RandyRandleman / RECmd

Command line access to the Registry

RECmd

Get the latest binary at https://ericzimmerman.github.io/#!index.md

Command line Registry access, including batch mode!

See the manual for more examples.

If you get an error message like "error loading plugin" when running RECmd after downloading the ZIP archive and extracting it using Windows' ZIP tool, use the following command to unblock the DLLs using PowerShell

PS> Unblock-File .\Plugins\*.dll

Batch Files

RECmd uses Batch Files to make your Registry output more actionable. Learn about Batch Files here!

Open Source Development funding and support provided by the following contributors: SANS Institute and SANS DFIR.