EncryptedRegView helps you decrypt decipher encrypted registry data

The Registry Editor inwards Windows stores encrypted information to continue the information security as well as secure. It is useful when yous desire to safeguard sensitive information similar user concern human relationship password, database credentials, etc. into the registry. However, sometimes yous powerfulness desire to peek into the information stored inwards these encrypted registry keys. EncryptedRegView is a complimentary tool which tin decrypt the cloak-and-dagger registry information that has been stored inwards encrypted form.

Decrypt registry information alongside EncryptedRegView

You tin purpose EncryptedRegView to divulge the crypt information stored inwards Registry editor or feed whatever registry file (.reg extension) saved locally. The programme postulate non last installed every bit yous tin merely download as well as run the executable file to launch the tool. Available every bit both 32-bit and 64-bit version, the utility industrial plant smoothen across all versions of Windows.

Upon execution, it searches for the information stored anywhere inwards the Registry Editor which is encrypted using DPAPI (Data Protection API), a cryptographic API developed past times Microsoft as well as is available inwards Windows OS for the ages. Let’s lead maintain a expect at how the tool works.

Once yous opened upwards the utility, yous are greeted alongside the Advanced Options window where yous tin select to scan the arrangement registry editor or scan registry of an external drive. You tin also select to run the application every bit an administrator inwards monastic tell to decrypt the arrangement protected information that yous can’t decipher using normal privileges.

Once all the settings are set, as well as yous click OK to come inwards main EncryptedRegView window, it starts scanning the registry editor for information encrypted alongside DPAPI algorithm. If it successfully decrypts the data, yous tin stance the hidden information (in Hex-Dump format) inwards the lower pane past times selecting the respective registry entry from the upper pane.

For decrypting the registry information stored on an external difficult drive, you’d postulate to re-adjust the settings inwards Advanced Options window which yous tin access past times clicking F9 on your keyboard.

Select Scan the registry of external drive from the top drop-down carte du jour as well as induce amount inwards the details for rootage folder, user registry file, registry hives folder, etc. You tin also select to automatically induce amount the details past times clicking Automatic Fill button. Take authorities notation that all the relevant information volition last filled every bit good thus if yous desire to alter something, tell a registry value for another user as well as then you’d lead maintain to manually come inwards the path.

EncryptedRegView has several columns inwards the top pane, as well as the corresponding fields are auto-filled every bit it scans through the registry. Let’s lead maintain a brief expect at what each column means:

• Registry Key Path: The amount path of the Registry key.
• Value Name: The cite of the Registry value where the DPAPI encrypted information was found.
• Decryption Result: Result of the decryption – Succeeded or Failed.
• Decrypted Value: If the decrypted information contains a uncomplicated string as well as then it’s displayed inwards this column. The entire decrypted information is displayed inwards the lower pane.
• Encrypted Data Length: Total length of the encrypted data.
• Decrypted Data Length: Total length of the decrypted data.
• Hash Algorithm: Hash algorithm used inwards the DPAPI encrypted data. In Windows seven as well as afterwards it’s commonly SHA512.
• Encryption Algorithm: Encryption algorithm used inwards the DPAPI encrypted data. In Windows seven as well as afterwards it’s commonly AES256.
• Name: The cite of the DPAPI encrypted information block.
• Key File: Name of the primal file that was used to encrypt the data. The primal file is located inwards a ‘Protect’ folder (e.g., C:\ Users\ admin\ AppData\ Roaming\ Microsoft\ Protect )

Using EncryptedRegView yous may discovery passwords as well as other cloak-and-dagger information stored inwards the Registry past times Microsoft products every bit good every bit past times 3-party products. If yous lead maintain a purpose for this tool, yous tin download it from Nirsoft.

Source: https://www.thewindowsclub.com/

Share This :