Description
HBIN Recon identifies and parses Windows Registry hive bins (hbins) from any input. Hive bins are essentially the building blocks of Registry hives. Examples of HBIN Recon input include healthy Registry hives, fragmented hives, hive transaction logs, Transactional Registry (TxR) files, compressed hive bins which can be found in swap files and elsewhere, hibernation slack (first processed by Hibernation Recon), and unallocated space. HBIN Recon is a surgical tool which is extremely useful in both testing and verification related to Registry data, as well as uncovering valuable data not accessible using other methods.
