Extract registry key from NTBackup System State backup
A Windows Server 2003 machine died recently but I need some information that was contained in the now-defunct server's registry. I have a "System State" backup file created by the Windows Server 2003 built-in backup program (NTBackup.exe). Is there any way to extract a key/value out of the backup file?
I might be able do a Win2003 install on a similar machine then do a system-state restore but that's a lot of effort and I don't know for certain that the system-state restore will work on a different spec machine. (Would it work if I booted up in 'safe mode'?) But I'd really rather just get at the data straight out of the NTBackup file zip-file-esque styles if that's possible.
Restore the System State portion of the backup on another machine running W2K3 or Windows XP, choosing the "Single Folder" option for the "Restore files to" and picking some sensible "Alternate location" (like a directory you make for that purpose). You'll be warned about how this is an "advanced" feature and that not all files will be restore. For your purposes, that's fine.
You'll get back a lot of the "%SystemRoot%\System32" directory (a lot of DLL files, etc), and the registry, too.
From there, the instructions that Shial (who seems to look rather like SHODAN) posted are the right track. Fire up "REGEDIT", highlight "HKEY_LOCAL_MACHINE" in your local registry, then use the "File / Load hive..." option. Choose the file from the "Alternate location" corresponding to the part of the registry you want to extract data out of (these files have no extension):
- SYSTEM - HKEY_LOCAL_MACHINE\System
- SOFTWARE - HKEY_LOCAL_MACHINE\Software
- SECURITY - HKEY_LOCAL_MACHINE\Security
- SAM - HKEY_LOCAL_MACHINE\SAM
- DEFAULT - HKEY_USERS.Default
Choose any name you want when loading the hive, so long as it isn't a name that's already used under HKEY_LOCAL_MACHINE. You're "mounting" that hive into your live registry, not unlike mounting an NTFS volume under a directory (except that you don't have to make the registry key to mount the hive into like you would an NTFS mount point).
When you're done, unload the hive by highlighting the key where it's mounted (HKEY_LOCAL_MACHINE\whatever_name_you_chose) and doing a "File / Unload hive...".
I havn't done much with this on server 2003 but it should be the same as in xp. The registry is the set of files stored in c:\windows\system32\config, the various files without any extension (DEFAULT, SAM, SECURITY, SOFTWARE, SYSTEM) are the actual registry hives and you can manually mount them in regedit by selecting something like HKEY LOCAL MACHINE then going to File and and selecting the option to Load Hive then select the file you extracted, it should ask you for a name to import it under then you can access it from within there. Its under a subhive so it will not actually affect your normal registry. It has to be loaded inside one of the main hives, the option will be greyed out otherwise.