RawHive. Cobalt Strike BOF that extracts selected Windows registry hives directly from a raw NTFS volume by parsing NTFS metadata and reading file data straight from disk.

github.com/nmht3t/RawHive

Vaya's read on this project

Problem, audience, market, and the verdict — sign in to see it.

Updates

No recent activity.