REGRIPPER(1)

📦
version 3.0~git20260527.ec96dd4 · 3 versions
, in ubuntu stonking

💖 REGRIPPER(1) — the regripper girlie's guide 💖

okay so bestie, welcome to regripper, from the General Commands Manual section 💅 forensics but make it slay.

✨ NAME ✨

Regripper — forensic analysis of Registry hives 🕵️♀️🌈

🎀 SYNOPSIS 🎀

regripper [-r <hivefile>] [-f <hivetype>] [-p <plugin>] [-d] [-g] [-aT]
[-s systemname] [-u username]

🦋 DESCRIPTION 🦋

So Regripper is literally a source tool for forensic analyses of Windows Registry files, no cap. It's giving surgical extraction energy: it can surgically extract, translate, and display info — both data AND metadata — from Registry-formatted files, and it does all of that via plugins that are Perl-scripts. 💜

And the way that all output goes to STDOUT?? So if you want a file, you gotta redirect yourself, bestie — use > or >>. Periodt. 💅

✨ OPTIONS ✨

  • -r <hive> — tell it which Registry hive file to parse, queen. You'll find those either in %SystemRoot%\System32\config or in %userprofile (aka the user's directory) 🗂️
  • -f <hivetype> — specify which hive type/profile to use. Could be sam, security, software, system, ntuser 👑
  • -p <plugin> — pick the plugin to use. E.g. run, appcompatcache and so on. (Peep -l for the full list, iykyk) 🔌
  • -d — check to see if the hive is dirty 🧼 (spoiler: hives can be messy)
  • -g — guess the hive file type 🔮
  • -a — automatically run hive-specific plugins 🤖
  • -aT — automatically run hive-specific timelining (TLN) plugins ⏳
  • -s <systemname> — specify system name (TLN Support) 🖥️
  • -u <username> — specify user name (TLN Support) 🙋♀️
  • -l — list ALL the available plugins. And yes bestie, you could place custom plugins in /usr/bin/regripper/plugins 📋
  • -c — output the list of plugins as comma-separated values (use it with -l) 🍓
  • -h — print short help information 🆘

🌈 EXAMPLES 🌈

List all available plugins

regripper -l

Run a specific plugin; E.g. Retrieve timeline of recent docs from NTUSER.DAT

regripper -r /hive/NTUSER.DAT -p recentdocs_tln

Retrieve run-keys from NTUSER.DAT

regripper -r /hive/NTUSER.DAT -p run

Process a complete hive file of type system:

regripper -r /mnt/SYSTEM -f system > /mnt/reports/system.txt

Parse hive file of type SAM:

regripper -r /mnt/SAM -f sam > /mnt/SAM.txt

💜 AUTHORS 💜

Written by Harlan Carvey <keydet89@yahoo.com> — iconic behavior, honestly 🌟

💀 BUGS AND LIMITATIONS 💀

⚠️ Okay this is the important part, bestie, listen up: this tool does NOT automatically process hive transaction logs. Like, at all. Not me finding that out the hard way 😭

If you need to incorporate data from hive transaction logs into your analysis, consider merging the data via Maxim Suhanov's yarp + registryFlush.py, or via Eric Zimmerman's rla.exe. Those are the moves 🫶

🙈 REPORTING BUGS 🙈

When submitting a bug report, please include a description of the problem, how you found it, and your contact information. Like, spill the tea properly, we need the lore 📝

Submit bug reports to: https://github.com/keydet89/RegRipper3.0/issues

This project is licensed under terms of the MIT License — https://opensource.org/licenses/MIT. Copyright by Harlan Carvey <keydet89@yahoo.com> and 2020 Quantum Analytics Research, LLC. 💖

This manual page was written by Jan Gruber <j4n6ru@gmail.com>, for the Debian project (and may be used by others). Slay, Jan 🎀

🌸 SEE ALSO 🌸

More information on Regripper appears in the README file, distributed with the regripper source code. Go read it, it's giving lore drop 📖✨

and that's the whole vibe check bestie 💅 — this manual page is brought to you by Harlan Carvey, version v3.0 - December 2020, from the REGRIPPER(1) era. Go forth and parse those hives, queen 🧚💖🔥

📦 where this page comes from