I know RegRipper can do a live system. I know that ProDiscover has the ability (with its ProScript functionality) to do postmortem with perl. Does anyone have a perl script already written I can use with ProDiscover OR perhaps another tool that enumerates the autorun registry entries on a "dead" drive?
Greetings,
RegRipper works just fine on "dead" systems….
-David
Thanks!
I know RegRipper can do a live system. I know that ProDiscover has the ability (with its ProScript functionality) to do postmortem with perl. Does anyone have a perl script already written I can use with ProDiscover OR perhaps another tool that enumerates the autorun registry entries on a "dead" drive?
Not sure what you mean by "RegRipper can do a live system". Tthrough F-Response, sure…but not when run from a CD or thumb drive.