More Windows FE and triage notes (WindowsRipper?)
Matt Churchhill (http://mattchurchill.net/2010/06/windowsripper/) has been doing some work to supercharge RegRipper. Take a look at his video and while watching, consider how this can affect your method to triage a computer when booted to WinFE…
[youtube=http://www.youtube.com/watch?v=r4nBUXYGkBw&hl=en_US&fs=1&border=1]
Discover more from Brett's Ramblings
Subscribe to get the latest posts sent to your email.
Show CommentsAm I correct that once you assign a drive letter to the Volume you are going to be touching the Drive in WinFE?
If you set a volume to read only, the disk is written to (offset 0x417). If a disk is set to read only, it is not written to. So as long as you don’t set the volume to read only…
Thanks for the link, Brett. I hadn’t thought of putting this on WinFE before, but it’s a great idea.
As fast as RegRipper is, and that it now can be pointed to a mounted drive, plus your addition of adding multiple CLI apps to be called within RegRipper, I can only imagine how quickly a triage can be done on a computer onsite. A bare-bone WinFE disk with only FTK Imager Lite (free) and RegRipper (free) set up as you have worked on means that you can have a lightweight, easy to use, triage (and subsequent imaging tool) at the cost of…a CD Rom…
Not being Fluent in RegRipper… To be “precise” with it..do you need specific plug-in’s? If I just want to see the Recent File List from Windows Media Player (For example…) a plug in would have to target that key to get the output I need… Is it, as it sits “off the shelf” going to report on the entire registry..?
You can choose the plugins to run, or even write your own plugins if what you are looking for isn’t part of the RegRipper package. You can check out the regripper.net site and forum for better answers from the developer too (Harlan Carvey).
NO LINK WORKS FROM YOUR PAGE
To be fair…this particular blog post is almost 10 years old…