Hello, As we discussed briefly on IRC about a month ago, HKLM\SYSTEM\MountedDevices can contain greater than 55000 (HIVEX_MAX_VALUES) values if VMWare’s snapshot functionality is frequently used. This is due to an unintended interaction between Windows and VMWare’s snapshot functionality. VMware has a knowledge base article regarding this issue, although it does not directly mention MountedDevices: https://kb.vmware.com/s/article/2006849 The attached patch increases HIVEX_MAX_VALUES in order to enable access to those hives with hivex. -- Matt Coleman Senior Software Engineer Datto, Inc. www.datto.com