HiveRecon and HbinRecon Launched

Mark Spencer

August 9, 2018

How does exposing Windows Registry data you’ve never seen before sound to you?

We launched two new tools with powerful and unique functionality today – HiveRecon and HbinRecon. We are confident that our customers and colleagues, particularly those interested in the maximum exploitation of electronic evidence, will be pleased that we are yet again exposing valuable information that has not been possible previously.

Summary of HiveRecon Functionality

HiveRecon extracts Registry hives from Windows hibernation and crash dump files, often extracting hives when other solutions have completely failed and extracting healthier (more intact) hives when other solutions have appeared to run successfully. HiveRecon also extracts volatile hives and can incorporate swap files from the same hibernation session to extract even healthier Registry hives than if using a hibernation file alone.

HiveRecon Features:

  • Extracts Windows Registry hives from hibernation and crash dump files
  • Support for both stable and volatile hives
  • Optional incorporation of pagefile from same session as hibernation
  • Hive header checksum patching
  • Detailed CSV output


Summary of HbinRecon Functionality

HbinRecon extracts Windows Registry hive bins (hbins) from any input and decodes the data they contain. Hive bins are essentially the building blocks of Registry hives. Examples of HbinRecon input include healthy Registry hives, fragmented hives, hive transaction logs, and unallocated space. HbinRecon is a surgical tool which is extremely useful in both testing and verification related to Registry data as well as uncovering valuable data not accessible using other methods.

HbinRecon Features:

  • Identifies and parses Windows Registry hive bins from any input
  • Hive (full/partial), transaction log, and hive bin slack identification
  • Multiple scan modes for more efficient processing
  • Decodes nk, vk, sk, lf, lh, li, ri, and db records
  • Date/time decoding (RegFiletime/RegQWord/RegBinary values)
  • Powerful nk and vk hunting modules beginning with “BAM Hunter”
  • Resident and non-resident data options
  • Hive bin carver to carve hive bins from extremely large input
  • CSV output with customizable record separator

Why did we build these new tools?

We are a first and foremost a consulting company. We only engage in software development when we determine that existing tools and techniques are failing to expose valuable information in our cases. The following slides represent some of the workflows (processing Windows hibernation files and then attempting to extract Registry hives from them) using a variety of tools that we tested during the development of HiveRecon. In many ways these slides speak for themselves:


At this point, if you are a digital forensics practitioner, you should be asking yourself just how much Registry data you could have had access to in your previous cases if you were properly extracting hives from hibernation and crash dump files.

Where can you get HiveRecon and HbinRecon?

We are in the process of making both tools available to established customers with active software subscriptions. HiveRecon and HbinRecon will be available soon to new customers as well.



Please support us, as we work to make maximum exploitation of electronic evidence more accessible, by learning more about the powerful and unique functionality our tools provide. You can learn more about our tools at Thank you!

Related Articles

Arsenal Image Mounter and Virtual Machine Inception

Arsenal Image Mounter and Virtual Machine Inception

While we recommend that Hyper-V and AIM be run on “bare metal” (particularly when launching virtual machines), we have recently heard from our customers that they have successfully run both Hyper-V and AIM within VMware.

Arsenal Image Mounter (AIM) Walkthrough

Arsenal Image Mounter (AIM) Walkthrough

This article will briefly summarize the features of AIM’s Free and Professional Modes, explain the requirements for running AIM, and demonstrate how to launch virtual machines and mount Volume Shadow Copies (VSCs) from AIM-mounted disk images.

Arm Yourself!

Join our mailing list to arm yourself with updates about Arsenal tools, training, and research. Our mailing list is double opt-in so you will need to check your email and confirm your subscription before receiving our mailings.

Chelsea, Massachusetts


or (617) 277-3625

Site Map



















Privacy Policy


Terms & Conditions


Cookie Policy

Follow Us




Share This