dfwinreg icon indicating copy to clipboard operation
dfwinreg copied to clipboard

Digital Forensics Windows Registry (dfWinReg)

Results 8 dfwinreg issues
Sort by recently updated
recently updated
newest added

add support for HKEY_LOCAL_MACHINE\BCD00000000 The corresponding regf file is typically stored on the boot volume (active partition) under `\Boot\` or `\EFI\Microsoft\Boot\`

enhancement

Add sanity check if Windows NT SYSTEM Registry file contains CurrentControlSet key

enhancement

key => directory with name of the key values => sub directory of a directory with name of the key named "(values)" default value => file in sub directory "(values)"...

expose corrupted flag in dfWinReg

enhancement

Currently FindSpecs and WinRegistrySearch are not able to search for Values within a specific key, limiting searches to keys only. The docstring for WinRegistrySearcher is slightly incorrect here as it...

- initially directly map this to HKEY_LOCAL_MACHINE\Software\Classes ? - https://msdn.microsoft.com/en-us/library/windows/desktop/ms724475%28v=vs.85%29.aspx - https://msdn.microsoft.com/en-us/library/windows/desktop/ms724498%28v=vs.85%29.aspx

enhancement

- [ ] add support for default values

enhancement

Add support for restore points

enhancement