Difference between "reg save" and "reg export"?
The generated file is the difference.
save
saves the branch into the Registry's native "hive" format. This preserves key ownership and ACLs, so is best suited for backups and restoring on the same machine.
export
exports it into a textual format, suitable for distribution since the .reg format does not preserve any metadata.
It's not just that the generated files are different. I noticed that what happens when you use the .reg file vs when you use the .hiv file is quite different
When you import a .reg file, you don't have to specify a path. It writes to your registry based on the .reg file, and leaves new registry keys and entries created between export and import untouched.
Whereas when you import a .hiv file, you have to specify a path. New registry keys and entries created between export and import are deleted.
Here's an example to illustrate.
-
Create a dummy key with a dummy entry
reg add hkcu\test reg add hkcu\test /v entry /t REG_DWORD /d 1
-
If you run
reg query hkcu\test
you will see thisHKEY_CURRENT_USER\test
(Default) REG_SZ
entry REG_DWORD 0x1
-
Export to a .reg file and to a .hiv file
reg export hkcu\test test.reg reg save hkcu\test test.hiv
-
Then create a new entry and a new subkey
reg add hkcu\test /v new_entry /t REG_SZ /d "ayy lmao" reg add hkcu\test\new_key
-
If you run
reg query hkcu\test
you will see thisHKEY_CURRENT_USER\test
(Default) REG_SZ
entry REG_DWORD 0x1
new_entry REG_SZ ayy lmao
HKEY_CURRENT_USER\test\new_key
-
Import the .reg file we created earlier
reg import test.reg
If you run
reg query hkcu\test
, you will see the same output from #5. -
Import the .hiv file we create earlier
reg restore hkcu\test test.hiv
If you run
reg query hkcu\test
, you will find that the new items we created in #4 is gone and we get the same output as #2.