drop a raw registry hive binary · scan hive for deleted but not overwritten key and value structures · recover key names · value names · value data · creation timestamps · forensic registry carving · runs locally
hive binary
drop registry hive
or click
drop raw registry hive (NTUSER.DAT · SOFTWARE · SYSTEM · SAM · SECURITY)