Presentation of Malekal Live CD (Win10PESE v1607) features

1.1.10. Registry

In the "Registry" category of the start menu, you will find the programs:

• MiTeC Registry Recover: utility allowing to find many information in many places of the registry from the "SAM, SYSTEM, ..." files which compose it.
• Regalyzer : utility to analyze the registry of your Windows installation offline.
• RegScanner_NS : allows searching for data in the registry using keywords and other options.
• RegScanner_NS_RS : allows to launch this RegScanner program via the RunScanner program.
• RegShot : lets you create images (snapshots) of the registry to quickly detect changes that a program makes to the registry.
• Remote Regedit : opens the registry editor (regedit.exe).

When you launch the "MiTeC Windows Registry Recover" program, by default, it will not display anything.

For this to display the registry data of your Windows installation, you will need to click on: File -> Open.
Then, go to the "C:\Windows\System32\config" folder corresponding to your Windows installation and select the files: DEFAULT, SAM, SECURITY, SOFTWARE and SYSTEM.

Several sub-windows will appear.
One window per loaded registry file.

If you select the "SOFTWARE" file and go to the "Windows Installation" section, you can easily see the list of programs installed on your computer from this registry file.
In short, this allows you to quickly find the desired information from the registry offline without having to know all the paths of the desired keys.

When you launch Regalyzer, a message will appear telling you that the registry keys corresponding to your Windows installation have been loaded into "PE_*" subfolders of the root folders: HKEY_LOCAL_MACHINE and HKEY_USERS.

By default, RegAlyzer looks like this.

In the "HKEY_LOCAL_MACHINE" and "HKEY_USERS" keys, you will find the "PE_*" folders containing the registry data of your Windows installation.
Indeed, the other folders relate to the Windows PE where you are.

When you launch "RegScanner" (regardless of the shortcut used), a search window will appear and allow you to search for data in the registry according to the root key (HKEY_...), the data type (DWORD, STRING , ...), a keyword (Find String), ...

Then, the list of found data will appear in the RegScanner window.

Thanks to Regshot, you can quickly make an image of the registry and thus quickly find what a program modifies.

If you launch the "Remote Regedit" shortcut, the registry editor will appear.
This will allow you to browse the registry of your Windows installation.

1.1.11. Network

In the "Network" category of the start menu, you will find the programs:

• Mozilla Firefox: a web browser for surfing the Internet to find information online about a problem you are trying to solve on this computer and/or to download additional tools from the Internet.
• UltraVNC Viewer : a client to control a PC remotely using the VNC protocol.
• Wireless Network Watcher : tool to monitor who is connected to your network.

As you can see, this version of Mozilla Firefox will allow you to access all secure and non-secure sites without problems.
Which is not the case on older versions of this live CD.

The "Ultr@VNC Viewer" client allows you to control a PC remotely by indicating its IP address and port (where a VNC server is installed).

Thanks to Wireless Network Watcher, you will be able to quickly see the devices that are on your network, as well as easily locate your computer, as well as your default gateway (router) by looking at what is indicated in the "Device Information" column.

1.1.12. System Tools

In the "Network" category of the start menu, you will find the programs:

• Command Prompt: the command prompt (cmd.exe) of Windows 10.
• ImDisk Virtual Drive Management: allows you to create additional virtual disks stored in random access memory (RAM) or in image files.
• ReMount CdDrive Y: allows you to remount the CD and reassign the letter Y to it, in the event of a problem.
• Windows Setup\WinNTSetup3: allows you to customize a Windows installation.

As mentioned earlier, Command Prompt corresponds to the command prompt (cmd.exe) of Windows 10.

Thanks to ImDisk Virtual Disk Driver, you can manage your virtual disks, including the one created by default in the random access memory (RAM) of your computer and which has the letter "B".

If you want to create additional virtual disks in the random access memory (RAM) of your computer, refer to step "1.1.13. System Tools" of our article regarding the Win8PESE version of the Malekal Live CD.

The "Mount Cd Drive Y" shortcut allows you to mount the CD of this live CD in the CD/DVD drive with the letter "Y".
This can be useful in the event of a problem.

WinNTSetup 3 allows you to create a personalized installation of Windows by adding an unattended configuration file, drivers, ...