Registry Forensics - Free Online Windows Hive (regf) Analyzer
Registry Forensics
Load a Windows registry hive - SYSTEM, SOFTWARE, SAM, SECURITY, NTUSER.DAT, UsrClass.dat or Amcache.hve - to walk its real key tree, decode autoruns, USB history, UserAssist, ShellBags, installed software and services, and recover deleted keys still sitting in free space.
Drop a registry hive here
SYSTEM, SOFTWARE, SAM, SECURITY, NTUSER.DAT, UsrClass.dat, Amcache.hve - usually no file extension - or click to browse from your device
Choose hive fileHive Overview
What kind of hive this is, whether it was shut down cleanly, and the system identity this tool could resolve from it.
Key Tree
Navigate the hive's real key tree, exactly as parsed from its nk/vk cells - click a subkey to descend into it.
Known Artifacts
Autoruns, USB device history, typed URLs and paths, recent-document MRU, UserAssist program execution, ShellBags folder history, installed software, services and network profiles - decoded from this hive's own well-known key paths.
Timeline
Every key's last-write time, plus every dated artifact this tool could decode - program executions, USB connections, network activity and the OS install date - merged into one chronological view.
--
Recovered Deleted Cells
Free-space cells that still hold an intact key or value structure - a freed cell in this format usually keeps its whole layout, so recovery here is exact rather than carved.
Strings
Readable text pulled directly from the raw file bytes, ASCII and UTF-16, independent of the key tree.
--
Understanding Registry Forensics
A Database, Not a File
A registry hive is a self-contained database format: a base block, then 4 KB "hive bin" pages, each holding cells for keys, values, security descriptors and subkey indexes. Every offset inside it is relative to where that page data begins, and a cell's own size field carries a sign - negative for allocated, positive for free - that this tool reads directly rather than guessing from context.
UserAssist: Proof of Execution
Windows tracks every program launched from the Start menu or desktop in UserAssist, and then encodes each program's path with ROT13 - a trivial letter-substitution cipher that this tool decodes automatically. Alongside the run count and last-run time, it is some of the strongest evidence available that a specific user actually executed a specific program.
ShellBags Outlive the Folder
Every time Explorer remembers how you liked a folder's icons arranged, it writes an entry to ShellBags - and that entry survives the folder being deleted, or the USB drive it lived on being unplugged for good. This tool reconstructs the full path from the raw shell-item bytes and pulls out whatever creation and modification timestamps happen to be embedded in them.
Freed, Not Gone
Deleting a registry key does not erase its bytes - it marks the cell free and moves on. This tool walks every free cell in the hive and checks whether it still parses as a key or value; when one does, the recovery is exact, not a best guess. When a hive's free space turns out to be entirely zeroed instead, that is reported as its own distinct finding - it means something deliberately wiped the evidence, not that nothing was ever deleted.
Reads the Hive on Disk, Not the Live Registry
This tool parses a hive FILE - the same bytes Windows itself reads at boot, or that a forensic image captures - never a live system's in-memory registry. A hive can be dirty (shut down uncleanly, with the newest changes sitting only in a .LOG1/.LOG2 transaction log this tool detects but deliberately does not replay), so what you see here is the last state actually committed to the file, which can trail the very latest activity by a few writes.
Key Takeaways
-
The active control set is resolved from
Select\Current, never assumed to beControlSet001. -
MRU order comes from the
MRUListExblob, not from the order values happen to be stored in. - Deleted-key recovery distinguishes "nothing found" from "deliberately zeroed" - two very different conclusions.
- Transaction logs are detected, never replayed: the newest changes may be missing from what is shown.
- Nothing leaves your device: every parse, decode and recovery attempt runs client-side in your browser.