hivex
A Windows Registry hive extraction library that provides C API access for reading and writing registry binary files with XML export capabilities.
A Windows Registry hive extraction library that provides C API access for reading and writing registry binary files with XML export capabilities.
Checked October 2026.
Hivex is a Windows Registry hive extraction library that enables reading and writing of Windows Registry 'hive' binary files. The library provides a C API for programmatic access to registry data and includes a separate program for exporting hive contents as XML format.
Written in C with bindings available for OCaml, Perl, Python, and Ruby, Hivex operates as a self-contained library that does not rely on the textual .REG format for output. The library focuses on careful handling of error cases, corrupt registry files, malicious registry files, and endianness issues.
Hivex is derived from multiple sources including the NTREG registry reader/writer library and dumphive, a BSD-licensed Pascal program. The library is distributed under the LGPL v2.1 license and provides forensic investigators and system administrators with tools for analyzing Windows Registry data structures.
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about hivex: features, pricing and alternatives.
hivex is a product in the Digital Forensics category. It covers Registry, XML and Windows.
hivex is free. Download and setup instructions are at https://github.com/libguestfs/hivex/.
Alternatives to hivex listed on CybersecTools:
Compare all hivex alternatives at https://cybersectools.com/alternatives/hivex
hivex is available as on-premises software. It is listed for startups, small businesses, mid-market companies and enterprises. It is free.
Side by side: features, pricing model and the company behind each one.
Analyse a forensic target to find and report files found and not found in hashlookup CIRCL public service.
HexPrism is a fast, privacy-first hex editor built for CTFs and digital forensics.
Hindsight is a free tool for analyzing web artifacts from Google Chrome/Chromium browsers and presenting the data in a timeline for forensic analysis.
Hoarder is a tool to collect and parse windows artifacts.
A specialized packet sniffer for displaying and logging HTTP traffic, designed to capture, parse, and log traffic for later analysis.
IE10Analyzer can parse and recover records from WebCacheV01.dat, providing detailed information and conversion capabilities.
On our shortlist?
No shortlist covers this product's category yet. The closest is Best MDR Solutions for Business.
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,033 products.
Connect your AI
