Where is the list of attached databases stored? I know database instance names are stored in the registry in subkeys of HKLM:SOFTWARE\Microsoft\Microsoft SQL Server\Instance Names\SQL and the path to master.mdf is stored in HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\__InstanceId__\\MSSQLSERVER\Parameters@SqlArg0. However, I don't see a table in master.mdf or a registry key where the names of the other attached databases are stored.

I know I can look in sys.databases for the databases. However, what I want to know is how to find this information out without sql server running. Is it stored in the master.mdf? In the registry? Can I get that information with a hex editor, OrcaMDF or something else? How does Sql server know what databases to attach at startup?
I don't see a table in master.mdf ... where the names of the other attached databases are stored.


That would be sys.databases. Running sp_helptext 'sys.databases' will quickly reveal what is the catalog table backing it:

CREATE VIEW sys.databases AS
    SELECT d.name, d.id AS database_id,
...
FROM sys.sysdbreg d 
...


To query sys.sysdbreg see Using a Dedicated Administrator Connection.