Registry Commands¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry <COMMAND> [OPTIONS]
Commands:
amcache Parse Amcache inventories
app-compat Parse application compatibility data
app-history Parse third-party tools' traces
auditpol Parse the audit policy
bam Parse BAM and DAM last runs
bcd Parse boot configuration
feature-usage Parse Explorer use counts and pins
help Print this message or the help of the given subcommand(s)
installed-programs Parse installed programs
lsa-secrets Parse LSA secrets' names and times
mru Parse most-recently-used lists
muicache Parse MuiCache program names
networks Parse network profiles, interfaces, shares, port proxies and routes
office Parse Office recent files, trusted documents and macro settings
open-save-mru Parse Open and Save As dialog history
persistence Parse autostart locations
read Read keys and values
recent-docs Parse recent documents
remote-access Parse outbound RDP, PuTTY, WinSCP and mapped drive connections
sam Parse local accounts
security-settings Parse security settings: Defender, UAC, credentials, RDP, firewall, logging
services Parse services
shell-bags Parse ShellBags (folders opened in Explorer)
shimcache Parse ShimCache entries
system-info Parse system information
taskcache Parse scheduled tasks
usb Parse USB devices and volumes
user-assist Parse UserAssist entries
Options:
-h, --help Print help
The canonical commands are app-compat, feature-usage, open-save-mru, recent-docs,
user-assist and shell-bags. Their former spellings (appcompat, featureusage,
opensavemru, recentdocs, userassist and shellbags) remain accepted as hidden aliases
for existing scripts. Automatic parsing uses the canonical names; its artifact identifiers,
result schemas and output filenames are unchanged.
Registry commands accept -f <HIVE> or -d <COLLECTION> and structured output options.
amcache replays adjacent Amcache transaction logs automatically when a hive is dirty, but has
no options to name logs or skip replay. shimcache replays adjacent SYSTEM logs by default and
also accepts an exported raw AppCompatCache value. The other registry commands replay adjacent
logs automatically; use --log1 / --log2 to name logs explicitly or --no-logs to inspect the
primary hive without replay.
parse-registry amcache¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry amcache <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for Amcache hives (Amcache.hve)
-f, --file <FILE> File path to one Amcache.hve
Records:
--files Include every inventoried executable (InventoryApplicationFile)
--devices Include every inventoried PnP device (InventoryDevicePnp)
-a, --all Include executables and devices (default for -o and for json, jsonl, csv)
Output:
-o, --output <PATH> Save the results to a file (text, json, jsonl) or a directory (csv)
-t, --output-type <TYPE> Output type: csv (default with -o), json, jsonl, text (default on the terminal)
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
juntei parse-registry amcache -f Amcache.hve --files
juntei parse-registry amcache -d evidence/ -o amcache-csv
juntei parse-registry amcache -f Amcache.hve -t jsonl | jq 'select(.RecordType == "file")'
See Amcache.
parse-registry bam¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry bam <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for SYSTEM hives
-f, --file <FILE> File path to one SYSTEM hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Filtering:
--all-control-sets Every control set (ControlSet001, ControlSet002, ...), not only the one Windows used last
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
Users are named from the system's SAM and SOFTWARE (ProfileList), found as the host is.
See BAM and DAM.
parse-registry installed-programs¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry installed-programs <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for SOFTWARE and NTUSER.DAT hives
-f, --file <FILE> File path to one SOFTWARE or NTUSER.DAT hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
Uninstall entries, Windows Installer products, App Paths, WSL distributions and packaged apps.
