DOCSEARCHbyAlgolia
Submit Docs

RegRipper3.0 Documentation

repository·master·Indexed 20 days ago

https://github.com/keydet89/regripper3.0

A registry parsing tool for digital forensics that extracts information from Windows registry hives using a plugin-based architecture. Supports both GUI (rr.exe) and CLI (rip.exe) interfaces, with capabilities to automatically run applicable plugins or specific TLN plugins via the -a and -aT switches.

Tokens
495
Snippets
1
Records
3
Agent score
22%

What's inside RegRipper3.0

  1. Handle hive transaction logs

    master

    RegRipper3.0 does not automatically process hive transaction logs. To include transaction log data in your analysis, you must merge the data using external tools before or during your workflow.

    Recommended methods:

    1. Use Maxim Suhanov's yarp combined with registryFlush.py.
    2. Use Eric Zimmerman's rla.exe (included in Registry Explorer/RECmd).

  2. Install modified Perl modules on Linux

    master

    If you are running RegRipper3.0 on Linux (rather than using the Windows .exe versions), you must manually install modified Perl module files provided in the repository to ensure correct functionality.

    Copy the following files from the repository to your local Perl installation directory (e.g., C:\Perl\site\lib\ or the equivalent Linux path):

    • Parse/Win32Registry/WinNT/File.pm
    • Parse/Win32Registry/WinNT/Base.pm
    • Parse/Win32Registry/WinNT/Key.pm

    Note: If using the Windows .exe versions, these modules are already compiled into the executable and no action is required.

  3. Run all applicable plugins against a hive automatically

    master

    In RegRipper3.0, you can bypass manual profile selection by targeting a hive directly. The tool will automatically identify and run all applicable plugins for that specific hive.

    • GUI (rr.exe): Simply select the hive to parse and an output directory; the GUI handles the plugin selection automatically.
    • CLI (rip.exe): Use the -a switch to run all applicable plugins against the selected hive.
    • CLI (TLN Plugins): Use the -aT switch to run only the hive-specific TLN (Transaction Log) plugins against the hive.

    Individual plugin and profile execution remains supported.

    # Run all applicable plugins against a hive via CLI
rip.exe -a <path_to_hive> <output_directory>

# Run only hive-specific TLN plugins against a hive via CLI
rip.exe -aT <path_to_hive> <output_directory>