---
name: "reglookup-recover"
section: "1"
platform: "linux"
package: "reglookup"
version: "1.0.1+svn296-1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/reglookup-recover"
---

# reglookup-recover(1)

Windows NT+ registry deleted data recovery tool

## NAME

reglookup-recover - Windows NT+ registry deleted data recovery tool

## SYNOPSIS

**reglookup-recover \[options\]** *registry-file*

## DESCRIPTION

reglookup-recover attempts to scour a Windows registry hive for  deleted data structures and outputs those found in a CSV-like format.

## OPTIONS

**reglookup-recover** accepts the following parameters:

- FC**-v**F\[0\]

  Verbose output.

- FC**-h**F\[0\]

  Enables the printing of a column header row. (default)

- FC**-H**F\[0\]

  Disables the printing of a column header row.

- FC**-l**F\[0\]

  Display cells which could not be interpreted as valid registry structures at the end of the output.

- FC**-L**F\[0\]

  Do not display cells which could not be interpreted as valid registry structures. This is the default behavior.

- FC**-r**F\[0\]

  Display raw cell contents for cells which were interpreted as intact data structures. This additional output will appear on the same line as the interpreted data.

- FC**-R**F\[0\]

  Do not display raw cell contents for cells which were interpreted as intact data structures. This is the default behavior.

- *registry-file*

  Required argument. Specifies the location of the registry file to read. The system registry files should be found under: **%SystemRoot%/system32/config**.

## OUTPUT

**reglookup-recover** generates a comma-separated values (CSV)  like output and writes it to stdout. For more information on the syntax of  the general format, see **[reglookup(1)](/reglookup/1.md)**.

This tool is new and the output format, particularly the included columns,  may change in future revisions. When this format stablizes, additional documentation will be included here.

## EXAMPLES

To dump the recoverable contents of a system registry hive:

```
FC
	reglookup-recover /mnt/win/c/WINDOWS/system32/config/system
      F[0]
```

Extract all available unallocated data, including unparsable unallocated space and the raw data associated with parsed cells in a user-specific registry:

```
FC
	reglookup-recover -r -l '/mnt/win/c/Documents and Settings/user/NTUSER.DAT'
      F[0]
```

## BUGS

This program has been smoke-tested against most current Windows target  platforms, but a comprehensive test suite has not yet been developed. (Please report results to the development mailing list if you encounter any bugs. Sample registry files and/or patches are greatly appreciated.)

This program is new as of RegLookup release 0.9.0 and should be considered  unstable.

For more information on registry format details and the recovery  algorithm, see:

http://sentinelchicken.com/research/registry\_format/ http://sentinelchicken.com/research/registry\_recovery/

## CREDITS

This program was written by Timothy D. Morgan.

## LICENSE

Please see the file "LICENSE" included with this software distribution.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License version 3 for more details.

## SEE ALSO

[reglookup-timeline(1)](/reglookup-timeline/1.md) [reglookup-recover(1)](/reglookup-recover/1.md)