A user hive's user comes from its profile folder and the system's ProfileList. See
Installed Programs.
parse-registry muicache¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry muicache <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for UsrClass.dat and NTUSER.DAT hives
-f, --file <FILE> File path to one UsrClass.dat (Windows Vista and later) or NTUSER.DAT (Windows XP) hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
Users are named from the hive's place in the collection, and their SIDs from a UsrClass.dat's
root key or the system's SOFTWARE (ProfileList). See MuiCache.
parse-registry open-save-mru¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry open-save-mru <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for NTUSER.DAT hives
-f, --file <FILE> File path to one NTUSER.DAT hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
--code-page <CP> Code page of shell item names that aren't Unicode (8.3 names, network shares): the system's ANSI code page (932 for Japanese) [default: 1252]
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
Each shell item list is decoded with ys-lnk-parser and joined into a path. See Open and Save As Dialogs.
parse-registry remote-access¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry remote-access <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for NTUSER.DAT hives
-f, --file <FILE> File path to one NTUSER.DAT hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
Users' SIDs come from the system's SOFTWARE (ProfileList), found as the host is. Stored
passwords are reported as present, never decoded. See
Remote Access (User Side).
parse-registry system-info¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry system-info <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for SYSTEM, SOFTWARE, SAM and SECURITY hives (those in one directory are one system's)
-f, --file <FILE> File path to a SYSTEM, SOFTWARE, SAM or SECURITY hive of one system; repeat for each (the others are looked for next to them)
--no-logs Read dirty hives as they are, without their transaction logs (default: <hive>.LOG, .LOG1 and .LOG2 next to each are replayed)
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
One record per system: its names, domain or workgroup, Windows version and install date, time
zone, last shutdown, last user, profiles and SIDs. The hives in one directory are one system's;
with -f, the hives given and the others of the four found next to them.
See System Information.
parse-registry mru¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry mru <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for NTUSER.DAT hives
-f, --file <FILE> File path to one NTUSER.DAT hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Filtering:
--list <LISTS> Only these lists (comma separated): runmru, typedpaths, wordwheelquery, typedurls, paint, wordpad, acmru
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
parse-registry app-history¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry app-history <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for NTUSER.DAT hives
-f, --file <FILE> File path to one NTUSER.DAT hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
Sysinternals tools, WinRAR, 7-Zip and WinZip history, OneDrive accounts, Adobe recent files, TeamViewer and CCleaner. See Application History.
parse-registry feature-usage¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry feature-usage <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for NTUSER.DAT hives
-f, --file <FILE> File path to one NTUSER.DAT hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
Reads FeatureUsage, RecentApps, Taskband and ProgramsCache. See
FeatureUsage, RecentApps and Taskbar Pins.
parse-registry security-settings¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry security-settings <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for SOFTWARE, SYSTEM and NTUSER.DAT hives
-f, --file <FILE> File path to one SOFTWARE, SYSTEM or NTUSER.DAT hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Filtering:
--all-control-sets Every control set of a SYSTEM hive (ControlSet001, ControlSet002, ...), not only the one Windows used last
--weakened-only Only settings whose value weakens what Windows does by default
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
Each setting found is a record with its value, its meaning and whether it weakens what Windows
does by default; --weakened-only keeps those that do. See
Security Settings.
parse-registry office¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry office <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for NTUSER.DAT hives
-f, --file <FILE> File path to one NTUSER.DAT hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
See Microsoft Office.
Examples¶
juntei parse-registry services -f SYSTEM -o services.csv
juntei parse-registry services -f SYSTEM --service ExampleSvc -t jsonl
juntei parse-registry recent-docs -f NTUSER.DAT -o recentdocs.csv
juntei parse-registry office -d collection/ -o office.csv
juntei parse-registry taskcache -f SOFTWARE --task ScheduledDefrag -t jsonl
juntei parse-registry sam -f SAM --rid 500 -t jsonl
juntei parse-registry persistence -d collection/ -o persistence.csv
juntei parse-registry user-assist -d collection/ -o userassist.csv
The complete options and field semantics are on Registry Hives, Windows Services, RecentDocs, Microsoft Office, Task Scheduler Cache, SAM Local Accounts, Registry Autostarts, and UserAssist.
