Registry Recon is not just another Registry parser. We have developed powerful new methods to parse Registry data, rather than relying on Microsoft APIs, so that Registries which have existed on a Windows system over time can be resurrected. Registry Recon provides access to an enormous volume of Registry data which has been effectively deleted, whether that deletion occurred due to benign system activity, malfeasance by a user, or even re-imaging by IT personnel. Your timelines can now include Registry data that was active, backed up in restore points or volume shadow copies, or carved from unallocated space. While Registry Recon displays unique Registry data by default, seamless access to all instances of particular Registry keys and values is available (with full paths and sector offsets) so your findings can be efficiently authenticated.
Registry Recon, along with all our other tools, is available as part of an affordable monthly subscription - currently, $49 per month. Please contact sales regarding discounts for volume licensing.
What is the Microsoft Windows Registry?
The Registry is a complex ecosystem, in database form, containing information related to hardware, software, and users on computer systems running Microsoft Windows. At a very basic level, the Registry is composed of "keys" and "values" which are similar in some ways to folders and files. Analysis of this information reveals the names of recently accessed files, when applications were last run, who attached removable storage devices, and much more. The Registry is continually referenced during Windows operation so large volumes of Registry data can always be found both on disk and in live memory.
How do you resurrect long forgotten Registries?
We have spent countless hours developing patent pending technologies which allow us to find as much Registry data as possible on a computer system and then rebuild Registries which have existed over time from that data.
What are Recon Registries and Recon View?
Recon Registries are all the Registries rebuilt by Registry Recon. Recon View is our method of showing you all the values within them in a unique and historical fashion, with seamless access to all instances of those values if you so desire.
How do Recon Registries get their names?
If a full set of hives (particularly System and Software) are available for any particular Registry, its Recon Registries name will include the system name, Windows version, and install date. If a System hive is available, but a Software hive is not, the name will include the system name and Machine Security ID ("MSID"). If a Software hive is available, but a System hive is not, the name will include the Windows version and install date. If both System and Software hives are missing, the name will simply include an MSID.
Can Registry Recon resurrect Registries if they have been overwritten?
It's important to keep in mind that in the context of computer forensics, "deleted" and "overwritten" are two very different things. Registry Recon is often very successful rebuilding Registries which have been deleted and only exist in unallocated (deleted) space. Registry Recon cannot however rebuild Registries if they have been overwritten - for example, if a data scrubbing tool has been used to overwrite unallocated space.
Where can I get the latest version of Registry Recon?
You can get the latest version of Registry Recon by selecting the "Request Download" button on this page.
How do support and updates work?
A Registry Recon purchase includes support and updates for one year.
Do I need an Internet connection for Registry Recon licensing?
You only need an Internet connection for Registry Recon when you initially enter your license code and when you renew your license. If you cannot connect to the Internet, see the air-gapped workstation instructions below.
How can I license Registry Recon on an air-gapped (a/k/a offline) workstation?
If you want your air-gapped workstation properly licensed for Registry Recon, please:
- Open Registry Recon and enter the license code you were given
- Upon realizing that no Internet connection is available, Registry Recon will save a ".LIC" file to your ProgramData\ArsenalRecon folder
- On a workstation with Internet access, go to our Offline Activation page and upload the ".LIC" file.
- Finally, copy the CDM file you receive to your ProgramData\ArsenalRecon folder
Your air-gapped workstation is now ready to run Registry Recon!
What kinds of evidence can be added to Registry Recon?
Registry Recon supports adding forensic images in EnCase (E01) and raw (dd) formats, VHD disk images, physically mounted slave drives, and the contents of directories as evidence.
I had trouble adding evidence to Registry Recon, what's wrong?
Certain computer forensics applications can interfere with physical drives being added as evidence to Registry Recon, so Arsenal recommends refraining from their use while Adding Evidence.
I'm a student and would like to try Registry Recon. Where can I find sample evidence?
You can find sample evidence here, here, and here.
What updates are on the way?
We are working on a large number of updates which include support for live memory captures, greatly improving searching, bookmarking, and reporting functionality, and performance tuning.
We consider the resources below to be living documents, so if you have any suggestions please let us know at info@ArsenalRecon.com.