request recomendation for "offline" registry hive diff utility
in [Security]
|
From: John Wunderlich on 14 Feb 2010 01:20 =?Utf-8?B?R3JhbmRwYUZlcnJldA==?= <GrandpaFerret(a)discussions.microsoft.com> wrote in news:1E8B28A2-F4F7-48E0-A72F-A0025D449872(a)microsoft.com: > John, > > I get it now. Forgot to look at changing the file type in the > export dialog box. That little weird way of thinking about stuff > has always screwed me up. > I am much happier in unix land, mostly solaris, some irix, some > linux. > > You will probably get a grin over another screwup I made. made a > restore point, then imported/expored the two "before" hive files. > Then restored to the restore point I made in preperation for doing > the two afet files. Did the two after files and then noticed my > two before .reg files were missing. > > duh. (red face) > > thanks for the help! > Glad you got it working. Probably a better way to get a copy of the registry than creating Restore points is to use the freeware program "ERUNT" which will backup your registry to an easy-to-get-to folder. ERUNT: <http://www.larshederer.homepage.t-online.de/erunt/> HTH, John
From: Jim on 14 Feb 2010 11:10 "GrandpaFerret" <GrandpaFerret(a)discussions.microsoft.com> wrote in message news:AD7AE2EE-7E83-4CF2-8369-F3F0E1D94318(a)microsoft.com... >I have two sets of system, system.LOG, software, and software.LOG hive >files. > One set is "before", the other is "after". > > I am looking for a good utility that will let me compare them, and having > trouble finding one. There are two requirements that I have having > trouble > finding a tool that can fulfill: > > 1) I dont have a full set of registry files... just these four, basicly > the > system hive and the software hive. > > 2) Both sets are "off-line" (not part of an actively running os. > > Running WinXP Pro with current updates (SP1-3, plus 80+ wupdate updates.) > > Thanks for the help. > The five hive files are SYSTEM, SOFTWARE, SAM, SECURITY and HARDWARE. These files have no extension. The HARDWARE hive is manufactured new at each boot of the computer. It may be super hidden. The contents of the SAM hive are not documented as far as I know. It may be super hidden anyway. I have no knowledge about the contents of the SECURITY hive. The files with the .LOG extension are transaction logs of the changes to a hive. Files with the SAV extension contain a copy of a hive made at the end of the text mode phase of the Windows setup program. It may be possible to compare versions of the SYSTEM and SOTWARE hives. But, it is pointless to try to compare the SYSTEM and the SYSTEM.LOG files (for example). You can find lots and lots of interesting information in "Microsoft Windows Registry Guide" by Jerry Hunnicutt. This book is published by Microsoft Press. Jim
From: GrandpaFerret on 15 Feb 2010 12:02 John/Jim, Thank both of you for your help and for the references (utilities and book.) I did the comparison on the system.before/system.after and and the software.before/software.after files. Interestingly, although the XP "DOS" FC command said there were lots of differences, windiff on the exported .reg files said they were identical. I actually went back and re-did the procedure to make sure I was exporting and comparing the correct sets of files and got the same result. I am a little puzzled over this. A little regression might be of intrest at this point. So, what is "before" and "after" you may be wondering? I wanted to get a "not hot" backup of my winXP install. Something I learned the hard way from my VMS days and have had confirmed in my life in the beastie called UNIX. So after I did the first ("real") install of winXP, I booted off of a "Fedora Live" cd and made copies of the hive files. These became my "before" set. I then did a (almost) unatted(ed) install of winXP ("scratch") into a different partition. Then I booted Fedora Live again and made the "after" copy of the hive files. Then I booted into the 2nd winXP ("scratch") install, installed PQ's DriveImage 7 and made a backup of the 1st winXP ("real") install. I had actually done this whole process before except that instead of backing up the hives I simply did a recursive directory listing (with date and size). I was expecting there to be no differences in these listings as the 2nd winXP ("scratch") install should not have any effect on the first ("real"). Wrong! There was the overlooked modification to boot.ini. Okay. That one I get. There were also changes in the directory listings indicating that the install of the 2nd winXP OS ("scratch") had caused the addition of restore points TO THE FIRST winXP OS's ("real") "root drive" (C: in this case)... (totally unexpected) as well as modifying the first winXP ("real") OS's "software" and "system" hives (again, totally unexpected.) So when I had to redo all of this for an unrelated reason, I did the above mentioned saves of the two hive files. I then did comparisons of the before and after system and software hive files, and got the results I mentioned at the beginning of this post. I would love to know why in the world the 2nd install of winXP ("scratch") is effecting the first ("real"). I get boot.ini mod; its the restore points and the hive changes I am asking about. As well as why that change shows up only in the actual hive files but not in the "reg" exports. Thanks guys.
From: GrandpaFerret on 15 Feb 2010 12:09
Amendment to my last post. Sorry... I goofed one point in my last post. I get the addition of the restore files on the "real" "root drive" (C:) by the install of the "scratch" version of winXP on the L: drive. Its the mod's to the "real" OS's hive files that I am interested in. Thanks. |