.\" -*- mode: troff; coding: utf-8 -*-
.\" Automatically generated by Pod::Man 5.01 (Pod::Simple 3.43)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" \*(C` and \*(C' are quotes in nroff, nothing in troff, for use with C<>.
.ie n \{\
.    ds C` ""
.    ds C' ""
'br\}
.el\{\
.    ds C`
.    ds C'
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\"
.\" If the F register is >0, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD.  Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.\"
.\" Avoid warning from groff about undefined register 'F'.
.de IX
..
.nr rF 0
.if \n(.g .if rF .nr rF 1
.if (\n(rF:(\n(.g==0)) \{\
.    if \nF \{\
.        de IX
.        tm Index:\\$1\t\\n%\t"\\$2"
..
.        if !\nF==2 \{\
.            nr % 0
.            nr F 2
.        \}
.    \}
.\}
.rr rF
.\" ========================================================================
.\"
.IX Title "hivexget 1"
.TH hivexget 1 2024-04-06 hivex-1.3.23 "Windows Registry"
.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH NAME
hivexget \- Get subkey from a Windows Registry binary "hive" file
.SH SYNOPSIS
.IX Header "SYNOPSIS"
.Vb 1
\& hivexget hivefile \*(Aq\ePath\eTo\eSubKey\*(Aq
\&
\& hivexget hivefile \*(Aq\ePath\eTo\eSubKey\*(Aq name
.Ve
.SH NOTE
.IX Header "NOTE"
This is a low-level tool.  For a more convenient way to navigate the
Windows Registry in Windows virtual machines, see \fBvirt\-win\-reg\fR\|(1).
For proper regedit formatting, use \fBhivexregedit\fR\|(1).
.SH DESCRIPTION
.IX Header "DESCRIPTION"
This program navigates through a Windows Registry binary "hive"
file and extracts \fIeither\fR all the (key, value) data pairs
stored in that subkey \fIor\fR just the single named data item.
.PP
In the first form:
.PP
.Vb 1
\& hivexget hivefile \*(Aq\ePath\eTo\eSubKey\*(Aq
.Ve
.PP
\&\f(CW\*(C`hivefile\*(C'\fR is some Windows Registry binary hive, and \f(CW\*(C`\ePath\eTo\eSubkey\*(C'\fR
is a path within that hive.  \fINB\fR the path is relative to the top
of this hive, and is \fInot\fR the full path as you would use in Windows
(eg. \f(CW\*(C`HKEY_LOCAL_MACHINE\eSYSTEM\*(C'\fR is not a valid path).
.PP
If the subkey exists, then the output lists all data pairs under this
subkey, in a format similar to \f(CW\*(C`regedit\*(C'\fR in Windows.
.PP
In the second form:
.PP
.Vb 1
\& hivexget hivefile \*(Aq\ePath\eTo\eSubKey\*(Aq name
.Ve
.PP
\&\f(CW\*(C`hivefile\*(C'\fR and path are as above.  \f(CW\*(C`name\*(C'\fR is the name of the value
of interest (use \f(CW\*(C`@\*(C'\fR for the default value).
.PP
The corresponding data item is printed "raw" (ie. no processing or
escaping) except:
.IP 1. 4
If it's a string we will convert it from Windows UTF\-16 to UTF\-8, if
this conversion is possible.  The string is printed with a single
trailing newline.
.IP 2. 4
If it's a multiple-string value, each string is printed on a separate
line.
.IP 3. 4
If it's a numeric value, it is printed as a decimal number.
.SH "SEE ALSO"
.IX Header "SEE ALSO"
\&\fBhivex\fR\|(3),
\&\fBhivexml\fR\|(1),
\&\fBhivexsh\fR\|(1),
\&\fBhivexregedit\fR\|(1),
\&\fBvirt\-win\-reg\fR\|(1),
\&\fBguestfs\fR\|(3),
<http://libguestfs.org/>,
\&\fBvirt\-cat\fR\|(1),
\&\fBvirt\-edit\fR\|(1).
.SH AUTHORS
.IX Header "AUTHORS"
Richard W.M. Jones (\f(CW\*(C`rjones at redhat dot com\*(C'\fR)
.SH COPYRIGHT
.IX Header "COPYRIGHT"
Copyright (C) 2009 Red Hat Inc.
.PP
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
.PP
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.
.PP
You should have received a copy of the GNU General Public License along
with this program; if not, write to the Free Software Foundation, Inc.,
51 Franklin Street, Fifth Floor, Boston, MA 02110\-1301 USA.