Forensicsforensicregistrywindowshiveanalysisperl

RegRipper

RegRipper is a CLI tool for performing forensic analysis of Windows Registry hives. It extracts, translates, and displays data and metadata using Perl plugins.

Description

RegRipper’s CLI tool can be used to surgically extract, translate, and display information (both data and metadata) from Registry-formatted files via plugins in the form of Perl-scripts. It allows the analyst to select a hive-file to parse and a plugin or a profile, which is a list of plugins to run against the given hive. The results go to STDOUT and can be redirected to a file.

Perform forensic analysis of registry hives. The tool parses Windows Registry files using either a single module or a profile. It checks if the hive is dirty but does not automatically process transaction logs; for that, use yarp + registryFlush.py or rla.exe from Eric Zimmerman.

All output goes to STDOUT; use redirection (ie, > or >>) to output to a file.

How It Works

RegRipper parses Windows Registry hive files using Perl plugins or profiles. It extracts data and metadata via surgically targeted plugins, supports guessing hive types, checking if hives are dirty, and running hive-specific or TLN plugins. Output is directed to STDOUT for redirection. Does not auto-process transaction logs.

Installation

bash
sudo apt install regripper

Flags

-r [hive]Registry hive file to parse
-dCheck to see if the hive is dirty
-gGuess the hive file type
-aAutomatically run hive-specific plugins
-aTAutomatically run hive-specific TLN plugins
-f [profile]use the profile
-p [plugin]use the plugin
-llist all plugins

Examples

Display help and usage information for the tool
regripper -h
Parse the system hive using the system profile
rip -r c:\case\system -f system
Parse ntuser.dat hive using the userassist plugin
rip -r c:\case\ntuser.dat -p userassist
Parse ntuser.dat hive and automatically run hive-specific plugins
rip -r c:\case\ntuser.dat -a
List all plugins
rip -l -c
Guess the hive file type and parse
regripper -r hivefile -g
Check if the hive is dirty before parsing
Updated 2026-04-16kali.org ↗