Most of the Registry hives are located in the \Windows\system32\config directory but some in other locations like Document and Settings. To analyze the NTuser hive one would load the file NTUSER.DAT which is located in the \Documents and Settings\username\ directory, select a name for the text document in the second step, select ntuser from the plugin list and click the Rip It button.

The analysis will save various system information in the text document which depend on the analyzed Registry hive. The analysis of the NTuser hive will for example reveal information about the logon username, installed applications, system and remote drives, various recent files lists, the programs that have been accessed recently and software that will start with the computer system.

Registry Ripper is a Registry analyzer that requires some knowledge about the locations of the various Registry hives on the computer system. It clearly aims at more advanced users and can provide the user with all kinds of useful information about a computer system and its users.

One of the things that bothers me the most is when I open the Windows Registry to edit a key and it loads up showing me the last key I had viewed. I normally go into the Registry to make one change and that’s it. I never go back and edit the same key. Wouldn’t it be great if you could open the registry and all the hives would load up collapsed like you opened it for the first time ever?

Luckily, there’s a little shortcut you can create to the registry that will get rid of that annoying little feature. It’s actually a script with a few lines of code. Just open Notepad and paste in the following lines of code:

Dim objShell, RegKey, Q

Set objShell = CreateObject("WScript.Shell")

strQuote = chr(34)

RegKey = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit"

RegKey = RegKey & "\LastKey"

objShell.RegWrite RegKey, ""

objShell.Run "regedit"

Save the file with a .VBS extension, which stands for Visual Basic Script. To do this in Notepad, choose All Files for the Save as type combo box and name the file “Registry.vbs” without the quotes.

So now instead of opening the Registry and getting something that looks like this:

You can easily start from the very top of the Registry hives like normal!

If you want to make if more official, you can change the icon for the VBS script file to the Registry icon. In order to do this, you have to create a shortcut to the script. Just right-click on Registry.vbs, click on Send To, and then click on Desktop (create shortcut).

Now right-click on the shortcut icon and click on Rename. Name the shortcut Registry. Next right-click again and go to Properties. Click on the Change Icon button.

Choose the Registry icon from the list of icons. Finally you can copy your shortcut to the Start Menu for easy acce