RECmd registry

RECmd.exe -d <registry-hive>

Analyze Windows registry hives with RECmd, extracting persistence, execution, and configuration keys into CSV.

Run it when you need the registry in a processable format: RECmd processes the hives (SYSTEM, SOFTWARE, NTUSER.DAT, etc.) and dumps them to CSV with all keys and values — or with the batch files that extract the hives of forensic interest: Run keys, services, UserAssist, MountedDevices. It's the reference registry analysis tool (from the Zimmerman suite): attacker persistence (Run keys, services, Winlogon) and activity (UserAssist, ShimCache) live in the registry, and RECmd pulls them out with their exact values.

Don't use it as a complete analysis: the registry is huge and the CSV of a full hive is unmanageable — RECmd's batch files (or filters) extract only the relevant keys; without them, you drown in data. In-use hives are copied beforehand (with KAPE or manual file copy) — analyzing live hives gives inconsistent results. And note: RECmd reads the registry as-is; registry manipulation (key deletion) is done by the attacker, and the absence of an expected key is also a finding. For specific persistence keys, dedicated batch files (Autoruns, Services) are more direct than the full dump.