Registry Decoder v1.0 - Digital Forensics Tool
What is Registry Decoder?
Registry Decoder provides a single tool in which to perform browsing, searching, analysis, and reporting of registry hive contents. All functionality is exposed through an intuitive GUI interface and accommodates even novice investigators. Registry Decoder is a free and open source tool
Registry Decoder was initially funded by the National Institute of Justice in late 2009 in the form of a research and development grant. Since the expiration of that grant, it has continued to be developed by Digital Forensics Solutions in order to add new features and perform more complex analysis. The main developers of Registry Decoder are Lodovico Marziale and Andrew Case.
Features:
- Hive Browsing
- Hive Searching
- Plug-in System
- Differencing of Registry Files
- Automated Reporting
Supported Evidence Types:
- Raw (dd) images
- Raw partition images
- Individual Registry Files
- Databases created by the online acquisition component
