• Home
• Search
• Taxonomy
• Developers
• Contacts

Searching for forensic tools and techniques by

functionality

Find all Windows Registry Analysis tools and techniques    Refine by search parameters

Forensic Functionality:	Windows Registry Analysis
Description:	No description available.
Technical Parameters:	Tool host OS / runtime environment:	Input data type(s):	Automated hive extraction and parsing:	Registry rebuilding:	Deleted key recovery:	Key and value instance display:	Pre-built reports:
	any N/A Windows Mac Linux	any N/A raw (dd) EnCase Evidence File Format Version 2 (.ex01) Expert Witness (.e01) virtual disk format (e.g., .vdi, .vhd, .vmdk) physically mounted slave drive loose hive(s)	any N/A active Registry active file system Windows restore points volume shadow copies unallocated space automated hive extraction and parsing not supported	any N/A Supports Registry rebuilding Registry rebuilding unsupported	any N/A Supports deleted key recovery Deleted key recovery not supported	any N/A Supports display of key and value instances No support for displaying key and value instances	any N/A Support for pre-built reports Pre-built reports not supported