A while back I wrote a Windows GUI for Regripper.
The rationale behind it is that you can quickly run plugins without having to look up which hives they relate to, and you can quickly click through and add them to a text report.
If the plugin indicates that it relates to multiple plugins then the GUI will iterate through each hive. As a result, if you have a plugin (ie regtime) that takes a long time to run, and works on all of the hives then that will make the GUI temporarily hang until everything’s complete. It’ll keep going, but I wouldn’t try to do anything with it or Windows will think it’s crashed and ask you to end the process.
The hives also have to have their proper names or else it won’t be able to identify them.
The main use case is to quickly run through multiple plugins and produce a report. If you have to run the same plugins over multiple sets of hives I’d recommend using a batch file. Alternatively, there’s also Harlan’s rr GUI for running profiles, and Corey Harrell’s auto_rip.
It requires Perl, and the libraries: Win32-GUI, Parse-Win32Registry, and dmake (install instructions at the start of the script)
You can download it here
2 thoughts on “Regripper GUI”
[…] trata de ‘RegripperGUI‘, una herramienta escrita por Phill Moore, autor de los Blogs This Week In 4n6 y ThinkDFIR. […]
[…] is with ‘RegripperGUI‘, a tool written by Phill Moore, author of the BlogsThis Week In 4n6 and ThinkDFIR. The […]