# Registry Hive Parser

Parse offline Windows registry hive bytes from hex or Base64, inspect regf header integrity, browse keys and values, and sweep Run/RunOnce autostart locations locally.

## Run it

- **CLI:** `gizza tool registry-hive-parser "Paste hex bytes starting with 72 65 67 66 ... (ASCII 'regf'), or choose Base64 below"`
- **Web:** https://gizza.ai/tools/registry-hive-parser/
- **Agents:** machine-readable descriptor (parameters JSON Schema) at https://gizza.ai/tools/registry-hive-parser/tool.json

## Inputs

- `data` — Hive bytes _(field)_
- `input_encoding` — Input encoding _(field)_
- `mode` — Inspection mode _(field)_
- `path` — Key path (for path mode) _(field)_
- `max_entries` — Maximum entries per section _(field)_

## Output

- Result (text)

## Query parameters

Open the tool pre-filled and auto-run via URL:

- `data` — Hive bytes
- `input_encoding` — Input encoding
- `mode` — Inspection mode
- `path` — Key path (for path mode)
- `max_entries` — Maximum entries per section

Example: `https://gizza.ai/tools/registry-hive-parser/?data=Paste%20hex%20bytes%20starting%20with%2072%2065%2067%2066%20...%20%28ASCII%20%27regf%27%29%2C%20or%20choose%20Base64%20below&input_encoding=hex&mode=summary&path=Software%5CMicrosoft%5CWindows%5CCurrentVersion%5CRun&max_entries=50`

---

## About this tool

Registry Hive Parser is a local DFIR helper for offline Windows registry hives such as `NTUSER.DAT`, `SYSTEM`, `SOFTWARE`, `SAM`, `SECURITY`, `USRCLASS.DAT`, and Amcache hives. Encode the hive as hex or Base64, paste it into the form, then choose a summary, a specific key path, or an autostart RunKeys sweep.

The summary mode validates the `regf` signature, parses the base-block metadata, recomputes the header checksum, flags dirty sequence numbers and truncation, and lists root subkeys/values when structured traversal succeeds. Path mode browses a backslash-separated key relative to the hive root, so use `Software\\Microsoft\\Windows\\CurrentVersion\\Run` for an `NTUSER.DAT` hive rather than adding `HKCU`. RunKeys mode probes common per-user, machine-wide, policy, Winlogon, BootExecute, and 32-bit-view autostart locations used during incident response.

### Worked example

To inspect an NTUSER Run key from the command line after installing the CLI:

```bash
gizza tool registry-hive-parser --data "$(xxd -p -c 256 NTUSER.DAT)" --mode path --path "Software\\Microsoft\\Windows\\CurrentVersion\\Run" --max-entries 25
```

For a quick browser smoke test, paste `504b0304140000000800` with summary mode. The tool should reject it as a ZIP header, not a registry hive. Real hive bytes begin with ASCII `regf` (`72 65 67 66` in hex) and must include the 4096-byte base block.

### Limits and edge cases

- This tool does not replay `.LOG`, `.LOG1`, or `.LOG2` transaction logs. Dirty hives are flagged so you can decide whether to replay logs in a forensic workstation first.
- Deleted-cell recovery, timeline reconstruction, transaction-log replay, and plugin-style artifact interpretation are out of scope for the current gizza model.
- Damaged hives still get a header report. When the key tree cannot be walked, the tool may carve key names from raw `nk` cells, but carved names cannot be reliably tied back to parent paths or values.
- Paste-friendly inputs are text encodings of the hive bytes. Very large hives may produce long output; use `max_entries` to keep reports reviewable.

## FAQ

<details>
<summary>Do I paste a file path or the hive bytes?</summary>

Paste the hive bytes encoded as hex or Base64. Browser and chat blocks cannot read your local disk path directly, so encode the file first, for example with `xxd -p NTUSER.DAT` or `base64 NTUSER.DAT`.

</details>

<details>
<summary>Should my path include HKCU or HKLM?</summary>

No. An offline hive starts at its own root. For `NTUSER.DAT`, enter a path such as `Software\\Microsoft\\Windows\\CurrentVersion\\Run`; for a `SOFTWARE` hive, enter `Microsoft\\Windows\\CurrentVersion\\Run`.

</details>

<details>
<summary>Can it recover deleted keys or replay registry logs?</summary>

No. It reports live keys/values when the hive tree parses and can carve key names from damaged hives as a fallback. It does not replay transaction logs or reconstruct deleted-cell timelines.

</details>

<details>
<summary>Why does RunKeys mode say a location is missing?</summary>

RunKeys mode checks known paths across NTUSER.DAT, SOFTWARE, and SYSTEM-style hives. A missing path usually means the loaded hive family does not contain that location or the software has no values configured there.

</details>

## Related tools

- [Shellbags Parser](https://gizza.ai/tools/shellbags-parser/): Parse Windows shellbags from a registry hive pasted as hex or Base64: walk BagMRU, decode shell items and rebuild the folder paths a user browsed, deleted ones included.
- [Amcache Parser](https://gizza.ai/tools/amcache-parser/): Parse Windows Amcache.hve bytes from hex or Base64 and report application, executable, driver, shortcut, SHA-1 hash and timestamp evidence locally.
- [Memory Strings Extractor](https://gizza.ai/tools/memory-strings/): Extract ASCII and UTF-16LE strings from a memory or process dump, then group URLs, IPs, emails, domains, file paths and registry keys locally.
- [USN Journal Parser](https://gizza.ai/tools/usnjrnl-parser/): Parse an NTFS $UsnJrnl:$J change journal from hex or Base64 and list file create, rename, write and delete events with UTC timestamps, locally.
- [Super timeline builder](https://gizza.ai/tools/super-timeline-builder/): Merge parsed forensic artifact CSVs into one sorted UTC timeline with expansion, dedupe, filters, and CSV/l2tcsv/TLN exports.