REGFIND hive[\key[\...]] | all [/W] [/N] ...
... [/D [filter]] [/v|/V [filter]] [/k|/K [filter]] [/t|/T [filter]]
hive = khcr | hkcu | hklm | hku
The default matching for key, value, and data filters is case-insensitive substring matching
/w - (or /W) use wildcard (simple, * and ?) matching instead of the default
Specify this option before specifying any filters
At least one of /d, /D, /v, /V, /k, /K, /T must be specified
/d - (or /D) search data
/v - limit data search to value names matching filter
/V - also search for and print matching value names
/k - limit value/data searches to key names matching filter
/K - also search for and print matching key names
/t - limit value/data searches to keys with write time matching time filter and output times
time format: USER_DEFAULT_SHORT_DATE<space>USER_DEFAULT_TIME
use /tm for milliseconds, /tu for microseconds
/T - only output key names and write times; overrides /d, /D, /k, /K, /v, /V, and /N
time format as above; filter matching respects the /W (/w) option
use /Tm for milliseconds, /Tu for microseconds
/n - (or /N) limit data searches to numbers; use decimal or hex with "0x"
- The default filters match all ("*" for wildcards, "" for substring)
- REG_DWORD and REG_QWORD searches are exact; use decimal or hex with 0x
- "quote" key names and filters containing whitespace
- Requested output (/K, /V, /d, /D) is prefixed with '*'