Wombat Registry

Stand Alone Version of the Registry Viewer found in Wombat Forensics

I needed a free linux based registry viewer and report generator, so I decoupled the registry viewer from wombat forensics. The registry parsing is thanks to the libregf library from Joachim Metz. On top of using his library to parse the registry artifacts, I added the ability to tag individual values for inclusion in a report. I also auto parse a few common registry keys/values and am happy to autoparse more upon request.

This tool is closer to yaru for it's display and I like the fine grained reporting better than other registry tools. You can preview the report as you build it, so you don't have to keep publishing or exporting to see what it looks like. There is tag management if you like to create your tags ahead of time rather than name them as you add them. Tagging and Reporting are now independent programs and work for all gui wombat forensic tools. Plus it runs on linux and is open source and free.

It is a pretty simple and straightforward tool. The libregf library and fox toolkit library are statically compiled into the program, so it should run if you download the binary for wombatregistry, as well as the wombattagmanager binary and the wombatreporter binary. If you want to compile from source, you will have to download libregf and the fox-toolkit library and compile those prior to compiling wombat registry. You can also download the wombat tag manager and wombat reporter and compile those if you don't want to use the latest binaries included with wombat registry. To compile, simply run "make wombatregistry" and that should create the executable, then you just have to copy it to your /usr/local/bin/ folder.

Screenshot of the main window