reglookup(1)

💖 reglookup-recover — the man page, but make it give 💖

okay bestie, so this is the manual for reglookup-recover, from the File Conversion Utilities fam. Introducing: the Windows NT+ registry deleted data recovery tool. yes, deleted data. we're doing archaeology on a registry hive. slay. 🦋

---

✨ NAME ✨

reglookup-recover — a Windows NT+ registry deleted data recovery tool 🌸

🎀 SYNOPSIS 🎀

reglookup-recover [options] registry-file

💅 DESCRIPTION 💅

So basically, reglookup-recover goes absolutely feral scouring a Windows registry hive for deleted data structures, and then it prints everything it finds in a CSV-like format. it's giving forensic scavenger hunt, no cap. 🔥

👑 OPTIONS 👑

reglookup-recover accepts the following parameters, bestie, take notes:

• -v — Verbose output. she's chatty, she's telling you everything 💬
• -h — Turns ON printing a column header row. (this is the default, so she's already doing it) ✨
• -H — Turns OFF printing a column header row. no header for you 🙈
• -l — Shows you the cells that could not be interpreted as valid registry structures — and it tucks them at the end of the output. the weird little mystery cells get their moment 💀
• -L — Does not display those uninterpretable cells. this is the default behavior, so mystery cells stay hidden 🤫
• -r — Displays the raw cell contents for cells that were interpreted as intact data structures. this extra output shows up on the same line as the interpreted data, side by side, matching energy 🫶
• -R — Does not display raw cell contents for interpreted-as-intact cells. this is the default behavior ⭐
• registry-file — Required argument, no skipping it. This specifies the location of the registry file to read. The system registry files should be found under: %SystemRoot%/system32/config. 📁

🌈 OUTPUT 🌈

reglookup-recover generates output that's like comma-separated values (CSV) and writes it to stdout. For more info on the syntax of the general format, go see reglookup(1). 👀

This tool is new and the output format — especially which columns are included — may change in future revisions. When this format stablizes, additional documentation will be included here. so like, don't get too attached to the columns, she's still growing ✨

🍓 EXAMPLES 🍓

To dump the recoverable contents of a system registry hive:

reglookup-recover /mnt/win/c/WINDOWS/system32/config/system

To extract all available unallocated data — including unparsable unallocated space and the raw data associated with parsed cells — in a user-specific registry:

reglookup-recover -r -l '/mnt/win/c/Documents and Settings/user/NTUSER.DAT'

💀 BUGS 💀

This program has been smoke-tested against most current Windows target platforms, but a comprehensive test suite has not yet been developed. (Please report results to the development mailing list if you encounter any bugs. Sample registry files and/or patches are greatly appreciated.) bestie we are BEGGING, send files, send patches, we love you 😭💖

This program is new as of RegLookup release 0.9.0 and should be considered unstable. it's giving baby program, handle with care 🙈

For more information on registry format details and the recovery algorithm, see:

http://sentinelchicken.com/research/registry_format/
http://sentinelchicken.com/research/registry_recovery/

🌸 CREDITS 🌸

This program was written by Timothy D. Morgan. iconic behavior, honestly 👑

🦋 LICENSE 🦋

Please see the file "LICENSE" included with this software distribution.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License version 3 for more details. (translation: no promises, bestie, it's free software 💜)

⭐ SEE ALSO ⭐

reglookup-timeline(1) reglookup-recover(1)

---

okay that's the whole thing, you're so welcome 🎀 File Conversion Utilities — 10 October 2026 — reglookup(1) 💖 mwah, go recover some deleted registry data, you main character 🫶✨