| 摘要 |
<p>A method for accessing a Window's registry file on a selected file system to allow the registry file to be read or manipulated comprises determining the file's starting sector, its length, reading and decoding the file by converting any file offsets into a physical sector + byte offset, reading the physical sector, proceeding to the byte offset, and ascertaining if the byte offset corresponds to location of a registry key or registry value of interest thereby to reveal the location of registry data on the file system.</p> |
