Skip to content
Yet another registry parser
Branch: master
Clone or download
msuhanov Update.
Latest commit 5c1624e Feb 13, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
cython Update. Oct 22, 2018
hives_for_manual_tests RegistryFuse: expose class names and data types using the xattr (beta). Aug 14, 2017
hives_for_tests Minor update. Nov 27, 2018
records_for_tests Initial release (beta). Jul 3, 2017
yarp Update. Feb 13, 2019
ChangeLog Update. Feb 13, 2019
Example Initial release (beta). Jul 3, 2017
Example.Advanced Minor update (beta). Oct 3, 2017
License Initial release (beta). Jul 3, 2017
License.Python-LLFUSE Minor update. Dec 31, 2017
ReadMe Update. Feb 13, 2019 Update. Oct 22, 2018 Minor update. Nov 27, 2018
yarp-carver Update. Aug 17, 2018
yarp-memcarver Update. Feb 13, 2019
yarp-mount Minor update (beta). Sep 27, 2017
yarp-print Update. Nov 4, 2018
yarp-timeline Minor update. Aug 4, 2018


yarp: yet another registry parser

1. Project goals: the library and tools

- Parse Windows registry files in a proper way (with forensics in mind).
- Expose values of all fields of underlying registry structures.
- Support for truncated registry files and registry fragments.
- Support for recovering deleted keys and values.
- Support for carving of registry hives.
- Support for transaction log files.

2. Hive version numbers supported

- Full support: 1.1-1.6.
- No support: 1.0.

In general, full support is available for hive files from installations of
Windows NT 3.1 and later versions of Windows NT (including Windows 10);
hive files from installations of pre-release versions of Windows NT 3.1 are
not supported.

3. Documentation

See the docstrings in the module.
For usage examples, see the 'Example' and 'Example.Advanced' files.

4. License

This project is made available under the terms of the GNU GPL, version 3.
See the 'License' file.

5. Installation

# pip3 install

6. Known issues

- Issue: the UnicodeEncodeError exception is raised when redirecting the
output of a tool (Windows only).
- Solution: execute the "set PYTHONIOENCODING=utf-8" command before running
a tool (in the same CMD session).

(c) Maxim Suhanov
You can’t perform that action at this time.