Registry Hive Explorer Lite
Quickly inspect registry hives for common forensic artefacts in your browser.
Drop a Windows registry hive file to extract likely Autoruns, USB device history and UserAssist entries for quick triage. Use the CSV export to download findings for further analysis.
How it works
The Lite explorer scans the binary hive for printable strings and known registry key paths, then applies lightweight heuristics to identify common forensic artefacts (Autoruns, USBSTOR entries, UserAssist). Heavy processing runs inside a Web Worker. You can provide an optional WASM parser (via the UI or site `public/wasm`) for deeper decoding.
This is a triage-focused view — use full registry tools for comprehensive analysis.
Input
Drop a file here or click to browse
Accepted: .reg,.hiv,.dat,.dat?
No file selected
Drop a registry hive to start.
Frequently Asked Questions
Which hive files are supported?
This Lite parser works best with exported hive files (NTUSER.DAT, SYSTEM, SOFTWARE). It is a heuristic parser and not a full registry engine.
Do files leave my browser?
No. All parsing runs locally in your browser or a Web Worker; files are not uploaded.
Does this replace full registry forensics tools?
No. This is a lightweight triage aid to surface common indicators quickly; use dedicated tools for deep analysis.