Yaru is a compact, portable Registry viewer with some very unusual features. For example, one of the reasons the Registry is a dangerous place is that when you delete something, there’s no “undo” (at least, not with Regedit); it’s gone forever. Yaru, however, can scan for and list at least some deleted Registry keys.
It tried this, going to HKEY_LOCAL_MACHINE\SYSTEM\Software on a test PC and deleting a leftover key. And sure enough, on launching yaru and clicking File > Open System, all the deleted keys were visible. A right-click option exports these to a file and this can be imported to Regedit to restore the missing data.
[advt]Yaru also has a powerful search tool, which can for instance find keys created during a particular date range, or look for text strings in unallocated Registry space. The program can also compare snapshots of a particular Registry hive. And yaru offers a host of reports to provide detailed information on every aspect of your target system.
Be the first to comment