HEADSWAP TOOLSET : SUMURI
Hibernation Recon
Hive Recon
Hive Recon extracts Registry hives from Windows hibernation and crash dump files, often extracting hives when other solutions have completely failed and extracting healthier (more intact) hives when other solutions have appeared to run successfully. Arsenal Hive Reconย can also extract hives from memory captures, provided they have already been converted to crash dump format.