parse-registry auditpol¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry auditpol <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for SECURITY hives
-f, --file <FILE> File path to one SECURITY hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
One record per subcategory (Windows Vista and later) or category (XP and 2003) of the audit
policy in Policy\PolAdtEv: what it logs, its GUID and message ID, and its main events. See
Audit Policy.
parse-registry app-compat¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry app-compat <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for SOFTWARE and NTUSER.DAT hives
-f, --file <FILE> File path to one SOFTWARE or NTUSER.DAT hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
Compatibility layers, the Program Compatibility Assistant's Store and Persisted, CIT and custom
shim databases. The ShimCache is parse-registry shimcache's. See
Application Compatibility.
parse-registry bcd¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry bcd <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for BCD hives (and BCD-Template)
-f, --file <FILE> File path to one BCD hive (\Boot\BCD, \EFI\Microsoft\Boot\BCD)
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
One record per object of the store, with test signing, integrity checks, recovery, boot status policy and safe mode resolved through inheritance. See Boot Configuration Data (BCD).
parse-registry lsa-secrets¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry lsa-secrets <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for SECURITY hives
-f, --file <FILE> File path to one SECURITY hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
One record per LSA secret (Policy\Secrets\<name>) with its kind, the service or user it
names, when its values were set and whether they hold data, and one for the cached logons
(Cache). Names and times only: nothing is decrypted. See LSA Secrets.
parse-registry networks¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry networks <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for SOFTWARE and SYSTEM hives
-f, --file <FILE> File path to one SOFTWARE or SYSTEM hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Filtering:
--all-control-sets Every control set of a SYSTEM hive (ControlSet001, ControlSet002, ...), not only the one Windows used last
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
Profile times are converted to UTC with the time zone of the system's SYSTEM hive, found as the
host is, and kept as found too. See Networks.
parse-registry persistence¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry persistence <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for SOFTWARE, SYSTEM, NTUSER.DAT and UsrClass.dat hives
-f, --file <FILE> File path to one SOFTWARE, SYSTEM, NTUSER.DAT or UsrClass.dat hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Filtering:
--all-control-sets Every control set of a SYSTEM hive (ControlSet001, ControlSet002, ...), not only the one Windows used last
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
parse-registry read¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry read <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for registry hives (every file that is one, logs aside)
-f, --file <FILE> File path to one registry hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Filtering:
-k, --key <PATH> Only the key at this path (in any case; ex: Microsoft\Windows\CurrentVersion\Run). It may start with HKLM\ and the hive's name, and CurrentControlSet is the control set Windows used last
--key-regex <REGEX> Only keys whose path matches REGEX (ignoring case)
--value <NAME> Only the value named NAME (in any case; "" is the key's default value). With --key or --key-regex, a key without it gives an absent_value record
--value-regex <REGEX> Only values whose name matches REGEX (ignoring case; the default value's name is empty)
--data-regex <REGEX> Only values whose data, as written, matches REGEX (ignoring case, so a GUID matches in any case; binary data in hex)
--timeline-start <DATE> Only keys last written on or after DATE, in UTC unless an offset is given (ex: 2025-10-19, 2025-10-19T13:45:30Z)
--timeline-end <DATE> Only keys last written on or before DATE
--recover-deleted Also deleted keys and values: in free cells, the slack of cells in use and the data past the hive bins, and what only the transaction logs kept (allocation_status says how complete; recovered_from where found)
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
--raw-data Write every value's bytes in hex (value_data_raw), not only those that don't decode as their type
--qword-as-filetime Also write REG_QWORD values as FILETIMEs (value_filetime_utc), keeping the number (value_data, value_u64)
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
juntei parse-registry read -f SYSTEM --key 'CurrentControlSet\Services' -o services-raw.csv
juntei parse-registry read -f NTUSER.DAT --recover-deleted -t jsonl | jq .
