nt_hive2
Warning The tools of this repository have been moved to https://github.com/dfir-dd/dfir-toolkit
You can install the tools by running
cargo install dfir-toolkit
The lib itself will stay available here
This crates aims to be a replacement of https://github.com/ColinFinck/nt-hive, with the following differences:
- use of BinRead to parse hive files
- support of displaying last written timestamps
- recovery of deleted cells
Usage example for developers
use File;
use *;
#
let hive_file = open?;
let mut hive = new?;
let root_key = hive.root_key_node?;
for sk in root_key.subkeys?.iter
License: GPL-3.0