Windows registry hive viewer

The Windows registry is not one database but several hive files: NTUSER.DAT in the profile, UsrClass.dat beside it, SOFTWARE and SYSTEM in the system folder. The built-in registry editor only ever opens the registry of the running system, which leaves a hive from an old disk, a backup or a disk image with nothing to read it. This tool reads such a file directly, and does something the Windows API cannot do at all: it finds deleted keys. Deleting in the registry flips a cell to "free" and unlinks the record from its parent, but the name, the timestamp and the values stay on disk until the room is reused.

1
Load the hive

Drop an NTUSER.DAT from a profile, a UsrClass.dat, SOFTWARE, SYSTEM or any other hive file — off an old machine's disk or out of a backup.

2
Look at the tree

Keys on the left, the selected key's values with their types on the right. If the hive is damaged, the tool says exactly what it had to step around.

3
Take what you need

A .reg file Windows imports by itself, or a CSV of every deleted record that was found.

Open a registry hive and find the deleted keys still inside it

Drop a file here
Registry hives: NTUSER.DAT, UsrClass.dat, SOFTWARE, SYSTEM, SAM, .hiv, .dat ·
Published Updated Author: