drop registry hive file listing or disk inventory csv · detect registry hives that are unusually small or large · identify hives that were truncated or padded · surface hive size inconsistencies indicating tampering or replacement · runs locally
hive file listing
drop file listing or mft csv
or click
SYSTEM · SOFTWARE · SAM · SECURITY · NTUSER.DAT · UsrClass.dat · BCD · .LOG1/.LOG2 · Size/Length + LastWriteTime columns
drop registry hive file listing or mft csv filtered to config/profile paths