Accessing Windows Registry from Ubuntu

Posted on 05 Aug 2016

I needed to find the hostname of a PC, but I had its harddrive connected to my Ubuntu box as an external drive. Solution: Browse the registry file of the Windows PC using chntpw

sudo apt-get install chntpw
cd /media/myusername/WINDOWS/Windows/System32/config
chntpw -e SYSTEM

This loads the SYSTEM hive (the file containing everything that's related to HKeyLocalMachine\System). It can take a few seconds to load.

You can use "standard" cmd/bash commands to navigate the registry (use "?" for help). Find the number of the "current control set":

cd Select dir

(Look at "Current" value, usually 1) Go back and navigate to the key that contains the hostname (computer name):

cd ..
cd ControlSet001
cd Control
cd ComputerName
cd ComputerName
cat ComputerName

The cat command prints out the string of the variable ComputerName, which is the host name of the computer.

Use "q" to quit.