I thought that accessing an "Offline" registry file is like parsing a copy of a registry file that is not in use or, like you said, actively loaded by the oprating system.
Registry files in Windows are normally located under "C:\WINDOWS\system32\Config" for system hives and "C:\Documents And Settings\Username" for user hives.
I open these files in "offline" mode everyday from Ubuntu using Wine and tools like "MiTeC Windows Registry File Viewer" and "RegRipper", so it is not impossibile to do.
Being able to use Autoruns instead of the above tools would be better for me because it is more appropriate for my purposes.
I don't know what exactly autoruns is trying to do in the operating system when accessing the "offline" registry files, here is the messages that Wine shows in console when Autoruns gives the error:"Autoruns requires Administrator privilege to analyze an offline system"
err:ole:CoGetClassObject class {148bd52a-a2ab-11ce-b11f-00aa00530503} not registered
err:ole:CoGetClassObject no class object {148bd52a-a2ab-11ce-b11f-00aa00530503} could be created for context 0x1
err:shell:SHGetFileInfoW pidl is null!
fixme:advapi:ImpersonateLoggedOnUser ((nil))
fixme:advapi:ImpersonateLoggedOnUser ((nil))
err:shell:SHGetFileInfoW pidl is null!
fixme:advapi:ImpersonateLoggedOnUser ((nil))
fixme:advapi:ImpersonateLoggedOnUser ((nil))
fixme:advapi:ImpersonateLoggedOnUser ((nil))
err:shell:SHGetFileInfoW pidl is null!
fixme:advapi:ImpersonateLoggedOnUser ((nil))
err:shell:SHGetFileInfoW pidl is null!
Thank you in advance for any hint or info.
