RegRipper runs a collection of plugins against registry hive files (NTUSER.DAT, SYSTEM, SOFTWARE, etc.) to extract forensic artifacts such as USB history, executed programs, and network configuration — one of the most widely used registry forensics tools for over a decade.