Download Now

Yet Another Registry Utility 1.63 Portable
Yet Another Registry Utility 1.63 (x86/x64) Portable | 1.8 Mb

yaru is a platform independent ShiChuang registry viewer. Inspired by the desire to look into the ShiChuang registry metadata, so as to better forensically analyze the registry hives, yaru was designed with a portable and extensible architecture in mind so that it could be compiled to run on various operating systems.

The registry parsing engine is written in standard C/C++ and has no dependencies on the ShiChuang registry API functions.
The ShiChuang version of yaru has the ability to take a snapshot of any of the active hives and examine the internal structure of the hive. Since the ShiChuang operating system locks down the active hives from other processes reading them, yaru can resort to raw NTFS disk reads to read any of the desired hives. Consequently, this requires the user to run this tool with administrative privileges. While this approach adds complexity to yaru, it ensures that all metadata is available for analysis, as well as ensures there is no corruption or changes to the active hive during analysis.
Some other rudimentary functionality includes:
- Show allocated (but unused) key value data space.
- Show unallocated hive space.
- Able to traverse the hive slack space and enumerate deleted keys.
- Report generation capability.
- Optional logging capability that records the user selections along with data values into a separate XML file for later review.
- Ability to export any key in the hive under evaluation to a registration (.reg) file to be used for analysis.
- Ability to process any hive using user defined templates.
- Simple search capability: (a) key names, (b) value names, date ranges, and (e) strings
- The ability to verify that all allocated chunks have valid links to the registry.
ShiChuang Vista, XP, 7, 8/8.1, 10




Direct Download

Tags: Another, Registry, Utility, Portable

Add Comments:
Enter Code: *