live acquisition for registry

chemical349 · 2011-03-07T13:20:03Z

i hope i did not ask a stupid question here, i want to capture a set of registry from a live pc, is there any nice small tool that someone can introduce to me? i have been try using ftk imager lite but it's image the whole disk but i just need the registry for comparion. because i am just a student in the field and i want to use regripper then to compare. thanks in advance.

Page 2 / 2 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by MrWh1t3 16 years ago

11 Posts

6 Users

0 Reactions

3,009 Views

RSS

MrWh1t3

(@mrwh1t3)

Eminent Member

Joined: 16 years ago

Posts: 41

31/03/2011 10:41 pm

Capture it using FTK Imager and then pull the reg keys out using volatility. You can extract reg hives using volatility one windows and some linux systems as well.

Good luck!

ReplyQuote

Page 2 / 2 Prev