0

I would need to know how to retrieve regional settings from the Windows registry, from a Windows (7 or 10) partition mounted on a Linux system. Please, note that I cannot use Windows directly.

The best would be to to display them directly into the terminal, but I guess it will not be as easy as using cat registry_file | grep key.

I am mainly interested in registry keys such as sCountry, Locale, LocaleName and sLanguage (but there could be more I am not aware of, since I am more a Linux person). As far as I could see, these keys are scattered system-wide or in each user directory for different purposes but I could not find a final answer on how to read these keys, especially for one user in particular.

Is it possible to achieve that in this situation?

My question is not a duplicate ; I already looked at:

Paradox
  • 738
  • 12
  • 30
  • Possible duplicate of [Editing Windows registry, from Python, Under Linux](https://stackoverflow.com/questions/1666690/editing-windows-registry-from-python-under-linux) – Joseph Sible-Reinstate Monica Mar 06 '19 at 02:59
  • My question differs because I do not really where are these keys, how they can interact or override themselves (in order to determine which ones I am really interested in). Hence my question, but it may be too broad. – Paradox Mar 06 '19 at 03:02
  • Find which ones you care about from inside Windows with plain ol' `regedit`, then use the paths you find in Linux. – Joseph Sible-Reinstate Monica Mar 06 '19 at 03:05
  • I cannot do it from Windows directly. Moreover, apart from `locale` (which I am not already so sure about), I do not know where to find the others. – Paradox Mar 06 '19 at 03:08
  • @JosephSible I check the possible duplicate you were refering to. It is outdated: it covers all windows up to 7 only, all but one project quoted in it are not there anymore and documents seems sort of outdated as well, even if I just browsed them. – Paradox Mar 06 '19 at 03:31

1 Answers1

3

Locale Registries

The desired system locales are stored at:

HKEY_USERS\.DEFAULT\Control Panel\International\sCountry

HKEY_USERS\.DEFAULT\Control Panel\International\Locale

HKEY_USERS\.DEFAULT\Control Panel\International\sLanguage

The sCountry is only used for the notation format, you could also use the Locale info and link it to this table:

https://msdn.microsoft.com/en-us/library/ee825488(v=cs.20).aspx

Additionally, you could take a look on the following registry:

HKEY_CURRENT_USER\Control Panel\International\Geo\Nation

Which stands for the current location as in the following table:

https://msdn.microsoft.com/en-us/library/windows/desktop/dd374073%28v=vs.85%29.aspx?f=255&MSPPError=-2147217396

Registries Location on Filesystem

From grawity's answer on: https://superuser.com/a/289963

  • Registry: HKLM\SYSTEM

    File: \WINDOWS\system32\config\system

    • Registry: HKLM\SOFTWARE

    File: \WINDOWS\system32\config\software

    • Registry: HKU\<user-SID> (aka HKCU)

    File: <home>\NTUSER.DAT

    • Registry: HKU\<user-SID>_Classes (aka HKCU\Software\Classes)

    File: <home>\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat

    File: <home>\AppData\Local\Microsoft\usrclass.dat – as of Windows Vista

    • Registry: HKU\.DEFAULT (the system account)

    File: \WINDOWS\system32\config\default

Note that HKU\.DEFAULT is the system account. It is not the template account.

The template account's files are at \Documents and Settings\Default User (substitute for <home> above).

Editing tools

  • hivex:

    This program provides a simple shell for navigating Windows Registry 'hive' files. It uses the hivex library for access to these binary files. https://linux.die.net/man/1/hivexsh

  • chntpw:

    chntpw is a utility to view some information and reset user passwords in a Windows NT/2000 SAM userdatabase file (...). In addition it contains a simple registry editor and a hex-editor with which the information contained in a registry file can be browsed and modified. http://manpages.ubuntu.com/manpages/cosmic/man8/chntpw.8.html

Additional references:

How to find world region (or country) or language from the windows registry? https://superuser.com/questions/289955/access-windows-registry-from-ubuntu/289963#289963 https://unix.stackexchange.com/questions/214856/how-can-i-access-the-windows-registry-from-linux

jmiguel
  • 349
  • 1
  • 9