EncryptedRegView

EncryptedRegView makes it possible for you to analyze either the computer's registry or the registry of an external drive, and find the keys that are encrypted using the Data Protection API (or, in short, DPAPI). It is not a standard registry explorer, but a tool that can help you dig deeper into the registry and search for entries that are not normally displayed.

Upon launch, you must go through the advanced options to select the target to scan (local or external). Choosing an external drive requires you to fill in the location of the root folder, the registry hives, the user and the classes registry files. Automatic filling is also possible for a given root directory. To decrypt system protected data, administrator rights are mandatory.

Once you hit the 'OK' button, EncryptedRegView starts scanning the registry, displaying the data it finds key by key in a structured manner. Aside from the path of each registry key, EncryptedRegView discloses both its encrypted and decrypted values. Also, it displays the decryption status, the length of the encrypted and decrypted data, the hash and the encryption algorithm that was used. Clicking on any key reveals the hex-coded form of the key.

EncryptedRegView features satisfactory reporting tools, which enable you to save selected chunks of data in various formats, namely TXT, CSV, HTML, or XML. HTML reporting is also available in the right-click menu.

The advanced selection tools can assist you in choosing the data you want to export. As such, you can select the rows you want to include in the report (and there are options to choose even or odd rows with a click, so you don't have to do this manually), and eliminate the columns you don't want the report to contain.

EncryptedRegView can disclose encrypted data that can contain passwords for both Microsoft or third party products. It scans the system without modifying the registry, placing all the information within an organized table, for your convenience.