Get-ForensicRegistryValue

NAME Get-ForensicRegistryValue



SYNOPSIS

Gets the values of the specified registry key.





SYNTAX

Get-ForensicRegistryValue -HivePath <String> [-Key <String>] [-Value <String>] [<CommonParameters>]





DESCRIPTION

The Get-ForensicRegistryValue cmdlet parses a registry hive and returns the values of a specified key.



Except as noted, the cmdlets in the PowerForensics module require the permissions of a member of the

Administrators group on the computer. To run them, start Windows PowerShell with the 'Run as administrator' option.





PARAMETERS

-HivePath <String>

The registry hive to parse.



Required? true

Position? named

Default value

Accept pipeline input? false

Accept wildcard characters? false



-Key [<String>]

The key to list values from.



Required? false

Position? named

Default value

Accept pipeline input? false

Accept wildcard characters? false



-Value [<String>]

The specific value to return.



Required? false

Position? named

Default value

Accept pipeline input? false

Accept wildcard characters? false



<CommonParameters>

This cmdlet supports the common parameters: Verbose, Debug,

ErrorAction, ErrorVariable, WarningAction, WarningVariable,

OutBuffer, PipelineVariable, and OutVariable. For more information, see

about_CommonParameters (https:/go.microsoft.com/fwlink/?LinkID=113216).



INPUTS

None







OUTPUTS

PowerForensics.Registry.ValueKey













-------------------------- EXAMPLE 1 --------------------------



[ADMIN]: PS C:\\>Get-ForensicRegistryValue -HivePath C:\\Windows\\system32\\config\\SOFTWARE -Key

Microsoft\\Windows\\CurrentVersion\\Run



This command gets the values of the Run key.

-------------------------- EXAMPLE 2 --------------------------



[ADMIN]: PS C:\\>Get-RegistryValue -HivePath C:\\Windows\\system32\\config\\SYSTEM -Key ControlSet001\\Serivces\\Enum

-Value NextParentID.72bb93.8



HivePath : C:\\Windows\\system32\\config\\SYSTEM

Key : Enum

DataLength : 4

DataType : REG_DWORD

Name : NextParentID.72bb93.8

Allocated : True



This command gets the NextParentID.72bb93.8 value of the HKLM:\\SYSTEM\\ControlSet001\\Services\\Enum key.



RELATED LINKS