Legal Cyber Academy
ToolFreeCurrent

RegRipper

Harlan Carvey · RegRipper 3.0 · 2026

Access and status

Cost

Free

Free to read or download at source. No account, no purchase.

Status

Current

Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.

What it is

An open-source Perl tool that runs a library of plugins against Windows registry hives and reports the values that matter forensically, with each plugin documenting the key it read. RegRipper 3.0 is the current line and the repository remains actively updated.

Who it is for, and when

RegRipper is how most examiners get from a raw hive file to answers about USB device history, installed software, autostart locations, user accounts, typed paths, and shellbags without hand-navigating the registry. Its real value in expert work is transparency: each plugin names the key and value it relied on, so a conclusion can be traced back to a specific registry path in a report. Plugins are short Perl files, so an examiner can write one for an artefact nobody has covered yet.

What it does not cover

RegRipper reads hives; it does not extract them from an image, does not recover deleted registry keys from hive slack (tools such as Arsenal's Registry Recon or a dedicated hive parser are for that), and does not interpret the registry for you beyond what a plugin's author chose to report. Plugin coverage varies in age and quality, and a missing plugin is not evidence of a missing artefact.

Go to the source

Open at github.com (opens in a new tab)

https://github.com/keydet89/RegRipper3.0

Details

Type
Tool
Written for
Working examinerAdvancedWorking examiner, Advanced
Author
Harlan Carvey
Version verified
RegRipper 3.0
Year
2026
Topics
registry, windows, open-source, triage, scripting
Checked at source
  • A large collection of free single-purpose Windows artefact parsers — among them MFTECmd, PECmd, LECmd, JLECmd, AmcacheParser, SBECmd, EvtxECmd, RECmd, and the Timeline Explorer and Registry Explorer GUIs. The tools are still distributed from ericzimmerman.github.io, with a Get-ZimmermanTools helper that pulls the current set.

  • An open-source Python framework that extracts timestamps from hundreds of artefact types across a disk image or directory and writes them into a single normalised storage file. log2timeline is the extraction front end; psort and psteal filter, sort, and export the result.

  • David Cowen's daily-blog project, running to over 800 numbered posts plus the Sunday Funday challenges, Solution Saturday write-ups and the Forensic Lunch video series, covering Windows artifacts, NTFS internals, cloud logging and DFIR programming.

  • An artifact-by-artifact working guide to Windows examination: Volume Shadow Copies, file metadata, registry analysis, malware detection on a dead box, timeline construction and artifact correlation. Written as a bench manual rather than a textbook.

  • An open-source graphical forensic platform built over The Sleuth Kit, with an ingest-module architecture for keyword search, hash matching, web and email artefacts, and timeline review. It is now maintained by Sleuth Kit Labs, which also sells the commercial Cyber Triage product.