registry_query
Search Windows registry hives using exact, substring, or regex matching, with subtree scoping, field selection, and pagination for forensic analysis.
Instructions
Query registry values with exact, substring, or regex matching, subtree scope, field projection, and pagination. Returns results and total_matched over the readable subtree, with read diagnostics. Follow next_offset for the next page.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| fields | No | Return only selected fields; missing optional fields are omitted | |
| offset | No | ||
| pattern | Yes | ||
| hive_path | Yes | ||
| match_mode | No | substring | |
| search_data | No | ||
| search_names | No | ||
| case_sensitive | No | ||
| key_path_prefix | No | Whole subtree key, hive-relative or including root name | |
| diagnostic_limit | No | Maximum read-error details; read_errors always counts all errors |