Presentation
DTLreg scans accessible Registry areas, assesses the importance and probable use of their values, and gathers the results in an interactive report. It never modifies the Registry.
The tool first counts keys without reading their values. This allows it to announce a likely duration before analysis and recalculate the estimate during processing. A separate progress display is shown for each hive and view.
Main features
- preliminary key count and duration estimate;
- five aligned progress displays for
HKLM,HKCU,HKCR,HKU, andHKCC; - importance and probable-use analysis for Registry values;
- warnings for sensitive areas and details about denied access;
- automatic redaction of potentially confidential data;
- bilingual console interface with contextual
?help; - a single HTML report, with no TXT or JSON export.
Analysis flow
- check privileges and offer administrator elevation;
- count accessible keys without processing their values;
- display the total and likely duration;
- read and analyze data with progress per hive and view;
- build the HTML report progressively;
- offer to open the report immediately.
Elevation makes more keys readable but cannot guarantee complete access. Some locations remain reserved for Windows, SYSTEM, or TrustedInstaller, or are protected by their own permissions. These denials are expected and counted.
Interactive HTML report
The report includes reading statistics, denied-access counts, breakdowns by category and importance, keys, values, types, probable uses, warnings, and reading errors. Text search and an importance filter make exploration easier.
The output is fully standalone: styles, scripts, and resources are embedded. Its language follows the browser automatically, and no Internet connection is required.
Quick start
.\dist\DTLreg.exe python .\DTLreg.py
From the menu, press Enter to start, type 1 to switch to English, ? for help, or Q to quit. In the English interface, type 2 to return to French.
Useful options
python .\DTLreg.py --hives HKCU --max-depth 6 python .\DTLreg.py --views 32 64 python .\DTLreg.py --output C:\Reports\DTLreg python .\DTLreg.py --non-interactif --lang en
Other options can limit retained value length or select hives and views. Redaction can be disabled with --no-redact, which is not recommended before sharing a report.
Privacy
DTLreg runs locally and hides values by default when their name or path appears to contain a password, secret, token, credential, or private key.
- no Registry data is uploaded;
- the report remains readable offline;
- redaction reduces disclosure risk;
- the report should still be reviewed before sharing.