reglookup

RegLookup enables direct analysis of Windows NT-based registry files, offering command line utilities like reglookup, reglookup-recover, and reglookup-timeline for reading, recovering deleted data, and generating timelines. Designed primarily for digital forensics, it outputs registry data in a standardized CSV-like format with quoted special characters, facilitating parsing by other tools. Users can filter output by registry path prefixes and data types such as SZ, BINARY, DWORD, and others.

The toolset supports mounting Windows registry hives from disk images and extracting keys, values, timestamps, and security descriptors. It handles deleted structures through recovery algorithms and provides verbose options for detailed output, including ACLs and rarely used fields. Related packages include development libraries (libregfi-dev), runtime libraries (libregfi1t64), and Python bindings (python3-pyregfi) for programmatic access.

Common use cases involve investigating mounted Windows images for evidence in system hives like SYSTEM, SOFTWARE, or NTUSER.DAT, reconstructing timelines of key modifications, and recovering artifacts from unallocated space.

RegLookup reads Windows NT+ registry hive files (e.g., from %SystemRoot%/system32/config/), parsing internal data structures including keys, values, MTIMEs (modification timestamps stored on keys), and security descriptors. It decodes registry data types (NONE, SZ, EXPAND_SZ, BINARY, DWORD, etc.) and outputs in CSV format, encoding special characters as %XX hex. Deleted data recovery scans slack space and unallocated cells using algorithms based on registry format specifications. Security attributes parse ACLs into SIDs, ACE types (ALLOW/DENY), access rights (e.g., KEY_QUERY_VALUE), and flags (OI, CI), with unrecognized bits as hex. Timestamps convert to UTC, inheriting parent key MTIMEs for values.