DFIR-NT-HIVE

This project is part of the DFIR-OGRE suite and provides an interface for accessing keys, values, and data stored in hive files. Hive files can be found in C:\Windows\system32\config and store what is commonly called the Windows registry. This crate supports the hive format that is used from Windows NT 4.0 up to the current Windows 11.

It is a fork of the nt-hive project to add some forensic capabilities.

⚠️ Beta Status

This software is currently in beta. While functional and actively developed, it may still undergo breaking changes, and some artefact parsers may not yet be fully stabilized. We welcome feedback, bug reports, and contributions using the issue tracker.

Features

• (dfir-nt-hive) give access to the timestamp and security descriptors of the nodes.
• (dfir-nt-hive) relax the way data is read to allow retrieval of nodes that don't follow the specifications correctly
• Functions to find a specific subkey, subkey path, or value as efficient as possible (taking advantage of binary search for keys).
• Zero-copy data representations wherever possible.
• Static borrow checking everywhere. No mutexes or runtime borrowing.
• No usage of unsafe anywhere. Checked arithmetic where needed.
• Error propagation through a custom NtHiveError type that implements Display. As a bootloader may hit corrupted hive files at some point, nt-hive outputs precise errors everywhere that refer to the faulty data byte.
• Platform and endian independence.

French Cybersecurity Agency (ANSSI)

This projet is managed by ANSSI. To find out more, you can visit the page (in French) dedicated to ANSSI’s open-source strategy. You can also click on the badges above to learn more about their meaning.