Harlan Carvey
Create a Place for Regripper
Get RegRipper
Setup Regripper
• Unpack the zip file
• Move all to the root of the regripper directory
• Update the plugins form
• Test drive
RegRipper Interface
Create a Case Folder
Get Your Hive Files
C:\Windows\System32\Config - Get ‘em all.
Save in your case folder
There they are
• Frame work for extracting and displaying
specific info from hive files
• Permits the tailoring of registry reports
• Enables the writing of plugins
• The contents of the “plugins” file determines
which and in what order the plugins are
Plugins File
RegRipper Interface
Which hive file will be analyzed
Where to put the report
Which Plugins file to use
Command Line exe