Quick Registry Browser
Allows the examiner to quickly view data in the highlighted Registry file.
Binary values can be viewed as hex/ASCII by double-clicking on them. Use the 'View Key Data' option to examine the binary data associated with Registry keys (folders).
Selected values can be bookmarked with the option to convert binary data to ASCII (non-ASCII characters are replaced with a '·' character).
Registry values can be re-bookmarked in order to change the bookmark columns shown in the report.
The user can opt to copy the path of the highlighted value/key to the Windows clipboard. Note that the copied version of the path will exclude the 'Read Hive' root-folder, which is created by EnCase.
For additional information, please see the following Twitter post:
This script was developed for use in EnCase training. For more details, please click the following link:
Download Now