How to View Registry Items from Saved NTUSER.DAT

Question

I am trying to view registry items in a saved copy of NTUSER.DAT; how can I do so?

I want to do this because I had a crashed hard drive and want to get all my programs running again. I reinstalled Win10 and all programs from a USB drive backup, but now some programs refuse to run because they can't find their registry settings; I have a pre-crash backup of NTUSER.DAT and want to view it so I can find the missing items.

Answer 1

Registry hives, such as NTUSER.DAT, are a bespoke file format, with a number of ways of viewing them:

• Perhaps the cleanest is to use a third-party application such as:
  1. Ease of use: MiTeC's Windows Registry Recovery
  2. Forensic analysis: Eric Zimmerman's Registry Explorer

• If you don't want third-party tools, you can mount a registry hive using regedit:
  (You probably don't want to do this, and it requires local Administrator privileges)
  1. From Start Menu, find Registry Explorer/regedit
  2. In the left-hand tree pane select HKEY_USERS
  3. From the File menu, select Load hive...
  4. Select the file you want to mount [NTUSER.DAT]
  5. Give it a name [OLD] and you will now see the mounted hive under HKEY_USERS
  6. To unmount it, select the name you gave it [OLD], and from the File menu, select Unload hive

• Google search results

Answer 2

To load the NTUSER.DAT hive:

• GUI:
  1. +R → RegEdit → OK
  2. Highlight HKEY_USERS → File: Load Hive... → Select: NTUSER.DAT
  3. Arbitrarily name it → OK → Browse as normal
  4. Select: arbitrarily named hive → File → Unload Hive...
     
     
• CLI:
  1. Load hive:

     Reg Load "HKU\temp" "C:\Path\to\NTUSER.dat"
     

  2. Export key:

     Reg Export "HKU\temp\Path\to\Key" "C:\Path\to\Save\Exported.reg"
     

  3. Unload hive:

     Reg Unload "HKU\temp"
     

Answer 3

I appreciate the suggestions but I couldn't get any to work as I wanted. However, I did find a work-around: I created a shortcut to the troublesome EXE and changed its Properties (Compatibility Mode) to Windows 7. I also set Shortcut->Advanced->Run as Administrator. This did not actually answer my question as originally asked, but it did solve my problem.