{"id":21831,"library":"python-registry","title":"python-registry","description":"python-registry is a pure Python library for reading Windows Registry files (Windows NT, 2000, XP, Vista, 7, 8, 10, etc.). It supports both user and system hives, including registry transaction logs. Current version 1.3.1 is stable; releases are infrequent.","status":"active","version":"1.3.1","language":"python","source_language":"en","source_url":"https://github.com/williballenthin/python-registry","tags":["windows","registry","forensics","parser"],"install":[{"cmd":"pip install python-registry","lang":"bash","label":"pip"}],"dependencies":[{"reason":"Python 2/3 compatibility; required by the library.","package":"six","optional":false}],"imports":[{"note":"Module name is 'registry' (lowercase), not 'Registry'.","wrong":"from Registry import Registry","symbol":"Registry","correct":"from registry import Registry"},{"note":"RegistryKey is available directly from 'registry' module.","wrong":"from Registry.RegistryKey import RegistryKey","symbol":"RegistryKey","correct":"from registry import RegistryKey"},{"note":"Correct import for enum/value types.","wrong":null,"symbol":"RegistryValue","correct":"from registry import RegistryValue"}],"quickstart":{"code":"from registry import Registry\nimport os\n\nhive_path = os.environ.get('HIVE_PATH', '/path/to/SAM')\nreg = Registry(hive_path)\n# Iterate over root keys\nfor key in reg.root().subkeys():\n    print(key.name())","lang":"python","description":"Open a registry hive file and list its subkeys."},"warnings":[{"fix":"Ensure you point to a valid hive file path, not a registry key path like 'HKLM\\SAM'.","message":"The library only reads offline hive files (files on disk). It does not interact with the Windows Registry API on a live system. You must have access to the hive file (e.g., from a disk image or backup).","severity":"gotcha","affected_versions":"all"},{"fix":"Use RegistryKey.value().name (now str) and RegistryKey.value().raw_data() for the original bytes.","message":"In version 1.3.0, the RegistryKey.value() method now returns the value name as str (bytes in earlier versions). This can break code that expects bytes for binary values.","severity":"breaking","affected_versions":">=1.3.0"},{"fix":"Call find_key on the root key object: reg.root().find_key('SubKey')","message":"The Registry.find_key() method is deprecated since 1.3.0. Use RegistryKey.find_key() or recursive iteration instead.","severity":"deprecated","affected_versions":">=1.3.0"}],"env_vars":null,"last_verified":"2026-04-27T00:00:00.000Z","next_check":"2026-07-26T00:00:00.000Z","problems":[{"fix":"Change to: from registry import Registry (lowercase)","cause":"Using wrong import path with capital 'R'.","error":"ModuleNotFoundError: No module named 'Registry'"},{"fix":"Use RegistryParse class for recovery attempts or ensure the file is a complete hive (e.g., SAM, SYSTEM). For transaction logs, see RegistryLog class.","cause":"The file you're trying to open is not a proper registry hive (e.g., it's a registry transaction log or a different binary format).","error":"Registry.ParseException: File is not a valid registry hive"},{"fix":"Upgrade to python-registry >=1.2.0 which supports str paths on Python 3. If stuck with older version, convert paths to bytes: path.encode('utf-8')","cause":"Python 3 compatibility issue when passing paths or key names as str instead of bytes in older library versions.","error":"TypeError: expected bytes, str found"},{"fix":"Use RegistryKey.value_list() to get a list of RegistryValue objects.","cause":"The method for enumerating values is 'value_list()', not 'values()'.","error":"AttributeError: 'RegistryKey' object has no attribute 'values'"}],"ecosystem":"pypi","meta_description":null,"install_score":null,"install_tag":null,"quickstart_score":null,"quickstart_tag":null}