Windows 7's REG, version 6.1, has a
/F (Find) switch for the
Query command that allows us to specify a pattern instead of an exact value to look for.
REG Query /? will display the following help:
REG Query KeyName [/v [ValueName] | /ve] [/s] [/f Data [/k] [/d] [/c] [/e]] [/t Type] [/z] [/se Separator] KeyName [\\Machine\]FullKey Machine - Name of remote machine, omitting defaults to the current machine. Only HKLM and HKU are available on remote machines FullKey - in the form of ROOTKEY\SubKey name ROOTKEY - [ HKLM | HKCU | HKCR | HKU | HKCC ] SubKey - The full name of a registry key under the selected ROOTKEY /v Queries for a specific registry key values. If omitted, all values for the key are queried. Argument to this switch can be optional only when specified along with /f switch. This specifies to search in valuenames only. /ve Queries for the default value or empty value name (Default). /s Queries all subkeys and values recursively (like dir /s). /se Specifies the separator (length of 1 character only) in data string for REG_MULTI_SZ. Defaults to "\0" as the separator. /f Specifies the data or pattern to search for. Use double quotes if a string contains spaces. Default is "*". /k Specifies to search in key names only. /d Specifies the search in data only. /c Specifies that the search is case sensitive. The default search is case insensitive. /e Specifies to return only exact matches. By default all the matches are returned. /t Specifies registry value data type. Valid types are: REG_SZ, REG_MULTI_SZ, REG_EXPAND_SZ, REG_DWORD, REG_QWORD, REG_BINARY, REG_NONE Defaults to all types. /z Verbose: Shows the numeric equivalent for the type of the valuename. Examples: REG Query HKLM\Software\Microsoft\ResKit /v Version Displays the value of the registry value Version REG Query \\ABC\HKLM\Software\Microsoft\ResKit\Nt\Setup /s Displays all subkeys and values under the registry key Setup on remote machine ABC REG Query HKLM\Software\Microsoft\ResKit\Nt\Setup /se # Displays all the subkeys and values with "#" as the seperator for all valuenames whose type is REG_MULTI_SZ. REG Query HKLM /f SYSTEM /t REG_SZ /c /e Displays Key, Value and Data with case sensitive and exact occurrences of "SYSTEM" under HKLM root for the data type REG_SZ REG Query HKCU /f 0F /d /t REG_BINARY Displays Key, Value and Data for the occurrences of "0F" in data under HKCU root for the data type REG_BINARY REG Query HKLM\SOFTWARE /ve Displays Value and Data for the empty value (Default) under HKLM\SOFTWARE
As you probably know, searching the registry can be very time consuming.
Using the correct switches may save us a lot of time.
To search part of the registry, use the following syntax:
REG Query HKxx\subkey [/D|/K|/V] /F "search_pattern" /S [/E] [/C]
To search an entire registry hive, just omit the subkey:
REG Query HKxx [/D|/K|/V] /F "search_pattern" /S [/E] [/C]
/D to search the data (i.e. the registry values' values),
/K to search for matching key names,
/V to search for matching value names, or none of these switches to search keys, values and data.
/V are fast, searches with
/D or none of these switches are slow.
So make sure to use
/V if you do not need to search the registry data.
Hover your mouse pointer over the image to display the names of components.
/C for cases sensitive searches, and
/E for exact matches only (no partial matches).
My guess is that using
/C would make searches a fraction faster, especially when searching registry data.
To search remote registries, use:
REG Query \\remote_pc\HKxx\subkey [/D|/K|/V] /F "search_pattern" /S [/E] [/C]
Search for the string "C:\Program Files (x86)\ATI" in "HKEY_LOCAL_MACHINE\Software", no exact match (i.e. partial matches are allowed), case insensitive, search in keys, values and data:
REG Query HKLM\Software /F "C:\Program Files (x86)\ATI" /S
On my computer this search takes about 61 seconds.
Search for all values named "AppPath" in "HKEY_LOCAL_MACHINE\Software", exact matches only (e.g. RestoreAppPath is not a valid match), case insensitive:
REG Query HKLM\Software /V /F AppPath /S /E
On my computer this search takes about 7.5 seconds.
The same registry tree was searched, yet the difference in time is striking.
Searching for keys (
/K) is even faster!
Search for keys named "9.0":
REG Query HKLM\Software /K /F 9.0 /S /E
On my computer this search only takes 6 seconds.
My first batch file to take advantage of this technique is GetUninstall.bat.
It searches the registry for uninstall commands and displays only the ones whose name matches the specified search string.
|page last uploaded: 2017-07-06, 12:37|