This project is the live registry hive acquisition component of Registry Decoder. It is capable of acquiring both the currently running and historical registry files from a number of Windows operating system versions, both 32 and 64 bit.

The acquired files can then be imported into the offline analysis component for complete forensic investigation.

Please see our FAQ for further information about the project, including supported systems.

The latest version of Registry Decoder can be found in the downloads section as well as complete instructions.

Please join our mailing list for discussion about the project and announcements about updates and new features.

Registry Decoder was developed and is maintained by developers from Digital Forensics Solutions. Please see our history page for more information about the project. For updates about the project, please regularly check our blog.