Windows – Access Windows Registry from Ubuntu

You can load another windows hive right in Windows using regedit, no need to use a third party software.

Connect the drive to another Windows PC as secondary or use a usb adapter.

When in registry editor, highlight HKLM (or whichever hive you need to load), then do a File>load hive navigate to (drive letter):\WINDOWS\System32\config of the crippled drive and highlight the file "Software" (or navigate to another hive you need to load) hit ok, it will ask you to name the hive it is about to load, give it a unique name like Test, hit OK, it will load the hive under HKLM with the name Test, Make and changes you need then highlight "Test" and do File>Unload Hive. Be sure to have the Test key highlighted when you select unload.

I have never encountered problems using this method but thought I should post the "possible" risks see this article

Note WinXP has a new feature called Registry Repair and Recovery (MS KB Q815011) and it is usually activated when starting WinXP. But it is also activated when loading an offline hive, which can have the undesired effect that the loaded hive is modifying behind your back. One can disable this feature in WinXP SP1 in case one is afraid that the "Repair" feature will do more harm than good: [HKEY_LOCAL_MACHINE\ System \CurrentControlSet \Control \Session Manager \Configuration Manager] SelfHealingEnabled = 0

I have never done this using a W7 PC either, which has a more aggressive self healing mechanism. but seems to be related to the files system rather than the registry, one would assume it also has a self healing registry similar to XP.

Other offline registry editing tools.

Bart PE

PC Regedit

The Windows registry was created long after DOS was discontinued. As such, there is no native way to do it, and (not surprisingly) there do not seem to be any DOS programs to do it. Aside from perhaps FreeDOS or ReactOS, it is unlikely that anybody will ever bother to write a Windows registry-editor for DOS.

That said, there is a way you can access and even edit the Windows registry from DOS, but it is not pretty. You would have to use a file-editor (edit.com is not going to cut it) to access the registry hive files directly. For example, to access HKLM\Software, you would open C:\Windows\Config\Software, or to access a user’s hive, you would open C:\Users\<username>\NTUSER.dat. And this is all assuming that the Windows system drive is even FAT32 since DOS cannot access NTFS without a special driver, most of which only allow read-only access.

Like I said, this method is not pretty because you would need to be familiar with the raw file-format of the Windows registry, be wary of entries that are visible in the file but marked as deleted, and be incredibly careful making any modifications because doing it like that is super risky. As such, this method is highly unadvised (even I don’t bother with it, and I like to crack everything open to look inside).

A much easier and safer method is to simply copy the hive files to another Windows system and mount them (e.g., reg load hku\zzz x:\ntuser.dat), do whatever you need to, then unmount them (e.g., reg unload hku\zzz), and copy them back.