Registry snapshots

Some antispyware tools (for example HijackThis) can provide a snapshot of important parts of the registry and as such are useful in a wider context. Unfortunately Hijackthis cannot be used in batch mode (or at least I do not know how to use it in a batch mode).

As for monitoring generally periodic snapshots are enough (it's a good practice to dump the content of important parts of your registry in the morning or at the end of the day; it can be a scheduled job), but there are specialized tools too.

Several tools from Microft Resource Kits for Windows can do snapshots of the registry:

REG: This tool enables you to add, change, delete, search, backup, restore, and perform other operations on registry entries from the command prompt or a batch file. It can be used on both local and remote computers. Note: This version of REG is in fact version 1.10 from the NT4 Resource Kit. It works with Windows 2000 but is not the version 2 that comes with the 2000 Reskit and is very much updated and with differing syntax to version 1.10, nor is it the version 3 that comes bundled with Windows XP (Thanks Pete!)

REGBack: Registry Backup - Registry Backup (RegBack) is a tool for backing up the Windows Registry to files without use of a tape drive. RegBack allows you to back up Registry hives while the system is running and has the hive files open.

REGFind: RegFind is a command-line tool with which you can search the Windows 2000 registry for arbitrary data, key names, or value names and optionally replace any of these with new values.

REGINI: Registry Change by Script - This tool uses character-based batch files to add keys to the Windows 2000 registry by specifying a registry script.

REGRest: Registry Restoration - Registry Restoration (RegRest) restores Registry hive files from backups created by RegBack.

Dureg: Registry Size Estimator - Shows how much data is stored in the registry, or in any registry subtree, key, or subkey.

RegSafe Professional Edition 2.0 is a suite of tools designed to provide Network Administrators, IS/IT professionals and Power Users with the ability to perform advanced Registry management on 32-bit Windows PCs. RegSafe provides comprehensive Registry editing and management capabilities not found in other professional level Registry editing tools, all from within a protected environment.

Top 5 Reasons For Using RegSafe^®

Protected Environment
RegSafe automatically saves a copy of the Registry before you edit and has "Undo" functions available while editing the Registry. Unlike other Registry editing tools, a mistake made while editing with RegSafe won't trash your system.
Registry Comparison
RegSafe goes beyond simple Registry Editing with its powerful Comparison features. Compare Current or Snapshot Registries, compare keys/values within the same Registry, compare access control lists (ACL) on Windows NT/2000 systems. You name it, RegSafe compares it!
Powerful Export Features
Administrators and other advanced users will appreciate RegSafe's export feature, which allows portions of a Registry or Registry comparison results tree to be exported to a .reg file (Regedit4 format).
Partial or Full Registry Restoration
If an unwanted change to the Registry was made, or a problem with the Registry is detected, RegSafe can perform a partial or full restoration of a Registry snapshot to the current ("live") Registry.
Registry Restoration for Non-booting Systems
RegSafe's Command Prompt SOS technology can restore the Registry even when your system will not boot into Windows. SOS restores the Registry on Windows 9x, ME, NT, 2000 systems with FAT, FAT32 and NTFS-formatted drives. In addition, RegSafe provides Recovery Console restoration on Windows 2000.

Copyright © 1996-2008 by Dr. Nikolai Bezroukov. www.softpanorama.org was created as a service to the UN Sustainable Development Networking Programme (SDNP) in the author free time. Submit comments This document is an industrial compilation designed and created exclusively for educational use and is placed under the copyright of the Open Content License(OPL). Original materials copyright belong to respective owners. Quotes are made for educational purposes only in compliance with the fair use doctrine.

Standard disclaimer: The statements, views and opinions presented on this web page are those of the author and are not endorsed by, nor do they necessarily reflect, the opinions of the author present and former employers, SDNP or any other organization the author may be associated with. We do not warrant the correctness of the information provided or its fitness for any purpose.

Last modified: March 15, 2008