parse-registry recent-docs¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry recent-docs <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for NTUSER.DAT hives
-f, --file <FILE> File path to one NTUSER.DAT hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
parse-registry sam¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry sam <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for SAM hives
-f, --file <FILE> File path to one SAM hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Filtering:
--rid <RID> Only the account with this RID (ex: 500, the built-in Administrator)
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
parse-registry services¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry services <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for SYSTEM hives
-f, --file <FILE> File path to one SYSTEM hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Filtering:
--service <NAME> Only the service of this name (its key's name, in any case)
--all-control-sets Every control set (ControlSet001, ControlSet002, ...), not only the one Windows used last
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
parse-registry shell-bags¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry shell-bags <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for UsrClass.dat and NTUSER.DAT hives
-f, --file <FILE> File path to one UsrClass.dat or NTUSER.DAT hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Parsing:
--code-page <NUMBER> Windows code page for the ANSI names of shell items (8.3 names, network shares) [default: 1252]
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
parse-registry shimcache¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry shimcache <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for SYSTEM hives
-f, --file <FILE> File path to one SYSTEM hive, or an AppCompatCache value saved to a file
--no-logs Read a dirty hive as it is, without its transaction logs (SYSTEM.LOG1, SYSTEM.LOG2)
Output:
-o, --output <FILE> Save every entry to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. Without -o, the entries are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
juntei parse-registry shimcache -f SYSTEM
juntei parse-registry shimcache -d evidence/ -o shimcache.csv
See ShimCache.
parse-registry taskcache¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry taskcache <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for SOFTWARE hives
-f, --file <FILE> File path to one SOFTWARE hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Filtering:
--task <NAME> Only the task of this name, in any case: its whole name (\Microsoft\Windows\Defrag\ScheduledDefrag) or its last part (ScheduledDefrag)
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
parse-registry usb¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry usb <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for SYSTEM hives (each system's SOFTWARE and users' NTUSER.DAT hives are read with it)
-f, --file <FILE> File path to one SYSTEM hive (its system's SOFTWARE and users' NTUSER.DAT hives are read with it)
--log1 <FILE> The SYSTEM hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The SYSTEM hive's second transaction log (.LOG2), for -f
--no-logs Read dirty hives as they are, without their transaction logs
Filtering:
--all-control-sets Every control set (ControlSet001, ControlSet002, ...), not only the one Windows used last
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
parse-registry user-assist¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry user-assist <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for NTUSER.DAT hives
-f, --file <FILE> File path to one NTUSER.DAT hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
Examples¶
juntei parse-registry services -f SYSTEM -o services.csv
juntei parse-registry services -f SYSTEM --service ExampleSvc -t jsonl
juntei parse-registry recent-docs -f NTUSER.DAT -o recentdocs.csv
juntei parse-registry taskcache -f SOFTWARE --task ScheduledDefrag -t jsonl
juntei parse-registry sam -f SAM --rid 500 -t jsonl
juntei parse-registry persistence -d collection/ -o persistence.csv
juntei parse-registry usb -d collection/ -o usb.csv
juntei parse-registry user-assist -d collection/ -o userassist.csv
juntei parse-registry open-save-mru -d collection/ -o opensavemru.csv
juntei parse-registry bam -d collection/ --all-control-sets -o bam.csv
juntei parse-registry installed-programs -d collection/ -o installed.csv
juntei parse-registry muicache -d collection/ -o muicache.csv
juntei parse-registry shell-bags -d collection/ -o shellbags.csv
The complete options and field semantics are on Registry Hives, Windows Services, RecentDocs, Task Scheduler Cache, SAM Local Accounts, Registry Autostarts, UserAssist, BAM and DAM, Installed Programs, MuiCache, ShellBags, and USB Devices.
See also Open and Save As Dialogs.
See also remote-access.
See also system-info.
See also mru.
See also app-history.
See also featureusage.
See also security-settings.
See also office.
See also auditpol.
See also appcompat.
See also bcd.
See also lsa-secrets.
See also networks.