reglookup

1 File Conversion Utilities

reglookup-recover

Windows NT+ registry deleted data recovery tool

## SYNOPSIS

`reglookup-recover [options] `registry-file``

## DESCRIPTION

reglookup-recover attempts to scour a Windows registry hive for deleted data structures and outputs those found in a CSV-like format.

## OPTIONS

`reglookup-recover` accepts the following parameters:

`-v`

- Verbose output.

`-h`

- Enables the printing of a column header row. (default)

`-H`

- Disables the printing of a column header row.

`-l`

- Display cells which could not be interpreted as valid registry structures at the end of the output.

`-L`

- Do not display cells which could not be interpreted as valid registry structures. This is the default behavior.

`-r`

- Display raw cell contents for cells which were interpreted as intact data structures. This additional output will appear on the same line as the interpreted data.

`-R`

- Do not display raw cell contents for cells which were interpreted as intact data structures. This is the default behavior.

``registry-file``

- Required argument. Specifies the location of the registry file to read. The system registry files should be found under: `%SystemRoot%/system32/config`.

## OUTPUT

`reglookup-recover` generates a comma-separated values (CSV) like output and writes it to stdout. For more information on the syntax of the general format, see `reglookup(1)`.

This tool is new and the output format, particularly the included columns, may change in future revisions. When this format stablizes, additional documentation will be included here.

## EXAMPLES

To dump the recoverable contents of a system registry hive:

    	reglookup-recover /mnt/win/c/WINDOWS/system32/config/system

Extract all available unallocated data, including unparsable unallocated space and the raw data associated with parsed cells in a user-specific registry:

    	reglookup-recover -r -l '/mnt/win/c/Documents and Settings/user/NTUSER.DAT'

## BUGS

This program has been smoke-tested against most current Windows target platforms, but a comprehensive test suite has not yet been developed. (Please report results to the development mailing list if you encounter any bugs. Sample registry files and/or patches are greatly appreciated.)

This program is new as of RegLookup release 0.9.0 and should be considered unstable.

For more information on registry format details and the recovery algorithm, see:

http://sentinelchicken.com/research/registry_format/ http://sentinelchicken.com/research/registry_recovery/

## CREDITS

This program was written by Timothy D. Morgan.

## LICENSE

Please see the file "LICENSE" included with this software distribution.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License version 3 for more details.

## SEE ALSO

reglookup-timeline(1) reglookup-recover(1)