使用 Homebrew 安装 regipy

项目链接

• 主页
• 软件包管理器页面

命令和别名

• regipy-diff
• regipy-dump
• regipy-parse-header
• regipy-plugins-list
• regipy-plugins-run
• regipy-process-transaction-logs

项目历史

regipy was created as a Python toolkit for offline parsing of Windows Registry hive files. It grew beyond basic parsing to include transaction-log recovery, hive comparison, and a plugin framework for extracting forensic artifacts.

采用历史

regipy is packaged as both a Python library and a collection of command-line programs. Its plugin system and dedicated tools for hive dumping, differencing, header parsing, and transaction-log processing support repeatable forensic workflows.

使用方式

Users can parse hive metadata, dump hive contents, compare hives, enumerate or run forensic plugins, and process transaction logs through the supplied regipy-* executables or the Python API.

为什么软件包爱好者会关心

The project gives Unix and macOS users a scriptable, offline way to examine Windows Registry artifacts without using the Windows Registry APIs. That combination is particularly useful for cross-platform incident-response and forensic pipelines.

时间线

• 5.0.0: The project reported 52 forensic plugins and introduced validation cases for plugins
• 6.2.0: Additional plugins were released
• 6.2.1: The project added an MCP server and maintenance updates

Related projects

• Windows Registry hive format
• digital-forensics and incident-response tooling
• Python

来源

• https://github.com/mkorman90/regipy#readme
• https://github.com/mkorman90/regipy/releases