Description

Registry forensics has long been relegated to analyzing only readily accessible Windows Registries, often one at a time, in a needlessly time-consuming and archaic way. Registry Recon is not just another Registry parser. Arsenal developed powerful new methods to parse Registry data so that Registries which have existed on a Windows system over time can be rebuilt, providing unique insight into how Registry data has changed over time.

Registry Recon provides access to an enormous volume of Registry data which has been effectively deleted, whether that deletion occurred due to benign system activity, malfeasance by a user, or even re-imaging by IT personnel. Arsenal Subscription PlansEach subscription includes access to all the Arsenal tools (both those that exist now and released while the subscription is active), updates, and support!

License

Choose an optionStandard EditionProfessional EditionEnterprise EditionStandard EditionProfessional EditionEnterprise EditionClear

Advanced PDF Password Recovery quantity

Add to cart

Related products

Elcomsoft Desktop Forensic Bundle
$2,199.00
Select options

Select options
This product has multiple variants. The options may be chosen on the product page

Elcomsoft Cloud eXplorer
$1,995.00
Select options

Select options
This product has multiple variants. The options may be chosen on the product page

Elcomsoft Mobile Forensic Bundle
$2,999.00
Add to cart

Add to cart

Registry Recon Executive Summary

Registry Recon, developed by Arsenal Recon, is a powerful computer forensics tool used to extract, recover, and parse registry data from Windows systems. The process of manually scouring Windows Registry files proves to be extremely time consuming and leaves gaping holes in the ability to recover critical information.

What makes this tool superior to others is its capability to examine registry files not only from the current installation of a Windows operating system, but former installations as well. In addition, this application can be used to quickly and efficiently determine external devices that have been connected to the computer. The company’s slogan is, “Computer forensics tools by computer forensics experts.” This tool certainly affirms the slogan!Installation

For the most part, the installation of the product was straightforward. However, installation requires Microsoft Visual Studio C++ 2010 Redistributable and the .NET Framework 4 packages. As shown in Figure 1, you may already have multiple versions of the Redistributable package installed. But each installation contains different libraries.

Microsoft Visual C++ is an integrated development environment (IDE) often used in the development of software for Windows operating systems. Quite often when new software is coded, the programmers will make use of a number of the standard libraries included in the Redistributable and .NET packages.

These libraries include common code that has already been pre-written and tested by Microsoft. Many times the Redistributable package is included within the installation files/steps of the software package. That was not the case here. I had to download and install the Visual C++ Redistributable 2010 package prior to installationof Registry Recon. Just a tiny snag!

What is the Windows Registry?

The Windows registry recon download is a central repository that stores numerous configuration settings in the Windows operating system(s). The Registry stores settings for software, hardware, users, the operating system configuration, and much more. The registry is organized in a hierarchical structure of subtrees, keys, subkeys, and entries. The 5 root keys are called the “HKEYs”.

Click to enlarge

Registry Recon

$650.00

Registry Recon provides access to an enormous volume of Registry data which has been effectively deleted, whether that deletion occurred due to benign system ..