drop a raw disk image or memory dump · scan for registry hive fragments by regf signature · extract and reconstruct partial hives · identify additional registry hives beyond the standard locations · runs locally
disk image
drop image or dump
or click
512-byte aligned + unaligned regf scan · partial hives downloadable
drop raw disk image or memory dump · large files stream in chunks