I am saving the encrypted data (no. of tries,and other releted info) in a file and in the registry.
If your users are tech savvy, you won't be able to squirrel away information in the registry without them noticing. They can simply roll back to an earlier version of the registry entry.
Microsoft tried device fingerprinting by storing device characteristics in wpa.dbl. I haven't managed a Windows machine in a while, so I don't know how well it works, if it's used on Windows 7, or whether that file is readable by other processes. I do recall that they had to do a bunch of work to make the device fingerprint robust against minor changes to devices.
In its simplest form, activation (on a Net-connected PC) is a matter of sending a unique code from your PC to a server at Microsoft. That server then returns an activation code, which allows you to keep using the operating system. The unique code belongs to your computer alone and acts as a flag to Microsoft if your copy shows up on another PC or you significantly alter some part of your PC.
Fully Licensed, a software-licensing technology firm in Germany, figured out how the process works and shared the details with the world. Activation starts with an Installation ID--a packet of encrypted data containing the 25-character XP serial number combined with hardware information--which is sent to Microsoft over the Internet. While you have the option to register your copy of XP (that is, send personal information to Microsoft separately from activation) during the activation process, Fully Licensed verified that no personal information is gathered, stored, considered, or transmitted during activation. The registration process, on the other hand, does collect personal data, such as your name, address, and e-mail address, but as a separate process that is not required for activation. If your PC isn't connected to the Internet when you install or activate XP, the OS presents the Installation ID on your screen, and you must read it over the phone to a Microsoft customer service person. (A special program, called
msoobe.exe, creates the ID.)
At Microsoft's activation server, a program checks the ID to verify that the data arrived intact and that the product ID has not been used with a different hardware fingerprint (that is, another computer). XP stores the system fingerprint on your PC in a file named wpa.dbl. From now on, whenever you reinstall that copy of Windows, the Microsoft server compares the original system fingerprint and OS serial number created at first activation with the current system fingerprint for that product serial number.
If the product ID and hardware fingerprint from a new installation are not significantly different from a previous activation, the activation server generates a 44-digit Confirmation ID code and sends it back to your PC.
It looks like there are other commercially available device fingerprinting solutions on the market.
So if you can derive a device fingerprint or piggyback off the MS activation one, you could encrypt it with a private key on a server, and have your software check it with a public key embedded in the software so that the machine need not be reliably connected to the network for your software to start.
None of this helps though if the Windows install is inside a virtual machine where devices are virtualized.
Alternatively you could try non-hardware fingerprints. I vaguely remember some Berkeley folk coming up with a way to identify personal machines even when Tor was running by looking at the fonts installed. Many Windows programs carry fonts, fonts are rarely uninstalled, and fonts are available to browsers, so by looking at particular font versions they could come up with a reasonably reliable fingerprint. That might survive reimaging, assuming the user of your software wants to keep running other programs on the same machine.
In general, plugins and fonts are the most identifying metrics...
We tested the hypothesis that font orders are informative, by checking to see
if any returning, cookie-accepting users had font lists whose order had changed.
Just keep in mind that sending this information to a server, even in digest form, might be something you need to seek user consent for ahead of time.