reglookup
Utility to analysis for Windows NT-based registry
digital-forensicsBlue Team
Tooldigital-forensicsblueLinuxKali LinuxPlatforms: Linux · Last verified September 6, 2026
RegLookup is a system to direct analysis of Windows NT-based registry files providing command line tools, a C API, and a Python module for accessing registry data structures. The project has a focus on providing tools for digital forensics investigations (though is useful for many purposes), and includes algorithms for retrieving deleted data structures from registry hives.
Only use this tool against systems you own or are explicitly authorized to test — see the disclaimer.
Getting started
See the official Kali tool page and upstream homepage linked above for installation and usage details.
