**Approach (brief)** I would build a resilient Python script that uses high-level registry parsers (regipy, python-registry, pyregf) to extract MRU lists, Run keys, user-specific MRU/shellbags, with layered fallbacks to libyal pyregf raw parsing and byte-level recovery when hives are partially corrupted. Output is newline-delimited JSON records with timestamps and source offsets for timeline ingestion.**Pseudocode / Python-like implementation**python
import json, logging
from regipy.registry import RegistryHive # primary
from pyregf import open as pyregf_open # fallback
# configure logging
logging.basicConfig(filename='regparse.log', level=logging.INFO)
def parse_hive(path):
records=[]
try:
hive=RegistryHive(path) # high-level
except Exception as e:
logging.error("High-level parser failed: %s", e)
hive=None
if hive:
try:
# example keys
for key_path,label in [("Microsoft\\Windows\\CurrentVersion\\Run","Run"),
("Software\\Microsoft\\Windows\\ShellNoRoam\\MRU","ShellMRU")]:
try:
key=hive.get_key(key_path)
for v in key.iter_values():
rec={'source':path,'key':key_path,'value':v.name,'data':v.value, 'timestamp': key.timestamp, 'offset': key.offset}
records.append(rec)
except Exception as e:
logging.warning("Key parse error %s at %s: %s", key_path, path, e)
except Exception as e:
logging.error("Unexpected during high-level parse: %s", e)
else:
# fallback to pyregf for raw offsets and partial reads
try:
reg=pyregf_open(path)
# walk keys, attempt to read values with try/except and log offsets
for key in reg.root_key.sub_keys:
try:
# pseudo: recurse and extract value.name, value.value, key.record_offset, key.timestamp
pass
except Exception as e:
logging.warning("pyregf subkey error offset=%s: %s", getattr(key,'record_offset',None), e)
except Exception as e:
logging.critical("pyregf also failed: attempting byte-scan: %s", e)
# byte-level recovery: scan for "MRUList" ascii or known value signatures, record approximate offsets
with open(path,'rb') as f:
data=f.read()
for sig in [b"MRUList", b"Run"]:
idx=data.find(sig)
while idx!=-1:
logging.info("Found signature %s at %d", sig, idx)
# attempt lightweight parsing around idx to extract ascii values
idx=data.find(sig, idx+1)
return records
def to_jsonl(records, outpath):
with open(outpath,'w') as f:
for r in records:
f.write(json.dumps(r, default=str) + "\n")
