RegdatXP reads non active NT based registry files like ntuser.dat and Software and compares them to the current Registry.

It has Search and Replace functions for the Registry. Registry Backups can be done by command-line arguments. The full version can recover data from corrupt registry files, repair a corrupt file directly in many cases, and remove user passwords from offline Sam files. See also Regrecover by the same author for a software that can rebuild corrupt registry hives.

1. Backup Registry
A user with administrative rights can backup the Registry to a directory of choice. RegdatXP uses the following file names to backup Registry files.

2. Repair corrupt registry file
If a registry file is severely damaged the system load process will usually result in a blue screen of death (BSOD), like the ones below, or even in an automatic reboot loop. If one of the user registry files ntuser.dat, or classes.dat, is corrupt then the user, upon logon, will be forced into a temporary default user profile and can no longer use his personal settings. A corrupted ntuser.dat file could also cause a reboot loop at startup.

3. Export Hive to binary file
Recreate Hive, this saves a Hive to a new binary registry file. It should be used for corrupt registry files that can not be repaired, or when repairing them causes too much loss of data, or when RegdatXP does not find corrupted items. The new file will contain all information that still can be extracted from the corrupted file. You can choose to export security settings too, or, using default security settings instead. The user must have administrative rights. This is available in the full version.

4. Hidden Bytes
This searches for oversized strings containing embedded nulls or hidden bytes. Any string in the Registry has an associated length value. If this value happens to be larger than the actual length of the string, additional bytes can be stored after the end of the string. These bytes are normally not being displayed since they are located after a terminating zero, making it a so called embedded null.

5. Remove or Save Slack
Slack means bytes that are not currently used by the structure. For example, if a Registry value gets deleted, it is not overwritten immediately, but just flagged as deleted, which is faster. It continues to contain the old value name until it's reused again by some other key or value.

6. Security Records
Permissions to registry keys are determined by security records where different keys may have the same security record. Each security record has a discretionary access-control list (DACL), and a system access-control list (SACL), where each list contains a number of Access Control Entries (ACEs.) Each ACE stores permissions for a unique SID along with a few flags indicating, for example, if the permissions are inherited to newly created sub keys. This has been documented in US Patent 6625603. Usually the allow/deny type ACEs make up the DACL, while the audit type ACEs are located in the SACL. RegdatXP can generate lists of all security records/ACEs of the opened files. It can display all ACEs for a specified SID.

RegdatXP can also generate kind of snapshot files which can be compared to later Registry states. In contrary to Backup files, however, the snapshot files cannot be used to replace original registry files.
There may be situations where one wants to view, or export, keys from a WinNT/2K/XP registry file while being on a Win9x/Me platform.

Limitations:
* Recursing subfolders and saving output lists is partially disabled
* Nag screen

The license of this software is Free Trial Software, the price is $38.00, you can free download and get a free trial.