Quantcast
Channel: DFIR Training - Recently Added Listings
Viewing all articles
Browse latest Browse all 888

RegRipper GUI

$
0
0

The rationale behind it is that you can quickly run plugins without having to look up which hives they relate to, and you can quickly click through and add them to a text report.

If the plugin indicates that it relates to multiple plugins then the GUI will iterate through each hive.  As a result, if you have a plugin (ie regtime) that takes a long time to run, and works on all of the hives then that will make the GUI temporarily hang until everything’s complete. It’ll keep going, but I wouldn’t try to do anything with it or Windows will think it’s crashed and ask you to end the process.

The hives also have to have their proper names or else it won’t be able to identify them.

The main use case is to quickly run through multiple plugins and produce a report. If you have to run the same plugins over multiple sets of hives I’d recommend using a batch file. Alternatively, there’s also Harlan’s rr GUI for running profiles, and Corey Harrell’s auto_rip.

It requires Perl, and the libraries: Win32-GUI, Parse-Win32Registry, and dmake (install instructions at the start of the script).

Download:  https://github.com/randomaccess3/regripper_GUI 


Viewing all articles
Browse latest Browse all 888

Trending Articles