RegRipper
🔬 Digital Forensics · Perl
RegRipper is a Windows registry data extraction and correlation tool, written in Perl with an extensible plugin architecture. It parses offline Windows registry hive files (SAM, SYSTEM, SOFTWARE, NTUSER.DAT, UsrClass.dat) and extracts forensically significant data including user accounts, network connections, USB device history, application execution, file access timestamps, autorun entries, and hundreds of other artifacts. Each plugin targets a specific registry key or set of keys, formatting the output for analyst consumption. RegRipper is the standard tool for Windows registry forensics - its plugin library covers virtually every registry artifact documented in DFIR literature. It can process hives from mounted images, extracted files, or live systems, and outputs timestamped data suitable for timeline analysis. Harlan Carvey, the author, continuously maintains the plugin library as new forensic artifacts are discovered.
Installation
from source
$ git clone https://github.com/keydet89/RegRipper3.0.gitWindows
$ Download from GitHub and run rip.exeUse Cases
- Extracting user account data and password hashes from SAM hives
- Recovering USB device connection history from SYSTEM hives
- Parsing autorun entries and persistence mechanisms from SOFTWARE and NTUSER.DAT
- Building forensic timelines from registry timestamp artifacts
- Analyzing application execution history via UserAssist, Shimcache, and BAM
Tags
Details
- Category
- 🔬 Digital Forensics
- Language
- Perl
- Repository
- keydet89/RegRipper3.0
- Platforms
- 🪟windows🐧linux
Links
Alternatives & Comparisons
Volatility 3
PythonAdvanced memory forensics framework. Extracts artifacts from RAM dumps - processes, network connections, registry.
Compare RegRipper vs Volatility 3Autopsy
JavaDigital forensics platform with GUI. Disk image analysis, timeline analysis, keyword search, hash filtering.
Compare RegRipper vs AutopsyMore in Digital Forensics
Volatility 3
PythonAdvanced memory forensics framework. Extracts artifacts from RAM dumps - processes, network connections, registry.
Autopsy
JavaDigital forensics platform with GUI. Disk image analysis, timeline analysis, keyword search, hash filtering.
Ghidra
JavaNSA's reverse engineering framework. Disassembly, decompilation, graphing, and scripting for binary analysis.
Binwalk
PythonFirmware analysis tool. Searches binary images for embedded files, executables, and file systems.
YARA
CPattern matching swiss knife for malware researchers. Create rules to identify and classify malware samples.
Velociraptor
GoEndpoint visibility and collection tool. Hunt for artifacts across thousands of endpoints simultaneously.