drop registry hive export with last write times · detect abnormal timestamp clustering · identify mass key modification in short windows · surface registry restoration and manipulation events · runs locally
registry timeline csv
drop registry export csv (multi-file)
or click
expects LastWrite/LastModified + KeyPath · RegRipper / Registry Explorer / Velociraptor exports
drop registry hive export csv with last-write timestamps