Comparing registries ?

  • Thread starter Thread starter John Fitzsimons
  • Start date Start date
J

John Fitzsimons

I know there is payware for this, and I think freeware. If the latter
then what is currently available please ? I assume a standard text
file comparer would not work very well (at all ?) in this situation ?

Recommendations ?

Regards, John.
 
John wrote:


JF> I know there is payware for this, and I think freeware. If the latter
JF> then what is currently available please ? I assume a standard text
JF> file comparer would not work very well (at all ?) in this situation ?

Regshot will compare two "shots" of your registry.

http://regshot.ist.md/ (down at press time)
 
I know there is payware for this, and I think freeware. If the latter
then what is currently available please ? I assume a standard text
file comparer would not work very well (at all ?) in this situation ?

Recommendations ?

Of the two registry editors included in Windows NT-2000-XP:
Regedt32's text export format doesn't work well with standard text file
comparers. Regedit's works a little better, but only if all you're
trying to do is figure out which keys or values were recently added or
deleted. That's because Regedit doesn't really understand the new
REG_EXPAND_SZ values and just writes them out in a data dump format, and
because long-line wrapping is difficult to deal with in text-file
compares.

Beyond that, I guess you'd want a special-purpose program.
 
John Fitzsimons said:
I know there is payware for this, and I think freeware. If the latter
then what is currently available please ? I assume a standard text
file comparer would not work very well (at all ?) in this situation ?

John, what do you want to compare? *.dat files? *.reg files? Or do you
want to compare snapshots from different points in time?

Mainly, can you elaborate? Registry tools are my strongest interest,
but I'd want more of what you're looking for before suggesting one.


______
By the way, you're using 9x?
 
John Fitzsimons <[email protected]>:
Hi,
John, what do you want to compare? *.dat files? *.reg files? Or do you
want to compare snapshots from different points in time?

Well, I want to do a number of things. For example, sometimes during
upgrades my CD and/or DVD hardware doesn't install properly. Mainly
due to moving existing software and settings to the new drive.

In the past I solved the problem by installing the CD software on a
"clean" system and then importing the registry data, and files, to the
drive that didn't work.

Suppose my "new" drive was "A" and a clean drive was "B". I would
ideally like to know what keys etc. are in the "B" system but aren't
in the "A" system.

Not only would I like to compare registries on different drives but on
the same drive at different time periods.

Another thing that I would like (which probably doesn't exist) is to
merge two registry files and have a way to tell which line(s) came
from which registry.

In other words show the duplicates, and unique, lines "in situa".
Mainly, can you elaborate? Registry tools are my strongest interest,
but I'd want more of what you're looking for before suggesting one.
By the way, you're using 9x?

Yes. Thanks.

Regards, John.
 
John Fitzsimons <[email protected]>:

John, I plan to reply in depth later. But quick note now, one of the
most capable tools, for outputting changes to *.reg or *.csv, you'll
find it here:

http://www.epsilonsquared.com

Two programs there. Installwatch and Installrite are sort of twin siblings.
Installrite optionally makes an exe based on registry changes, but that's
the only functional difference I've detected. The only other difference is
the "front door" of each, when you launch, that's different one from the
other. The rest of the internals seem the same. Anyway, I just use both
of them.

There are some aspects of using this that I want to mention. A couple of
nuances about it. And some things to know about what it can do early on,
that I'll try to go into later. The main thing, is that its export of
changes, it offers it in *.csv and it also offers it in *.reg. What's cool
is you can customize your export request, tell it: give me a *.reg both of
before, and one of after, on just this hive, and just the adds or deletes
or value changes. (More plus tard)

[...]
Another thing that I would like (which probably doesn't exist) is to
merge two registry files and have a way to tell which line(s) came
from which registry.

In other words show the duplicates, and unique, lines "in situa".
[...]

Since you have some interesting tasks put forth in your message, I'm
going to read it through a few times...Give me some time to muddle.
 
John said:
Up now. Thank you. :-)

Heh:
_________________________________
HTTP Error 403

403.9 Access Forbidden: Too many users are connected

This error can be caused if the Web server is busy and cannot process
your request due to heavy traffic. Please try to connect again later.

Please contact the Web server's administrator if the problem persists.
_________________________________

Guess this is something that everybody's been looking for.

This download link worked for me for some reason though:

http://www.webattack.com/php/download.php?id=102888

and I'm sure an internet search would turn up others.

--
Regards from John Corliss
alt.comp.freeware F.A.Q.:
http://www.ccountry.net/~jcorliss/F.A.Q./FrameSet1.html
Note that I can't see Andy Mabbett's obsessive troll posts
because my I have him killfiled.
 
John wrote:

JC> Heh:
JC> _________________________________
JC> HTTP Error 403

JC> 403.9 Access Forbidden: Too many users are connected

Maybe, like "slashdotted", we can coin the phrase "that site
has been acf'ed".

Has a better ring to it IMO.
 
