drop registry export with timestamps from multiple snapshots · detect registry keys whose last write time regressed between snapshots · identify impossible timestamp rollbacks in registry key history · surface offline editing and hive restoration artifacts · runs locally
expects LastWrite/LastModified + KeyPath · snapshots ordered by capture date or filename · RegRipper / Registry Explorer / Velociraptor exports
drop two or more registry CSV exports with last-write timestamps