# hivex

hivex is a Digital Forensics product. It runs on-premises. Pricing is free.

A Windows Registry hive extraction library that provides C API access for reading and writing registry binary files with XML export capabilities.

Checked October 2026.

## What is hivex?

Hivex is a Windows Registry hive extraction library that enables reading and writing of Windows Registry 'hive' binary files. The library provides a C API for programmatic access to registry data and includes a separate program for exporting hive contents as XML format.

Written in C with bindings available for OCaml, Perl, Python, and Ruby, Hivex operates as a self-contained library that does not rely on the textual .REG format for output. The library focuses on careful handling of error cases, corrupt registry files, malicious registry files, and endianness issues.

Hivex is derived from multiple sources including the NTREG registry reader/writer library and dumphive, a BSD-licensed Pascal program. The library is distributed under the LGPL v2.1 license and provides forensic investigators and system administrators with tools for analyzing Windows Registry data structures.

Tags: Registry, XML, Windows

## Where it fits in your security program (NIST CSF 2.0)

- [Respond](https://cybersectools.com/guides/building-respond-program-small-team): helps you contain and handle incidents.

## Quick facts

- Category: [Security Operations](https://cybersectools.com/categories/security-operations) · [Digital Forensics](https://cybersectools.com/categories/digital-forensics)
- Deployment: On-Premises
- Company size fit: Startup, SMB, Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 145
- Website: github.com

## Where it ranks

No shortlist covers this product's category yet. The closest is [Best MDR Solutions for Business](https://cybersectools.com/shortlists/best-mdr-solutions).

## hivex FAQ

### What is hivex?

hivex is a product in the Digital Forensics category. It covers Registry, XML and Windows.

### What is the pricing for hivex?

hivex is free. Download and setup instructions are at https://github.com/libguestfs/hivex/.

### What are alternatives to hivex?

Alternatives to hivex listed on CybersecTools:

1. [ElcomSoft Advanced Office Password Recovery](https://cybersectools.com/tools/elcomsoft-advanced-office-password-recovery) - Password recovery tool for MS Office, WordPerfect, Lotus & other office docs. (Commercial)
2. [MailXaminer](https://cybersectools.com/tools/mailxaminer) - Windows-based email forensics tool for evidence recovery and analysis. (Commercial)
3. [Cyber Triage Automated Investigation Platform](https://cybersectools.com/tools/cyber-triage-automated-investigation-platform) - Automated DFIR platform for rapid incident investigation and endpoint triage (Commercial)
4. [WindowsSCOPE Cyber Forensics](https://cybersectools.com/tools/windowsscope-cyber-forensics) - GUI-based memory forensic capture tool for cyber forensics and cyber crime investigation. (Commercial)
5. [AhnLab A-FIRST 디지털 포렌식 서비스](https://cybersectools.com/tools/ahnlab-a-first-digital-forensics-service) - Digital forensics service for incident analysis and APT response (Commercial)

Compare all hivex alternatives at [https://cybersectools.com/alternatives/hivex](https://cybersectools.com/alternatives/hivex)

### What deployment and organization size does hivex fit?

hivex is available as on-premises software. It is listed for startups, small businesses, mid-market companies and enterprises. It is free.

## Compare hivex with similar solutions

- [hivex vs ElcomSoft Advanced Office Password Recovery](https://cybersectools.com/compare/elcomsoft-advanced-office-password-recovery-vs-hivex)
- [hivex vs MailXaminer](https://cybersectools.com/compare/hivex-vs-mailxaminer)
- [hivex vs Cyber Triage Automated Investigation Platform](https://cybersectools.com/compare/cyber-triage-automated-investigation-platform-vs-hivex)

All alternatives to hivex: [/alternatives/hivex](https://cybersectools.com/alternatives/hivex)

---

Source: https://cybersectools.com/tools/hivex

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on hivex: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md