Welcome to RegRippy’s documentation!

RegRippy is a Python-3 framework for quickly extracting data from Windows registry hives. It is heavily inspired by RegRipper, and reimplements a lot of its plugins. Its main goal is to simplify the life of DFIR people by giving quick and to-the-point results, without sacrificing automated analysis potential.

One of the main goal is also to make plugin creation accessible to all. We believe Python is a better choice for this than Perl.

Contents:

• Using RegRippy for Incident Response
  • Choosing the plugin
  • Selecting the hive
  • Usage examples
• Plugin test coverage
• Creating a plugin
• Writing tests for your plugins
• RegRip.py standard classes

Indices and tables

• Index

• Module Index

• Search Page