Installing Wine and using Windows Registry Recovery

[joetekno]

Wine Install

1. Click “Start”…System… Administration… Synaptic Package Manager
2. Click the “Search” button
3. Type “Wine”
4. Click the “Search” button
5. Click the “Wine” checkbox and select “Mark for Installation”
6. Click the “Mark” button
7. Click the “Apply” button
8. Click the “Apply” button
9. Exit “Synaptic Package manager” (File… Quit)

Copy the “Hive” files to your “/evidence/config” directory

1. Open a terminal window
2. Become the root user
a. Type: sudo su
3. Maneuver to the /evidence directory and create a subdirectory named config
a. Type: cd /evidence
b. Type: mkdir config

4. Mount your image file
a. See “Using CAINE and MMLS to mount an image of an NTFS drive” to do this

5. Copy the “Hive” files from the image to the /evidence/config directory
a. cp /media/evidence/WINDOWS/system32/config/* /evidence/config/

6. Change the permissions on the copied files to allow the mitec program to access them
a. chmod 666 /evidence/config/*

Downloading and Installing a Windows application using Wine

1. Open a browser and go to www.mitec.CZ
2. Download the “Windows Registry Recovery” application
3. Save the WRR.zip file to your desktop
4. Double Click the WRR.zip file
5. Right Click the WRR.EXE file and select “Open with…”
6. Select “Wine Windows Program Loader”
7. Click the “Open” button

Using the Mitec Windows Registry Recovery application

1. Select the File… Open… menu
2. Select /evidence/config…{some hive file}
3. Click the “Raw Data” button

Sam – HKEY_LOCAL_MACHINE\SAM
Security – HKEY_LOCAL_MACHINE\SECURITY
Software – HKEY_LOCAL_MACHINE\SOFTWARE
System – HKEY_LOCAL_MACHINE\SYSTEM
Default – HKEY_USERS\.DEFAULT