hivex Logo

hivex

0
Free
Visit Website

Hivex is a Windows Registry hive extraction library that allows users to read and write Windows Registry 'hive' binary files. It provides a C API and can export the hive as XML. The library is written in C and has bindings for OCaml, Perl, Python, and Ruby. It is licensed under LGPL v2.1. Hivex is a self-contained library that does not use the textual .REG format for output. Instead, it provides a C API and a separate program to export the hive as XML. The library is derived from several sources, including NTREG registry reader/writer library and dumphive, a BSD-licensed Pascal program. Hivex is designed to be more careful about handling error cases, corrupt and malicious registry files, and endianness compared to other libraries.

FEATURES

ALTERNATIVES

A repository containing material from a talk on sub-domain enumeration techniques

Analyse a forensic target to find and report files found and not found in hashlookup CIRCL public service.

RegRippy is a modern Python 3 alternative to RegRipper for extracting data from Windows registry hives.

A library to access and parse Windows Shortcut File (LNK) format.

Recreates the File/Directory tree structure from an extracted $MFT file with detailed record mapping and analysis capabilities.

A recognition framework for identifying products, services, operating systems, and hardware by matching fingerprints against network probes.

Automated Mac Forensic Triage Collector

A library for working with Windows NT data types, providing access and manipulation functions.