OfflineRegistryFinder and OfflineRegistryView are two new portable programs for Windows by NirSoft to view and search offline Registry files.
Offline Registry files are any Registry files that are not loaded currently by the Windows operating system; you can use OfflineRegistryFinder and other Nirsoft tools to create Registry snapshots that you can then load in the programs, or point both programs to folders that contain Registry files from other Windows installations.
Note that the program does not work with Registry backup files that you create.
Tip: while you can use the built-in Registry Editor to manage loaded Registry files, it is often much faster to work with offline copies instead; that is one of the main use cases that NirSoft’s programs offer.
OfflineRegistryFinder is a portable program for Microsoft Windows devices. It does not require installation and can be run from any location. The program is compatible with all versions of Windows starting from Windows XP up to the latest version of the operating system. The application is provided as a 32-bit and 64-bit version.
OfflineRegistryFinder provides you with options to scan Registry files stored on external drives to find specific Registry keys, values, or data of interest. A selection may then be exported as .reg Registry files for backup purposes or import using the built-in Registry Editor.
The application displays the search configuration window on start. You may use it to point it to Registry hive folders on the system by specifying paths. Another option that you have is to have it create a snapshot of the online Registry (the Registry of the system the program is executed on). Note that the latter requires elevation.
From there, it is a matter of specifying search parameters to use the program’s functionality. The following options are provided:
Set a time range for returned Registry keys, e.g. 10 days and “from” and “to” dates and time values.
Define types that should be included in search: key names, value names, values.
Add one or multiple search strings and specify whether Registry keys or values should contain the strings or match it exactly.
Binary or Dword value searches are supported as well.
Set the maximum number of Registry items that are returned by the program.
OfflineRegistryFinder scans the loaded files for matches and displays them all in its main window. The scan process is quite fast and all hits are displayed in individual lines in the interface.
Each hit is listed with the full Registry key, item type, value name, data type and length, actual value, key modification time, and the hive file it was found in.
A click on a column header sorts the data accordingly. Use the built-in search function to find Registry keys quickly using it.
You can export one, multiple or even all Registry keys to a .reg file. Just select the items that you want to save and right-click on the selection afterward and pick “export selected items to .reg file” from the context menu.
Select File > Registry Search Options or hit F8 on the keyboard to return to the search configuration window.
OfflineRegistryView is just a viewer for Registry files that supports search. It is also compatible with 32-bit and 64-bit versions of Windows starting from Windows XP all the way to the latest supported versions of Windows.
The program is portable and can be run from any location. You have to point it to a snapshot file or Registry files; it does not include an option to create a Registry snapshot of the current system. If you need to create it, use OfflineRegistryFinder for that.
The program displays data of a selected base key in the interface. You may specify a different key depth to include or exclude subkey data.
Options to save the data to a .reg file are provided but it is not possible to copy data directly from the interface.
OfflineRegistryView and OfflineRegistryFinder are two specialized programs by Nirsoft. Some users might have preferred a single application for both purposes instead of two programs as it would have made things easier.
The programs work well and provide exactly the functionality that you’d expect from them.
August 19, 2018