John Fitzsimons said:
Well, I want to do a number of things. For example, sometimes during
upgrades my CD and/or DVD hardware doesn't install properly. Mainly
due to moving existing software and settings to the new drive.

In the past I solved the problem by installing the CD software on a
"clean" system and then importing the registry data, and files, to the
drive that didn't work.

This, I assume, by identifying and then exporting the appropriate reg
keys, when booted into the one drive, and saving those as a .reg to import
into the other?

I have to say, while I spend a great deal of time reviewing and reigning
in modifications made to my system by software, I have overall shied away
from doing anything on the technical level with hardware.

The hkey_current_config & hkey_dyn_data sections of the registry is an
area I don't often look at and almost never monitor. The sole exception
might be once or twice doing some reg deletes on those ghost entries
from hardware history, eg all monitors and printers that have ever been
attached, which default to hiding forever in the registry.

I have never tried to transport anything related to hardware. I'm one of
those who just kicks the jukebox instead; (ie reboot nine consecutive
times, muttering incantations and curses, until that final fluke instance
where plugpray chooses to do its business). There are fundamental things
about hardware settings I don't understand. For instance, I've no idea
whatsoever about the story on any of these files: drvdata.bin, drvidx.bin,
*.pnf, *.cat. (And lowlevel *.vxds, while I know what they are, and have
read the docs on the ways in which they place themselves into system
config, I handle them generally with industrial gloves, keeping my
distance when possible.)

So, on this part, your having imported successfully the registry entries
and drivers from one drive to another, you've crossed terrain that I have
not.
Suppose my "new" drive was "A" and a clean drive was "B". I would
ideally like to know what keys etc. are in the "B" system but aren't
in the "A" system.

I've been puzzling this out. The idea of comparing a _complete registry_
between one drive and another. I mean, because, consider how incredibly
massive the registry is. I sometimes look at a specific key, to see what
the earlier setting was, but had not much thought into comparing a whole
registry.

I mean, to start, just think of the fact that a registry printed out is
30,000,000 pages (whatever the number is? just extremely high). Then the
hassle of all those binary values. And that many of those binary values,
not only are not decipherable, but often enough enough of little material
significance; for example, the way explorer rewrites a binary value each
moment you even glance at an icon on your desktop.

Just for the heck of it, I did some drive to drive comparing, for report
here. My system has three primary partitions, w98 on each.

P1: w98 active
installed 3.5 yrs ago

P2: w98 tmp
same as P1, from which it was ghosted.
except the ghosting was a few weeks ago.
so it's P1 3 weeks earlier in time

P3: w98 ~virgin
installed ~month ago, usage less than 25 hrs

There were a couple of times where I'd been booted into the w98 virgin,
and accidently clicked the wrong INCTRL.lnk. Meaning that Inctrl had a
"before" shot from my big+old w98 registry, and was accidently being asked
to compare it with the w98-new registry. The number of changes was more
that Inctrl could handle -- it froze, turned white, collapsed to the
floor.

I expected then that there would also be failure doing a compare of the
old w98 with the virgin one, if I tried with any other program, including
Installwatch. That the barrier might even be the weakness of my machine,
if not the program. However, turns out Installwatch pulled it off. I did
minimize what I asked it to analyze; yet still I was surprised to see
success in getting any analysis.

Settings I used. To compare the registry only. Also, to keeps thing
civil, I asked it to not even bother looking at user.dat (which isn't
too important anyway, not the way system.dat is). In other words, I
told it to process only HKEY_LOCAL_MACHINE.

The *.csv export of the registry differences, it has a file size
approaching 8 MB. I saved one *.reg file, a "before" shot (I forgot
to save an "after" shot). It's just over 1.1mb in size. There are a
couple of freeware *.reg file viewers available... Yet I can't find
any real use to look at this particular .reg file, not unless I was
hunting for data from a specific key.

The *.csv file, now while not suitable for any kind of import into the
registry obviously, at least it enjoys all the benefits of that format.
Despite the filesize, CSVdb opens it nicely, without even breaking
into a sweat. I can see using CSVdb to then toggle views, and delete
the fields that have more or less redundant information, plus delete
the entries that are fairly unimportant, until at last getting a
file offering some parsable/usable data. Data which one could have
as a reference bank when wanting to look into differences between
the two drives.

I also did a compare on my w98 active partition against P2, the
3-weeks-earlier image of it. This I've not bothered with exporting;
it was the one that had 3+ yrs difference held more curiosity to me,
to see how big the *.csv would come out. But let me do some numbers
in another way...

InstallWatch Report


3+ yr-old w98 install v a fairly new w98 install

5.3mb system dat v 2.3mb system.dat

HKEY_LOCAL_MACHINE -

54451 registry entries added
5184 registry entries deleted
3400 registry entries updated

[2] w98 active partition today, as compared to 3-4 weeks ago

HKEY_LOCAL_MACHINE + HKEY_CURRENT_USER

8315 registry entries added
7700 registry entries deleted
1014 registry entries updated
Not only would I like to compare registries on different drives but on
the same drive at different time periods.
[...]

