NAME

       reglookup-recover - Windows NT+ registry deleted data recovery tool

SYNOPSIS

       reglookup-recover [options] registry-file

DESCRIPTION

       reglookup-recover  attempts  to  scour a Windows registry hive for deleted data structures
       and outputs those found in a CSV-like format.

OPTIONS

       reglookup-recover accepts the following parameters:

       -v     Verbose output.

       -h     Enables the printing of a column header row. (default)

       -H     Disables the printing of a column header row.

       -l     Display cells which could not be interpreted as valid registry  structures  at  the
              end of the output.

       -L     Do  not  display cells which could not be interpreted as valid registry structures.
              This is the default behavior.

       -r     Display raw  cell  contents  for  cells  which  were  interpreted  as  intact  data
              structures.  This additional output will appear on the same line as the interpreted
              data.

       -R     Do not display raw cell contents for cells which were interpreted  as  intact  data
              structures. This is the default behavior.

       registry-file
              Required  argument. Specifies the location of the registry file to read. The system
              registry files should be found under: %SystemRoot%/system32/config.

OUTPUT

       reglookup-recover generates a comma-separated values (CSV) like output and  writes  it  to
       stdout. For more information on the syntax of the general format, see reglookup(1).

       This  tool  is new and the output format, particularly the included columns, may change in
       future revisions. When this format stablizes, additional documentation  will  be  included
       here.

EXAMPLES

       To dump the recoverable contents of a system registry hive:

            reglookup-recover /mnt/win/c/WINDOWS/system32/config/system

       Extract all available unallocated data, including unparsable unallocated space and the raw
       data associated with parsed cells in a user-specific registry:

            reglookup-recover -r -l '/mnt/win/c/Documents and Settings/user/NTUSER.DAT'

BUGS

       This program has been smoke-tested against most current Windows target  platforms,  but  a
       comprehensive  test  suite  has  not  yet  been  developed.  (Please report results to the
       development mailing list if you encounter any bugs. Sample registry files  and/or  patches
       are greatly appreciated.)

       This program is new as of RegLookup release 0.9.0 and should be considered unstable.

       For more information on registry format details and the recovery algorithm, see:

       http://sentinelchicken.com/research/registry_format/
       http://sentinelchicken.com/research/registry_recovery/

CREDITS

       This program was written by Timothy D. Morgan.

LICENSE

       Please see the file "LICENSE" included with this software distribution.

       This program is distributed in the hope that it will be useful, but WITHOUT ANY  WARRANTY;
       without  even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
       See the GNU General Public License version 3 for more details.

SEE ALSO

       reglookup-timeline(1) reglookup-recover(1)