Skip to content
/ regipy Public
forked from mkorman90/regipy

Regipy is an os independent python library for parsing offline registry hives

License

MIT license
0 stars 52 forks Branches Tags Activity
Star
Notifications You must be signed in to change notification settings

pombredanne/regipy

BranchesTags
 
 

Repository files navigation

regipy

CircleCI

Regipy is a python library for parsing offline registry hives (Hive files with REGF header). regipy has a lot of capabilities:

  • Use as a library:
    • Recurse over the registry hive, from root or a given path and get all subkeys and values
    • Read specific subkeys and values
    • Apply transaction logs on a registry hive
  • Command Line Tools
    • Dump an entire registry hive to json
    • Apply transaction logs on a registry hive
    • Compare registry hives
    • Execute plugins from a robust plugin system (i.e: amcache, shimcache, extract computer name...)

Installation

Regipy latest version can be installed from pypi:

pip install regipy[full]

NOTE: regipy[full] installs dependencies that require compilation tools and might take some time. It is possible to install a version with relaxed dependencies, by omitting the [full].

Also, it is possible to install from source by cloning the repository and executing:

pip install --editable .[full]

CLI

Parse the header:

registry-parse-header ~/Documents/TestEvidence/Registry/SYSTEM

Example output:

╒════════════════════════╤══════════╕
│ signature              │ b'regf'  │
├────────────────────────┼──────────┤
│ primary_sequence_num   │ 11639    │
├────────────────────────┼──────────┤
│ secondary_sequence_num │ 11638    │
├────────────────────────┼──────────┤
│ last_modification_time │ 0        │
├────────────────────────┼──────────┤
│ major_version          │ 1        │
├────────────────────────┼──────────┤
│ minor_version          │ 5        │
├────────────────────────┼──────────┤
│ file_type              │ 0        │
├────────────────────────┼──────────┤
│ file_format            │ 1        │
├────────────────────────┼──────────┤
│ root_key_offset        │ 32       │
├────────────────────────┼──────────┤
│ hive_bins_data_size    │ 10534912 │
├────────────────────────┼──────────┤
│ clustering_factor      │ 1        │
├────────────────────────┼──────────┤
│ file_name              │ SYSTEM   │
├────────────────────────┼──────────┤
│ checksum               │ 0        │
╘════════════════════════╧══════════╛
[2019-02-09 13:46:12.111654] WARNING: regipy.cli: Hive is not clean! You should apply transaction logs
  • When parsing the header of a hive, also checksum validation and transaction validations are done

Dump entire hive to disk (this might take some time)

registry-dump ~/Documents/TestEvidence/Registry/NTUSER-CCLEANER.DAT -o /tmp/output.json

registry-dump util can also output a timeline instead of a JSON, by adding the -t flag

Run relevant plugins on Hive

registry-plugins-run ~/Documents/TestEvidence/Registry/SYSTEM -o /tmp/plugins_output.json

The hive type will be detected automatically and the relevant plugins will be executed. See the plugins section for more information

Compare registry hives

Compare registry hives of the same type and output to CSV (if -o is not specified output will be printed to screen)

registry-diff NTUSER.dat NTUSER_modified.dat -o /tmp/diff.csv

Example output:

[2019-02-11 19:49:18.824245] INFO: regipy.cli: Comparing NTUSER.DAT vs NTUSER_modified.DAT
╒══════════════╤══════════════╤════════════════════════════════════════════════