Install regipy with Homebrew

Project links

• Homepage
• Package manager page

Commands and aliases

• regipy-diff
• regipy-dump
• regipy-parse-header
• regipy-plugins-list
• regipy-plugins-run
• regipy-process-transaction-logs

Project history

regipy was created as a Python toolkit for offline parsing of Windows Registry hive files. It grew beyond basic parsing to include transaction-log recovery, hive comparison, and a plugin framework for extracting forensic artifacts.

Adoption history

regipy is packaged as both a Python library and a collection of command-line programs. Its plugin system and dedicated tools for hive dumping, differencing, header parsing, and transaction-log processing support repeatable forensic workflows.

How it is used

Users can parse hive metadata, dump hive contents, compare hives, enumerate or run forensic plugins, and process transaction logs through the supplied regipy-* executables or the Python API.

Why package nerds care

The project gives Unix and macOS users a scriptable, offline way to examine Windows Registry artifacts without using the Windows Registry APIs. That combination is particularly useful for cross-platform incident-response and forensic pipelines.

Timeline

• 5.0.0: The project reported 52 forensic plugins and introduced validation cases for plugins
• 6.2.0: Additional plugins were released
• 6.2.1: The project added an MCP server and maintenance updates

Related projects

• Windows Registry hive format
• digital-forensics and incident-response tooling
• Python

Sources

• https://github.com/mkorman90/regipy#readme
• https://github.com/mkorman90/regipy/releases