reglookup-recover1

Usage

Overview

reglookup-recover attempts to scour a Windows registry hive for deleted data structures and outputs those found in a CSV-like format.

Options

reglookup-recover accepts the following parameters:

FC-vF[0]

Verbose output.

FC-hF[0]

Enables the printing of a column header row. (default)

FC-HF[0]

Disables the printing of a column header row.

FC-lF[0]

Display cells which could not be interpreted as valid registry structures at the end of the output.

FC-LF[0]

Do not display cells which could not be interpreted as valid registry structures. This is the default behavior.

FC-rF[0]

Display raw cell contents for cells which were interpreted as intact data structures. This additional output will appear on the same line as the interpreted data.

FC-RF[0]

Do not display raw cell contents for cells which were interpreted as intact data structures. This is the default behavior.

registry-file

Required argument. Specifies the location of the registry file to read. The system registry files should be found under: %SystemRoot%/system32/config.

Output

reglookup-recover generates a comma-separated values (CSV) like output and writes it to stdout. For more information on the syntax of the general format, see reglookup(1).

This tool is new and the output format, particularly the included columns, may change in future revisions. When this format stablizes, additional documentation will be included here.

Examples

To dump the recoverable contents of a system registry hive:

FC
	reglookup-recover /mnt/win/c/WINDOWS/system32/config/system
      F[0]

Extract all available unallocated data, including unparsable unallocated space and the raw data associated with parsed cells in a user-specific registry:

FC
	reglookup-recover -r -l '/mnt/win/c/Documents and Settings/user/NTUSER.DAT'
      F[0]

Credits

This program was written by Timothy D. Morgan.