hivex

Hivex offers a comprehensive set of tools for forensic analysis and manipulation of Windows Registry hive files, which are binary files typically found in C:\Windows\System32\Config. The suite includes utilities like hivexget for extracting subkey data, hivexml for converting hives to XML format, hivexsh for interactive shell navigation, and hivexregedit for merging regedit-format changes.

These tools are particularly useful in digital forensics for examining Windows system artifacts, malware analysis, and incident response. They enable investigators to extract configuration data, user settings, installed software information, and system events stored in registry hives without needing a full Windows environment.

Unlike traditional .REG format parsers, hivex works directly with the binary hive format through a stable C API, providing reliable parsing even for corrupted files with appropriate options.

Hivex parses the proprietary binary format of Windows Registry hive files using a self-contained C library (libhivex). The tools access hive structures through this API: hivexget traverses node paths to extract key-value pairs; hivexml serializes the entire hive tree to XML; hivexsh provides an interactive shell with filesystem-like navigation (cd/ls) over registry nodes; hivexregedit converts between regedit text format and binary hives. String values are decoded from Windows UTF-16LE to UTF-8, numeric values (DWORD/QWORD) are properly interpreted, and hex-encoded raw data is supported.