100% client-side · files never uploaded

Registry Parser

Drop hives below. Everything is parsed locally in your browser — no upload, no server.

Synthetic demo hives (NTUSER.DAT, SYSTEM, SOFTWARE) of a fictional intrusion — no real data. Tip: the “Last hour” time-range preset isolates the intrusion window, or click any timestamp to focus around it.

How to get your data

Collect the hives
Drop the files here
Parsed in your browser, nothing uploaded

Live Windows host. Open Command Prompt as administrator (in a PowerShell or Terminal window, type cmd first). Writes to C:\triage\.

1 · SYSTEM, SOFTWARE, SAM, SECURITY + Amcache.hve

mkdir C:\triage 2>nul & reg save HKLM\SYSTEM C:\triage\SYSTEM /y & reg save HKLM\SOFTWARE C:\triage\SOFTWARE /y & reg save HKLM\SAM C:\triage\SAM /y & reg save HKLM\SECURITY C:\triage\SECURITY /y & esentutl.exe /y /vss C:\Windows\AppCompat\Programs\Amcache.hve /d C:\triage\Amcache.hve

2 · NTUSER.DAT + UsrClass.dat of every profile

for /d %U in (C:\Users\*) do (mkdir "C:\triage\%~nxU" 2>nul & esentutl.exe /y /vss "%U\NTUSER.DAT" /d "C:\triage\%~nxU\NTUSER.DAT" & esentutl.exe /y /vss "%U\AppData\Local\Microsoft\Windows\UsrClass.dat" /d "C:\triage\%~nxU\UsrClass.dat" & attrib -h -s "C:\triage\%~nxU\*.dat")

reg save writes clean, flushed copies of the loaded machine hives; esentutl /vss copies the locked files from a shadow snapshot. User hives land in C:\triage\<user>\. Then drop the machine hives plus the NTUSER.DAT / UsrClass.dat of the user you are investigating. Delete C:\triage before running it again.

Gotchas

Hives are locked while Windows runs: Explorer or copy fails with "file in use". Use reg save, esentutl /vss or a raw-copy tool, all as administrator.
Copies taken from disk (esentutl, KAPE, images) can be dirty: the latest changes may still sit in .LOG1 / .LOG2, which are not replayed here. reg save output is always clean.
Keep the original file names: the hive type is recognized from the name, so a file renamed SAM.hiv or sam_copy loses its SAM analysis.

No hive loaded yet.

What Registry Parser does

Forensic Windows Registry analysis in your browser

Registry Parser is a free, browser-based forensic tool for analyzing Windows Registry hives. Drop an NTUSER.DAT, SOFTWARE, SYSTEM, SAM, SECURITY, USRCLASS.DAT or Amcache.hve file and it parses the hive entirely on your own machine — nothing is uploaded to a server.

It runs more than 140 RegRipper-style plugins over the loaded hives, extracting execution, persistence, USB, network, account and user-activity artifacts, then merges every timestamped result into a single forensic timeline. Because the parser is compiled to WebAssembly and runs client-side, it works offline on Windows, macOS and Linux without installing anything.

How it works

From raw hive to triaged report in three steps — entirely in your browser.

1
Drop your hives
Drag NTUSER.DAT, SOFTWARE, SYSTEM, SAM, SECURITY, USRCLASS.DAT or Amcache.hve onto the page — or click to browse. Each hive is parsed locally with WebAssembly; nothing is uploaded.
2
Automatic analysis
140+ RegRipper-style plugins run in parallel Web Workers, extracting execution, persistence, USB, network and account artifacts and correlating them across every loaded hive.
3
Triage & export
Read the correlated overview, drill into artifacts, findings and a unified timeline, then export a JSON, CSV, Markdown, HTML or PDF forensic report.

Drag-and-drop hive parsing

NTUSER.DAT, SOFTWARE, SYSTEM, SAM, SECURITY, USRCLASS.DAT and Amcache.hve, parsed locally with hivex compiled to WebAssembly.

140+ RegRipper-style artifact plugins covering program execution, persistence and autoruns, USB devices, networks, local accounts and user activity.

A searchable key tree and full-text search across key names, value names and value data.

A unified timeline that merges every timestamped artifact into one chronological view, exportable to TLN and bodyfile/mactime.

Automated triage findings that flag high-risk configurations from the parsed artifacts.

One-click export to JSON, CSV, a Markdown or HTML forensic report, or PDF.

Supported registry hives

NTUSER.DAT

per-user activity: UserAssist, RecentDocs, TypedPaths, Run keys, MountPoints2 and more.

SOFTWARE

installed programs, network profiles, scheduled tasks, Winlogon and machine-wide persistence.

SYSTEM

services, AppCompatCache (ShimCache), BAM/DAM, USBSTOR, time zone and control-set selection.

SAM

local user accounts, RIDs, login counts and group membership.

SECURITY

LSA secrets, cached credentials and audit policy.

USRCLASS.DAT

ShellBags and MUICache on modern Windows.

Amcache.hve

file inventory with SHA-1 hashes and first-seen timestamps.

FAQ

Frequently asked questions

Is Registry Parser free, and are my files uploaded anywhere?

Yes, it is free, and no files are ever uploaded. Every hive is parsed entirely in your browser using WebAssembly, so the files never leave your machine. That makes it safe to use on evidence and sensitive data.

Which Windows Registry hives can I analyze?

NTUSER.DAT, USRCLASS.DAT, SOFTWARE, SYSTEM, SAM, SECURITY and Amcache.hve. You can load several at once — for example a user's NTUSER.DAT alongside SYSTEM and SOFTWARE — and artifacts are correlated across them.

Is this a browser-based RegRipper alternative?

Effectively, yes. Registry Parser runs more than 140 plugins modelled on RegRipper's, extracting the same artifacts, but it runs in any modern browser with no Perl, no installation and no command line. It is a fast way to triage a hive when you cannot install tooling.

How do I open an NTUSER.DAT file?

Drag the NTUSER.DAT file onto the drop zone above, or click to browse. The hive is parsed locally and you can immediately explore its key tree, run every artifact plugin and build a timeline.

Does it work offline and on macOS or Linux?

Yes. The parser is compiled to WebAssembly and runs entirely client-side, so it is operating-system independent and keeps working with no network connection once the page has loaded.

What forensic artifacts does it extract?

Program execution (UserAssist, AppCompatCache/ShimCache, Amcache, BAM/DAM), persistence and autoruns (Run keys, services, scheduled tasks, Winlogon), USB device history, network connection history, local accounts, and user activity such as RecentDocs and ShellBags.

Artifacts that answer the next question in the same case.

Read deep-dives on individual artifacts and RegRipper plugins on the Registry Parser blog.