cincan/regripper repository overview

⁠Extract data from Windows registry

RegRipper CLI (rip.pl) can be used to read data out of Windows registry hives with plugins. Written by Harlan 'keydet89' Carvey⁠.

⁠Input

Windows registry hive files

⁠Output

report data

⁠Supported tags and respective Dockerfile links

• latest (regripper/Dockerfile⁠)

⁠Usage

To see what plugins are supported by regripper, run the -l option with the cincan⁠ tool:

cincan run cincan/regripper -l

Extract Run and RunOnce keys from registry (commands that run every time a user logs on) with docker

docker run --rm -v `pwd`:/samples cincan/regripper -r /samples/SOFTWARE -p soft_run

Extract user and group information from the 'SAM' hive file with the samparse plugin:

cincan run cincan/regripper -r samples/SAM -p samparse

Extract installed applications

cincan run cincan/regripper -r samples/SOFTWARE -p product

Extract the exact Windows version of the registry

cincan run cincan/regripper -r samples/SOFTWARE -p winver

⁠Project homepage

https://github.com/keydet89/RegRipper3.0⁠