• Use as a library:
  • Recurse over the registry hive, from root or a given path and get all subkeys and values
  • Read specific subkeys and values
  • Apply transaction logs on a registry hive
• Command Line Tools
  • Dump an entire registry hive to json
  • Apply transaction logs on a registry hive
  • Compare registry hives
  • Execute plugins from a robust plugin system (i.e: amcache, shimcache, extract computer name...)

pip install regipy

python setup.py install

registry-parse-header ~/Documents/TestEvidence/Registry/SYSTEM

╒════════════════════════╤══════════╕
 │ signature              │ b'regf'  │
 ├────────────────────────┼──────────┤
 │ primary_sequence_num   │ 11639    │
 ├────────────────────────┼──────────┤
 │ secondary_sequence_num │ 11638    │
 ├────────────────────────┼──────────┤
 │ last_modification_time │ 0        │
 ├────────────────────────┼──────────┤
 │ major_version          │ 1        │
 ├────────────────────────┼──────────┤
 │ minor_version          │ 5        │
 ├────────────────────────┼──────────┤

│ file_type              │ 0        │
 ├────────────────────────┼──────────┤
 │ file_format            │ 1        │
 ├────────────────────────┼──────────┤
 │ root_key_offset        │ 32       │
 ├────────────────────────┼──────────┤
 │ hive_bins_data_size    │ 10534912 │
 ├────────────────────────┼──────────┤
 │ clustering_factor      │ 1        │
 ├────────────────────────┼──────────┤
 │ file_name              │ SYSTEM   │
 ├────────────────────────┼──────────┤
 │ checksum               │ 0        │
 ╘════════════════════════╧══════════╛
 [2019-02-09 13:46:12.111654] WARNING: regipy.cli: Hive is not clean! You should apply transaction logs

• When parsing the header of a hive, also checksum validation and transaction validations are done

registry-dump ~/Documents/TestEvidence/Registry/NTUSER-CCLEANER.DAT -o /tmp/output.json

registry-run-plugins ~/Documents/TestEvidence/Registry/SYSTEM -o /tmp/plugins_output.json

registry-diff NTUSER.dat NTUSER_modified.dat -o /tmp/diff.csv

[2019-02-11 19:49:18.824245] INFO: regipy.cli: Comparing NTUSER.DAT vs NTUSER_modified.DAT
 ╒══════════════╤══════════════╤════════════════════════════════════════════════════════════════════════════════╤════════════════════════════════════════════════╕
 │ difference   │ first_hive   │ second_hive                                                                    │ description                                    │
 ╞══════════════╪══════════════╪════════════════════════════════════════════════════════════════════════════════╪════════════════════════════════════════════════╡
 │ new_subkey   │              │ 2019-02-11T19:46:31.832134+00:00                                               │ \Software\Microsoft\legitimate_subkey          │
 ├──────────────┼──────────────┼────────────────────────────────────────────────────────────────────────────────┼────────────────────────────────────────────────┤
 │ new_value    │              │ not_a_malware: c:\temp\legitimate_binary.exe @ 2019-02-11 19:45:25.516346+0:00 │ \Software\Microsoft\Windows\CurrentVersion\Run │

╘══════════════╧══════════════╧════════════════════════════════════════════════════════════════════════════════╧════════════════════════════════════════════════╛
 [2019-02-11 19:49:18.825328] INFO: regipy.cli: Detected 2 differences

registry-transaction-logs NTUSER.DAT -p ntuser.dat.log1 -s ntuser.dat.log2 -o recovered_NTUSER.dat 

from regipy.registry import RegistryHive
 reg = RegistryHive('/Users/martinkorman/Documents/TestEvidence/Registry/Vibranium-NTUSER.DAT')

for entry in reg.recurse_subkeys(as_json=True):
     print(entry)

for sk in reg.get_key('Software').iter_subkeys():
     print(sk.name, convert_wintime(sk.header.last_modified).isoformat())
 
 Adobe 2019-02-03T22:05:32.525965
 AppDataLow 2019-02-03T22:05:32.526047
 McAfee 2019-02-03T22:05:32.526140
 Microsoft 2019-02-03T22:05:32.526282
 Netscape 2019-02-03T22:05:32.526352
 ODBC 2019-02-03T22:05:32.526521
 Policies 2019-02-03T22:05:32.526592

reg.get_key('Software\Microsoft\Internet Explorer\BrowserEmulation').get_values(as_json=True)
 [{'name': 'CVListTTL',
   'value': 0,
   'value_type': 'REG_DWORD',
   'is_corrupted': False},
  {'name': 'UnattendLoaded',
   'value': 0,
   'value_type': 'REG_DWORD',
   'is_corrupted': False},
  {'name': 'TLDUpdates',
   'value': 0,
   'value_type': 'REG_DWORD',
   'is_corrupted': False},
  {'name': 'CVListXMLVersionLow',
   'value': 2097211,
   'value_type': 'REG_DWORD',
   'is_corrupted': False},
  {'name': 'CVListXMLVersionHigh',
   'value': None,
   'value_type': 'REG_DWORD',
   'is_corrupted': False},
  {'name': 'CVListLastUpdateTime',
   'value': None,
   'value_type': 'REG_DWORD',
   'is_corrupted': False},
  {'name': 'IECompatVersionHigh',
   'value': None,
   'value_type': 'REG_DWORD',
   'is_corrupted': False},
  {'name': 'IECompatVersionLow',
   'value': 2097211,
   'value_t   ype': 'REG_DWORD',
   'is_corrupted': False},
  {'name': 'StaleCompatCache',
   'value': 0,
   'value_type': 'REG_DWORD',
   'is_corrupted': False}]

from regipy.plugins.ntuser.ntuser_persistence import NTUserPersistencePlugin
 NTUserPersistencePlugin(reg, as_json=True).run()
 
 {
  'Software\\Microsoft\\Windows\\CurrentVersion\\Run': {
   'timestamp': '2019-02-03T22:10:52.655462',
   'values': [{
    'name': 'Sidebar',
    'value': '%ProgramFiles%\\Windows Sidebar\\Sidebar.exe /autoRun',
    'value_type': 'REG_EXPAND_SZ',
    'is_corrupted': False
   }]
  }
 }

from regipy.plugins.utils import run_relevant_plugins
 reg = RegistryHive('/Users/martinkorman/Documents/TestEvidence/Registry/SYSTEM')
 run_relevant_plugins(reg, as_json=True)
 
 {
  'routes': {},
  'computer_name': [{
   'control_set': 'ControlSet001\\Control\\ComputerName\\ComputerName',
   'computer_name': 'DESKTOP-5EG84UG',
   'timestamp': '2019-02-03T22:19:28.853219'
  }]
 }