files will be only partly readable.
The data on a disk is stored in tracks and sectors in an almost random manner. Data stored in a
bad sectors cannot be read.
RECOVER reads a file sector by sector and recovers data from the good sectors. You must
specify a
filename
.
Recover does not allow you to undelete a file.
Recover the files one at a time.
“Whom the gods love dies young” ~ Menander 300 BC
REG.exe
Read, Set or Delete registry keys and values, save and restore from a .REG file.
Syntax:
REG QUERY [
ROOT\]
RegKey /v
ValueName [/s]
REG QUERY [
ROOT\]
RegKey /ve --This returns the (default) value
REG ADD [
ROOT\]
RegKey /v
ValueName [/t
DataType] [/S
Separator] [/d
Data] [/f]
REG ADD [
ROOT\]
RegKey /ve [/d
Data] [/f] -- Set the (default) value
REG DELETE [
ROOT\]
RegKey /v
ValueName [/f]
REG DELETE [
ROOT\]
RegKey /ve [/f] -- Remove the (default) value
REG DELETE [
ROOT\]
RegKey /va [/f] -- Delete
all values under this
key
REG COPY [\\
SourceMachine\][
ROOT\]
RegKey
[\\
DestMachine\][ROOT\]
RegKey
REG EXPORT
[ROOT\]RegKey FileName.reg
REG IMPORT
FileName.reg
REG SAVE [
ROOT\]
RegKey FileName.hiv
REG RESTORE
\\MachineName\[
ROOT]\
KeyName FileName.hiv
REG LOAD
FileName KeyName
REG UNLOAD
KeyName
REG COMPARE [
ROOT\]
RegKey [
ROOT\]
RegKey [/v
ValueName] [
Output] [/s]
REG COMPARE [
ROOT\]
RegKey [
ROOT\]
RegKey [/ve] [Output] [/s]
Key:
ROOT :
HKLM = HKey_Local_machine (default)
HKCU = HKey_current_user
HKU = HKey_users
HKCR = HKey_classes_root
ValueName : The value,
under the selected RegKey, to edit.
(default is all keys and values)
/d
Data : The actual data to store as a "String", integer etc
/f : Force an update without prompting "Value exists,
overwrite Y/N"
\\
Machine : Name of remote machine - omitting defaults to current
machine.
Only HKLM and HKU are available on remote machines.
FileName : The filename to save or restore a registry hive.
KeyName : A key name to load a hive file into. (Creating a new
key)
/S : Query all subkeys and values.
/S
Separator : Character to use as the separator in REG_MULTI_SZ
values
the default is "\0"
/t DataType :
REG_SZ (default) | REG_DWORD | REG_EXPAND_SZ |
REG_MULTI_SZ
Output : /od (only differences) /os (only matches) /oa (all) /on
(no output)
To save a directory path with a trailing backslash (
\
) requires adding a second backslash to
'escape the escape'
so for example instead of
"C:\My Docs\"
use
"C:\My Docs\\"
Chia sẻ với bạn bè của bạn: