python-registry

1.3.1 verified Mon Apr 27 auth: no python

python-registry is a pure Python library for reading Windows Registry files (Windows NT, 2000, XP, Vista, 7, 8, 10, etc.). It supports both user and system hives, including registry transaction logs. Current version 1.3.1 is stable; releases are infrequent.

pip install python-registry

Common errors

error ModuleNotFoundError: No module named 'Registry' ↓

cause Using wrong import path with capital 'R'.

fix

Change to: from registry import Registry (lowercase)

error Registry.ParseException: File is not a valid registry hive ↓

cause The file you're trying to open is not a proper registry hive (e.g., it's a registry transaction log or a different binary format).

fix

Use RegistryParse class for recovery attempts or ensure the file is a complete hive (e.g., SAM, SYSTEM). For transaction logs, see RegistryLog class.

error TypeError: expected bytes, str found ↓

cause Python 3 compatibility issue when passing paths or key names as str instead of bytes in older library versions.

fix

Upgrade to python-registry >=1.2.0 which supports str paths on Python 3. If stuck with older version, convert paths to bytes: path.encode('utf-8')

error AttributeError: 'RegistryKey' object has no attribute 'values' ↓

cause The method for enumerating values is 'value_list()', not 'values()'.

fix

Use RegistryKey.value_list() to get a list of RegistryValue objects.

Warnings

gotcha The library only reads offline hive files (files on disk). It does not interact with the Windows Registry API on a live system. You must have access to the hive file (e.g., from a disk image or backup). ↓

fix Ensure you point to a valid hive file path, not a registry key path like 'HKLM\SAM'.

breaking In version 1.3.0, the RegistryKey.value() method now returns the value name as str (bytes in earlier versions). This can break code that expects bytes for binary values. ↓

fix Use RegistryKey.value().name (now str) and RegistryKey.value().raw_data() for the original bytes.

deprecated The Registry.find_key() method is deprecated since 1.3.0. Use RegistryKey.find_key() or recursive iteration instead. ↓

fix Call find_key on the root key object: reg.root().find_key('SubKey')

Imports

Registry
wrong
```
from Registry import Registry
```
correct
```
from registry import Registry
```
Module name is 'registry' (lowercase), not 'Registry'.

RegistryKey

wrong

from Registry.RegistryKey import RegistryKey

correct

from registry import RegistryKey

RegistryKey is available directly from 'registry' module.

RegistryValue
```
from registry import RegistryValue
```
Correct import for enum/value types.

Quickstart

Open a registry hive file and list its subkeys.

from registry import Registry
import os

hive_path = os.environ.get('HIVE_PATH', '/path/to/SAM')
reg = Registry(hive_path)
# Iterate over root keys
for key in reg.root().subkeys():
    print(key.name())