reglookup-timeline(1)

📦
version 1.0.1+svn296 · 5 versions
, in ubuntu stonking

💖 reglookup-timeline 💖

okay bestie so you found the reglookup-timeline manual page, and honestly? she's a cutie. this one is from the File Conversion Utilities squad and it's been around since 10 October 2026. let's get into it, i promise it's not scary 💅

🌸 NAME 🌸

reglookup-timeline — Windows NT+ registry MTIME timeline generator

like. it makes timelines. from registry MTIME stuff. periodt.

✨ SYNOPSIS ✨

reglookup-timeline [-H] registry-file [registry-file ...]

🦋 DESCRIPTION 🦋

so here's the tea: this script is a whole wrapper around [reglookup(1)](#-see-also-), and what it does is read one or more registry files and spit out an MTIME-sorted output. why do you care? because it's genuinely so helpful when you're building timelines for forensic investigations. yes, like actual detective work. main character energy fr fr 👑

🎀 PARAMETERS 🎀

reglookup-timeline takes one or more registry file names, no cap. every single registry you hand over gets parsed using reglookup(1) — all of them, bestie, it's thorough like that.

you've also got the -H option, which you can use to omit the header line. that's it, that's the whole option. lowkey iconic for being so simple.

🌈 OUTPUT 🌈

it generates a comma-separated values (CSV) compatible format and sends it straight to stdout. and yes, even though the output of reglookup-timeline and reglookup(1) differ in the columns they return, the base format is the same — they're siblings, not twins 💖

currently, reglookup-timeline returns three columns:

  1. MTIME
  2. FILE
  3. PATH

only rows representing registry keys get returned, because MTIMEs are literally not stored for values — the data just isn't there, bestie, don't come for her 🙈

quick breakdown of the columns:

  • the FILE column tells you which registry file (the ones you passed as arguments) the key came from.
  • the PATH field holds the full registry path to the key.
  • records come back sorted in ascending order based on the MTIME column. chronological queen ⭐

💀 BUGS 💀

okay, deep breath, this is the part where we're real with each other:

this script is new, and as such its interface may change significantly over the next few revisions. in particular, additional command line options will likely be added, and the output of the script may be altered in minor ways. so like... don't get too attached to the current shape of things 🫶

also, it is very difficult to find documentation on what precise operations actually cause the MTIMEs to be updated. basic experimentation indicates that a key's stamp gets updated anytime an immediate sub-value or sub-key is created, renamed, deleted, or its value is modified. but that's from basic experimentation, not gospel.

⚠️ if this MTIME data is critical to an investigation, any conclusions should be validated through experimentation in a controlled lab environment. do not skip this step. do not be messy about forensics. it's giving "measure twice, cut once" fr fr.

and finally: this software should be considered unstable at this time. she's in her growing era 💅

🧚 CREDITS 🧚

this script was written by Timothy D. Morgan, based on suggestions from Uwe Danz. iconic collaboration, honestly.

please see the source code for a full list of copyrights. 📜

💜 LICENSE 💜

please see the file "LICENSE" included with this software distribution.

this program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. see the GNU General Public License version 3 for more details. legal girlies stay winning ⚖️✨

👑 SEE ALSO 👑

and that's the whole page, bestie!! 🎀 this cutie came to you courtesy of File Conversion Utilities, dated 10 October 2026 — go forth and build your timelines, you forensic main character, i'm obsessed with you 💖✨🦋

📦 where this page comes from