drop registry hive binary or reg export · scan for remnants of deleted registry keys in hive slack space · recover key names and values from deleted cells · surface what was removed from the registry · runs locally
registry inputs
drop hive · transaction log · regripper csv
or click
NTUSER.DAT · SOFTWARE · SYSTEM · SAM · SECURITY · .LOG1/.LOG2 transaction logs · deleted-key csv
drop registry hive (.dat) · transaction log (.LOG/.LOG1/.LOG2) · regripper deleted-key csv