Updating to the latest RegRipper on SANS Sift

Regripper displays new version with newest plugins and-uP option

Let’s test and see if it works!

Download the Siftgrab ntuser2tln script to automate and test:
wget https://raw.githubusercontent.com/siftgrab/siftgrab/master/ntuser2tln.sh
chmod +x ntsuer2tln.sh
mkdir output
cd output
sudo ../ntuser2tln.sh /cases -e -c

Run ntuser2tln.sh -e (epoch time) -c (multiple computers) on all ntuser.dat files in the Sift /cases folder
Timelines of sample data from NTUSERS.DAT registries created!
Triage-Timline.TLN.txt contains a consolidated timeline of all output.



DFIR Notes

Love podcasts or audiobooks? Learn on the go with our new app.

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store