ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

Difference between revisions of "Regripper"

From ForensicsWiki
Jump to: navigation, search
(One intermediate revision by one other user not shown)
Line 22: Line 22:
* [ RegRipper Blog]
* [ RegRipper Blog]
* [ RegRipper Original Code and supporting information]
* [ Windows Forensics Analysis]
* [ RegRipper Supplemental Plugins]
* [ RegRipper Supplemental Plugins]
* [ Developers blog (Windows Incident Response)]
* [ Developers blog (Windows Incident Response)]
* [ RegRipper Google Code]

Revision as of 05:14, 24 August 2012

Maintainer: Harlan Carvey
OS: Windows
Genre: Analysis
License: GPL

RegRipper is an open source forensic software application developed by Harlan Carvey. RegRipper, written in Perl, is a Windows Registry data extraction tool.

RegRipper can be customized to the examiner's needs through the use of available plugins or by users writing plugins to suit specific needs.

Technical Background and Forensic Soundness

RegRipper uses James McFarlane’s Parse::Win32Registry module [1] to access a Windows Registry hive file in an object-oriented manner, bypassing the Win32API. This module is used to locate and access Registry key nodes within the hive file, as well as value nodes and their data. When accessing a key node, the LastWrite time is retrieved, parsed and translated into something the examiner can understand. Data is retrieved in much the same manner…if necessary, the plugin that retrieves the data will also perform translation of that data into something readable.

Also see

Windows Registry

External Links