RegRipper
Harlan Carvey · RegRipper 3.0 · 2026
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
An open-source Perl tool that runs a library of plugins against Windows registry hives and reports the values that matter forensically, with each plugin documenting the key it read. RegRipper 3.0 is the current line and the repository remains actively updated.
Who it is for, and when
RegRipper is how most examiners get from a raw hive file to answers about USB device history, installed software, autostart locations, user accounts, typed paths, and shellbags without hand-navigating the registry. Its real value in expert work is transparency: each plugin names the key and value it relied on, so a conclusion can be traced back to a specific registry path in a report. Plugins are short Perl files, so an examiner can write one for an artefact nobody has covered yet.
What it does not cover
RegRipper reads hives; it does not extract them from an image, does not recover deleted registry keys from hive slack (tools such as Arsenal's Registry Recon or a dedicated hive parser are for that), and does not interpret the registry for you beyond what a plugin's author chose to report. Plugin coverage varies in age and quality, and a missing plugin is not evidence of a missing artefact.
Go to the source
Open at github.com (opens in a new tab)https://github.com/keydet89/RegRipper3.0
Details
- Type
- Tool
- Written for
- Working examinerAdvancedWorking examiner, Advanced
- Author
- Harlan Carvey
- Version verified
- RegRipper 3.0
- Year
- 2026
- Topics
- registry, windows, open-source, triage, scripting
- Checked at source
Related entries
A large collection of free single-purpose Windows artefact parsers — among them MFTECmd, PECmd, LECmd, JLECmd, AmcacheParser, SBECmd, EvtxECmd, RECmd, and the Timeline Explorer and Registry Explorer GUIs. The tools are still distributed from ericzimmerman.github.io, with a Get-ZimmermanTools helper that pulls the current set.
An open-source Python framework that extracts timestamps from hundreds of artefact types across a disk image or directory and writes them into a single normalised storage file. log2timeline is the extraction front end; psort and psteal filter, sort, and export the result.
David Cowen's daily-blog project, running to over 800 numbered posts plus the Sunday Funday challenges, Solution Saturday write-ups and the Forensic Lunch video series, covering Windows artifacts, NTFS internals, cloud logging and DFIR programming.
An artifact-by-artifact working guide to Windows examination: Volume Shadow Copies, file metadata, registry analysis, malware detection on a dead box, timeline construction and artifact correlation. Written as a bench manual rather than a textbook.
Autopsy
FreeAn open-source graphical forensic platform built over The Sleuth Kit, with an ingest-module architecture for keyword search, hash matching, web and email artefacts, and timeline review. It is now maintained by Sleuth Kit Labs, which also sells the commercial Cyber Triage product.