I thought that accessing an "Offline" registry file is like parsing a
copy of a registry file that is not in use or, like you said, actively loaded by
the oprating system.
Registry files in Windows are normally located under
"C:\WINDOWS\system32\Config" for system hives and "C:\Documents
And Settings\Username" for user hives.
I open these files in "offline" mode everyday from Ubuntu using Wine
and tools like "MiTeC Windows Registry File Viewer" and
"RegRipper", so it is not impossibile to do.
Being able to use Autoruns instead of the above tools would be better for me
because it is more appropriate for my purposes.
I don't know what exactly autoruns is trying to do in the operating system
when accessing the "offline" registry files, here is the messages that
Wine shows in console when Autoruns gives the error:"Autoruns requires
Administrator privilege to analyze an offline system"
err:ole:CoGetClassObject class {148bd52a-a2ab-11ce-b11f-00aa00530503} not
registered
err:ole:CoGetClassObject no class object {148bd52a-a2ab-11ce-b11f-00aa00530503}
could be created for context 0x1
err:shell:SHGetFileInfoW pidl is null!
fixme:advapi:ImpersonateLoggedOnUser ((nil))
fixme:advapi:ImpersonateLoggedOnUser ((nil))
err:shell:SHGetFileInfoW pidl is null!
fixme:advapi:ImpersonateLoggedOnUser ((nil))
fixme:advapi:ImpersonateLoggedOnUser ((nil))
fixme:advapi:ImpersonateLoggedOnUser ((nil))
err:shell:SHGetFileInfoW pidl is null!
fixme:advapi:ImpersonateLoggedOnUser ((nil))
err:shell:SHGetFileInfoW pidl is null!
Thank you in advance for any hint or info.
