fs_registry
Parse Windows registry hives from a disk image using RegRipper plugins to extract local accounts, persistence mechanisms, and services for DFIR analysis.
Instructions
Parse a Windows registry hive from a disk image with RegRipper (read-only). Find the hive's inode first with fs_find (e.g. fs_find image "SAM" or "SYSTEM"), then run a plugin: samparse (local accounts, find attacker-created users), profilelist, run / soft_run (Run-key persistence), services, winlogon, shimcache, usbstor, networklist.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| image | Yes | ||
| hive_inode | Yes | ||
| plugin | Yes | ||
| offset | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |