Registry Recon

Registry Recon

Registry Recon UI showcasing six unique Windows Registries (associated with multiple installs of Windows over time) recovered from a single laptop.
Developer(s) Arsenal Recon
Initial release October 2012 (October 2012)
Stable release 2.10.0015 / November 2014 (November 2014)
Development status Active
Operating system Microsoft Windows
Available in English
Type Computer Forensics
License Proprietary
Website http://ArsenalRecon.com/

Registry Recon is a computer forensics tool that allows users to see how Registries from both current and former installations of Microsoft Windows have changed over time. It was developed by Arsenal Recon, whose slogan is "Computer forensics tools by computer forensics experts." Registry Recon first extracts Registry information from a piece of evidence (disk image, properly mounted slave drive, etc.), whether that information was active, backed up in restore points or Volume Shadow Copies, or deleted. Registry Recon then rebuilds all the Registries represented by the extracted information. Registry Recon was the first (and is currently the only)[1] digital forensics tool to rebuild Registries from both active and previous installations of Windows. The product is named after the French word reconnaissance ("recognition"), the military concept of probing unfriendly territory for tactical information.

Overview

The Windows Registry is a core component of all modern versions of Microsoft Windows. It is a complex ecosystem, in database form, containing information related to hardware, software, and users which is useful to computer forensics practitioners. At a very basic level, the Registry is composed of "keys" and "values" which are similar in some ways to folders and files. The Registry is continually referenced during Windows operation so large volumes of Registry data can be found both on disk and in volatile memory. Registry Recon was designed to address two major shortcomings of existing computer forensics tools - seamlessly recovering as much Registry information as possible from a piece of evidence, and rebuilding it in such a way that the user is able to see how the Registry (or Registries) changed over time.

Capabilities

Additional capabilities and improvements are planned, such as selective data parsing (as opposed to entire images / directories), more automated report features, live memory analysis, and improved search functions.[2] [3] [4] [5] [6]

See also

References

External links

This article is issued from Wikipedia - version of the Monday, March 07, 2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.