Code snippets

Windows Registry

To open a specific Windows Registry key from a specific Windows Registry file:

from dfwinreg import registry
from winreg_kb import collector

filename = 'NTUSER.DAT'

collector_object = collector.WindowsVolumeCollector()
collector_object.GetWindowsVolumePathSpec(filename)

registry_file_reader = collector.CollectorRegistryFileReader(collector_object)
win_registry = registry.WinRegistry(registry_file_reader=registry_file_reader)

Windows Registry keys

Retrieving a key by its path

key_path = 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion'

registry_key = win_registry.GetKeyByPath(key_path)

Iterating the subkeys

for subkey in registry_key.GetSubkeys():
    print subkey.name