Comments for Matt Churchill

Comment on Turning RegRipper into WindowsRipper by Sabrina Carliss

Sabrina Carliss — Mon, 15 Aug 2011 16:34:04 +0000

Hey Matt,
Really liked the post on Turning WebRipper into WindowsRipper. Would it be OK with you if I used a portion of it and cited back? My writing team should be completing a new blog post on a similar topic in the near future.

Thanks much.

–
Sabrina K. Carliss
The secret to creativity is knowing how to hide your sources

Comment on Turning RegRipper into WindowsRipper by Alfonso

Alfonso — Sun, 24 Jul 2011 09:22:32 +0000

Great job!
Is there a place where I can download the WindowsRipper shown in the video?

Comment on Run RegRipper Against a Mounted Drive by Verlin Cross

Verlin Cross — Fri, 30 Jul 2010 19:35:32 +0000

I tried the regripperpoc.zip file, following the directions in the video. when I click on the run fro mounted drive, I do not get a pop up to select the mounted drive. Any idea where I went wrong?

Comment on Turning RegRipper into WindowsRipper by João Carvalho

João Carvalho — Tue, 15 Jun 2010 16:58:43 +0000

This is fantastic job!! I would love to see a plug-in to quickly parse IM!
thanks for the great work!

Comment on Turning RegRipper into WindowsRipper by Debbie

Debbie — Mon, 14 Jun 2010 14:36:35 +0000

Excellent work! I can’t wait to try this, there is always a need to triage on scene as there are such limited resources “back at the lab”.

Comment on Turning RegRipper into WindowsRipper by Matt C

Matt C — Thu, 10 Jun 2010 16:15:40 +0000

Thanks for the comments, Camelot. We already have a working plugin for Prefetch and are still getting everything ready for a release.

Comment on Turning RegRipper into WindowsRipper by Camelot

Camelot — Thu, 10 Jun 2010 03:06:38 +0000

This is great stuff!! I would love to see a plug-in to quickly parse the windows prefetch directory.

Comment on Turning RegRipper into WindowsRipper by Matt C

Matt C — Sun, 06 Jun 2010 17:43:59 +0000

Hey Rob, thanks for the comments. We’ll take a look and see what P2P parsing items we can come with up. I’ll go search my IACIS archives and see if there is anything pre-made out there we can use.

Comment on Turning RegRipper into WindowsRipper by Robert

Robert — Sat, 05 Jun 2010 12:29:57 +0000

Great stuff… this works well (or will work well) with a WinFE boot disk for Triage.. I love the fact that your goals seem to be targeting what an Investigator will need on scene.

What I would love is a Script that wiill dig through the file system, find any *.Props files (for P2P investigations), maybe display the GUID in those files, and maybe collect a list of all the MPG/AVI files on the system..all in one quick script.
Great for On-Scene interviews with the subject..

Just a thought..

Thanks for your work!
Rob

Comment on Turning RegRipper into WindowsRipper by Pasquale

Pasquale — Fri, 04 Jun 2010 13:18:07 +0000

Congrats, it’s a really great job!!!
I’m also willing to give my small contribution with the code if it’s needed