How to scan the registry in a backup copy of Windows?

I have a backup of Windows - a Macrium Reflect image backup - and want to scan the registry in it. I can mount the image copy and access it from Windows but don't know where to go after that. I would like to the NirSoft RegScanner but I don't think it has that capability so I'm willing to use RegEdit if I must.

I've read a description of doing this with RegEdit, but it sounded like RegEdit would modify the existing registry in order to access the external copy. That makes no sense to me so I suspect I misunderstood, but I don't want to try until I understand the process better.

And on a related topic, I've used RegScanner for years and feel comfortable with it, but are there better tools? I have no desire to modify the registry from the tool - just scan for and view registry records, and, if needed, create RegEdit input if a modification is needed. (I may be paranoid, but I don't want a 3rd party tool making bulk changes to the registry.)

Win 10 21H1 (build 19043.1415)

Hi,

If you are used to Regscanner, You can use it as you where in Windows PE to load the offline Hives.

You can also load them the old fashion way with regedit.

Bree said:

... Have you ever used a Hyper-V virtual machine? Did you know that you can run a Macrium image as a virtual machine using the viBoot tool? Then you would be free to use any tools you like....
Macrium viBoot - Create Virtual Machine using Macrium Image

I activated Hyper-V support a couple weeks ago, but have never delved into virtual machines. That includes Macrium's viBoot. I consider such things a bit above my pay grade, but maybe it's time I look into it. (I did consider it earlier today.)

A safe way is to copy the hives out of the image into a folder e.g. on your desktop.

You can then load those hives and search them. You will find default, software and system hives in \windows\system32\config

Depending what you are looking for some of the info could be in users\yourusername\ntuser.dat ( which is also a hive)

It is quite easy to load them from the folder on your desktop in regedit or similar and scan with regscan or whatever.

If you are not sure where to look, you can check hklm\system\currentcontrolset\control\hivelist
They will be in the corresponding places in your image

Bree said:

With viBoot you can have a Hyper-V VM set up and running in a couple of minutes, one more if you want it to access the internet. ...

You're right. That was painless. It would be nice to figure out how to give one of my USB ports to the VM, but that's for a future date.

SIW2 said:

A safe way is to copy the hives out of the image into a folder e.g. on your desktop.
You can then load those hives and search them. You will find default, software and system hives in \windows\system32\config
... It is quite easy to load them from the folder on your desktop in regedit or similar and scan with regscan or whatever.

I'll give that a try when I get time. I'm not sure I can tell RegScanner to look anywhere other than \windows\system32\config.