You see how there tends towards big numbers involved, a tremendous amount
of intricate data....

Actually, while I'm aware that I've gotten nowhere in addressing your
request, those numbers have now got me tired out. <g> I'm going to halt
(wherever it was I was headed on this) for a bit, take a rest (shower,
errands, etc), to come back to the reg-data subject later on.
 

Hi Karen


changes, it offers it in *.csv and it also offers it in *.reg. What's cool
is you can customize your export request, tell it: give me a *.reg both of
before, and one of after, on just this hive, and just the adds or deletes
or value changes. (More plus tard)

< snip >

Golly, that seems rather interesting. Thanks for explaining all of
that. I must take a closer look at that program. Your help is very
much appreciated.

Regards, John.
 

Hi Karen,

This, I assume, by identifying and then exporting the appropriate reg
keys, when booted into the one drive, and saving those as a .reg to import
into the other?
Yep.

I have to say, while I spend a great deal of time reviewing and reigning
in modifications made to my system by software, I have overall shied away
from doing anything on the technical level with hardware.

I try to avoid messing with hardware setups but in the above case I
had to fix things or the hardware didn't work.

So, on this part, your having imported successfully the registry entries
and drivers from one drive to another, you've crossed terrain that I have
not.

I was told it wouldn't work BUT decided to find that out for
myself. :-)
I've been puzzling this out.

< snip >

Thanks. Notating your thinking was interesting reading. Thanks for
your time on this. :-)

Regards, John.
 
John, I plan to reply in depth later. But quick note now, one of the
most capable tools, for outputting changes to *.reg or *.csv, you'll
find it here:

Two programs there. Installwatch and Installrite are sort of twin siblings.
Installrite optionally makes an exe based on registry changes, but that's
the only functional difference I've detected.

< snip >

I might be missing something but AFAIK these programs do NOT record
zip installs. Which represents the majority of my downloaded files. Is
there something I am missing here ? If .zips can be monitored without
first unzipping then could someone please explain the steps required
please ?

Regards, John.
 
John Fitzsimons said:
I might be missing something but AFAIK these programs do NOT record
zip installs. Which represents the majority of my downloaded files. Is
there something I am missing here ? If .zips can be monitored without
first unzipping then could someone please explain the steps required
please ?

I don't run anything to do with its wizard. I didn't like the way it
was nagging me, and I much prefer to choose the start and stop points
of a registry monitoring session. I'm sure you're right that it can't
detect a number of auto-installs, probably is restricted to only
watching for files named setup.exe.

Try running it with the wizard disabled. First, let's say Installwatch;
I've decided that's the one I prefer, since it's one less screen to get
to the main interface (what it calls its "control panel").

Tools > Advanced > Configured > Misc Tab

[ ] Detect Setup Programs

I recommend keeping that box unchecked. I'm hoping there's not some other
config you have to do, beyond that one, to get it into the cleaner manual
mode. Try changing that one thing and see?

In the Installwatch main Control Panel screen, once you've set your options
for what part of the registry to monitor, and what preferences you might
have as far as directories and files monitored, then from there, it stays
pretty simple. You're just choosing between two buttons.

[Snapshot] [Analyze]

Analyze will be greyed out if the most recent act since last launching it
was doing an analyze (doing an install log), such that it does not have
a fresh "before" snapshot stored aside.

I've been running it reg log only, and it is lightning fast to take a
snapshot and do an analysis. Far faster than any other tool, even Inctrl.

<general rambling begin>

I haven't got around to spending too much time with its drive options,
although I like the version recording and a few other aspects. Note, the
one useless area is its ini compares.

On config for what part of the registry for it to monitor, maximum to
choose would HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE, since anything
more would be redundant. (It might already know that, but I haven't
checked, and have seen at least one registry related program that was
totally dumb about the reg architecture on that.

Note that this is a great snapshot tool. And its finest role is having
just a forever database of changes that take place on your system over
time. Well organized, readable, searchable, editable.

What it is not is an automatic uninstall tool. It can be used to uninstall,
but it means extra labor.

It does give you changed and deleted keys as they were before a monitoring
(of for instance an installation). So those can be merged back, if wanted.

For newly added keys, since those can be exported as reg files, you could
in principle add the the little minus signs into them, with a search &
replace text editor, to make them into undo reg files. Better would be
if there were a freeware version of what I've seen in payware. A tool
on your sendto menu that lets you send it reg files, and it automatically
makes them into "undo reg" files, merged into your registry, in one stroke.
Similar to the way as with using the Undo progam (forgetting name) with
Inctrl logs.

</general rambling?
 
Tools > Advanced > Configured > Misc Tab

Oops. Skip the menu. Make that ==> the "Configure" icon. Faster,
together with that it's natural to be already using the other icons:

Snapshot, Analyze, Export

And now I see the other place that the lame wizard tries to sneak in.
The Install icon on the left. I stay away from that. It's just messy
and ill-behaved, as far as I'm concerned.

Staying with Snapshot and Analyze, manual, keeps things under control,
and is fast.
 
Back
Top