Thursday, October 18, 2018

Powershell - Get all Windows file extensions from registry at HKEY_CLASSES_ROOT

























Here's a Powershell script to traverse all the keys in the registry at HKEY-CLASSES-ROOT to get all Windows file extensions that start with a dot. 


 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
#============================================================================================================================================================ 
# AUTHOR:         metadataconsult@gmail.com 
# WEBSITE:        http://metadataconsulting.blogspot.com 
# 
# SCRIPT NAME:    GetAllFileExtensions.ps1   
# DATE:           17/10/2018  
# VERSION:        1.0.0.0
# 
# SYNPOSIS:       Get all file extensions from registry at HKEY_CLASSES_ROOT  
#
#============================================================================================================================================================ 

#set HKCR hack
New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT
$i=0
Get-ChildItem 'HKCR:\' | ForEach-Object {  

 If($_.name -Match "^HKEY_CLASSES_ROOT\\\..+") {
    $i++
    Write-Host  $_.Name.Replace("HKEY_CLASSES_ROOT\","")
 }

}
"$i file extensions in Registry @ HKEY_CLASSES_ROOT\"


$i=0
Get-ChildItem 'HKLM:\Software\Classes\' | ForEach-Object {  
 
 If($_.name -Match "^HKEY_LOCAL_MACHINE\\Software\\Classes\\\..+") {
    $i++
    Write-Host  $_.Name.Replace("HKEY_LOCAL_MACHINE\Software\Classes\","")
 }

}
"$i file extensions in Registry @ HKEY_LOCAL_MACHINE\Software\Classes\"

$i=0
Get-ChildItem 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\' | ForEach-Object {  
 
 If($_.name -Match "^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\\..+") {
    $i++
    Write-Host  $_.Name.Replace("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\","")
 }

}
"$i file extensions in Registry @ HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\"

My other Powershell scripts

No comments:

Post a Comment