Ubuntu / CAINE Registry Analysis

I'm wondering what others are using for analyzing the Windows registry files with Ubuntu and/or CAINE.

I have installed Wine and am currently using Mitec's Windows Registry Recovery program. It has a nice GUI and is similar to using regedit. It is free to use for both private and commercial users and can be found here: http://www.mitec.cz/wrr.html

Regards,

Joe

Hi Joe,

I too have used WRR by MiTeC in Linux under WINE. Another tool I've used is RegRipper by Harlan Carvey. It is written in PERL, but doesn't run well under Linux in my experience. That said, it is a good analysis tool if you have a Windows box on which to run it.

I just read a blog where Harlan commented that he didn't make it portable to Linux because he didn't know anyone would want to run it on that platform. Maybe he'll address this in the future.

John

Well, a little more poking around, and I found someone who ported RegRipper to Linux here. The page is in Italian, but there is a translation link in the upper right pane. Thanks to Snip for making it available.

The link to the download is at the bottom of the blog entry.

John

John,

Thanks for your reply, I'll take a look at RegRipper this week. My forensic workstations have multiple drives using Windows and Linux. I regularly use LiveView and it is a Windows only tool. It's just nice not to have to reboot if you don't have to and to have an additional tool available to verify findings. I have used other tools Harlan Carvey has created in the past - most notably KeyTime. Thanks again.

Regards,

Joe

I use Registry Ripper regularly during forensic examinations of the registry.
It works well and produces quick results.
I recommend reading Harlan Carveys book - Windows Forensic Analysis (very good) and porvides good explanations as to what the script produces and explanation as to what some of it means.
Mitec is good for verifying results.
I have access to EnCase Forensic Edition so am able to use that to examine the registry also.
I tried to download the linux port but the link on rapidshare no longer works.
I also recommend visiting http://www.woanware.co.uk/.
Some very good scripts located on this website for forensic examination- including the registry.
EZ1

I also use RegRipper. Looking forward to trying the linux port (hopefully link is not broken as a previous poster noted). I have not read all of Harvey's book yet but I frequently look items up in it and highly recommend it as a reference. RegRipper allows for a quick glance at things that you can then verify by more thorough examination (it has always proven correct for me though).


Sully