Regripper - Revision history

Joachim Metz at 05:14, 24 August 2012

2012-08-24T05:14:57Z

2012-08-22T19:36:21Z

‎External Links

2012-07-18T04:51:25Z

2012-07-18T04:47:59Z

2012-07-18T04:46:48Z

2012-07-18T04:45:48Z

‎Technical Background and Forensic Soundness

2012-07-18T04:45:33Z

‎Resources:

2012-07-18T04:21:45Z

2012-07-17T17:22:50Z

‎RegRipper

2012-07-17T17:22:28Z

‎RegRipper

@@ Line 24: / Line 24: @@
 * [http://code.google.com/p/winforensicaanalysis/ Windows Forensics Analysis]
 * [http://code.google.com/p/regripperplugins/ RegRipper Supplemental Plugins]
-* [http://windowsir.blogspot.com/ Developers blog (Windows Incident Response]
+* [http://windowsir.blogspot.com/ Developers blog (Windows Incident Response)]
 * [http://code.google.com/p/regripper/ RegRipper Google Code]

@@ Line 22: / Line 22: @@
 * [http://www.regripper.wordpress.com RegRipper Blog]
-* [http://code.google.com/p/winforensicaanalysis/ RegRipper Original Code and supporting information]
+* [http://code.google.com/p/winforensicaanalysis/ Windows Forensics Analysis]
 * [http://code.google.com/p/regripperplugins/ RegRipper Supplemental Plugins]
-* [http://windowsir.blogspot.com/ Developers blog (Windows Incident Response)]
+* [http://windowsir.blogspot.com/ Developers blog (Windows Incident Response]

@@ Line 7: / Line 7: @@
    website = [http://code.google.com/p/winforensicaanalysis/ code.google.com/p/winforensicaanalysis/] |
 }}
 RegRipper is an open source forensic software application developed by [[Harlan Carvey]].  RegRipper, written in Perl, is a [[Windows Registry]] data extraction tool.

← Older revision		Revision as of 04:47, 18 July 2012
Line 17:		Line 17:

	RegRipper uses James McFarlane’s Parse::Win32Registry module [http://search.cpan.org/~jmacfarla/Parse-Win32Registry-0.40/] to access a Windows Registry hive file in an object-oriented manner, bypassing the Win32API. This module is used to locate and access Registry key nodes within the hive file, as well as value nodes and their data. When accessing a key node, the LastWrite time is retrieved, parsed and translated into something the examiner can understand. Data is retrieved in much the same manner…if necessary, the plugin that retrieves the data will also perform translation of that data into something readable.		RegRipper uses James McFarlane’s Parse::Win32Registry module [http://search.cpan.org/~jmacfarla/Parse-Win32Registry-0.40/] to access a Windows Registry hive file in an object-oriented manner, bypassing the Win32API. This module is used to locate and access Registry key nodes within the hive file, as well as value nodes and their data. When accessing a key node, the LastWrite time is retrieved, parsed and translated into something the examiner can understand. Data is retrieved in much the same manner…if necessary, the plugin that retrieves the data will also perform translation of that data into something readable.
		+
		+	== Also see ==
		+	[[Windows Registry]]

	== External Links ==		== External Links ==

@@ Line 18: / Line 18: @@
 RegRipper uses James McFarlane’s Parse::Win32Registry module [http://search.cpan.org/~jmacfarla/Parse-Win32Registry-0.40/] to access a Windows Registry hive file in an object-oriented manner, bypassing the Win32API.  This module is used to locate and access Registry key nodes within the hive file, as well as value nodes and their data.  When accessing a key node, the LastWrite time is retrieved, parsed and translated into something the examiner can understand.  Data is retrieved in much the same manner…if necessary, the plugin that retrieves the data will also perform translation of that data into something readable.
-== Resources: ==
+== External Links ==
 * [http://www.regripper.wordpress.com RegRipper Blog]

@@ Line 16: / Line 16: @@
 == Technical Background and Forensic Soundness ==
-RegRipper uses James McFarlane’s Parse::Win32Registry module ([http://search.cpan.org/~jmacfarla/Parse-Win32Registry-0.40/]) to access a Windows Registry hive file in an object-oriented manner, bypassing the Win32API.  This module is used to locate and access Registry key nodes within the hive file, as well as value nodes and their data.  When accessing a key node, the LastWrite time is retrieved, parsed and translated into something the examiner can understand.  Data is retrieved in much the same manner…if necessary, the plugin that retrieves the data will also perform translation of that data into something readable.
+RegRipper uses James McFarlane’s Parse::Win32Registry module [http://search.cpan.org/~jmacfarla/Parse-Win32Registry-0.40/] to access a Windows Registry hive file in an object-oriented manner, bypassing the Win32API.  This module is used to locate and access Registry key nodes within the hive file, as well as value nodes and their data.  When accessing a key node, the LastWrite time is retrieved, parsed and translated into something the examiner can understand.  Data is retrieved in much the same manner…if necessary, the plugin that retrieves the data will also perform translation of that data into something readable.
 == Resources: ==

← Older revision		Revision as of 04:21, 18 July 2012
Line 1:		Line 1:
		+	{{Infobox_Software \|
		+	name = RegRipper \|
		+	maintainer = [[Harlan Carvey]] \|
		+	os = [[Windows]] \|
		+	genre = {{Analysis}} \|
		+	license = {{GPL}} \|
		+	website = [http://code.google.com/p/winforensicaanalysis/ code.google.com/p/winforensicaanalysis/] \|
		+	}}
		+
	== RegRipper ==		== RegRipper ==

@@ Line 1: / Line 1: @@
 == RegRipper ==
-RegRipper is an open source forensic software application developed by Harlan Carvey[[Harlan Carvey]].  RegRipper, written in Perl, is a [[Windows Registry]] data extraction tool.
+RegRipper is an open source forensic software application developed by [[Harlan Carvey]].  RegRipper, written in Perl, is a [[Windows Registry]] data extraction tool.
 RegRipper can be customized to the examiner's needs through the use of available plugins or by users writing plugins to suit specific needs.