HiveOracle — Windows toolkit for offline registry and credential extraction

HiveOracle is a Windows x64 command-line tool that parses raw NTFS volume data to reconstruct locked files, offline registry hives, and local account NTLM hashes without accessing LSASS. It supports live volumes, physical disks, partitions, and raw disk images, requiring Administrator or SYSTEM privileges for volume access.

Features: • Reconstructs NTFS files and Alternate Data Streams (ADS) directly from raw NTFS volume data • Extracts SAM, SYSTEM, SECURITY, and optionally NTDS registry hives • Performs offline REGF parsing, BootKey recovery, and SAM hash decryption • Includes offline dump cleanup with overwrite-and-delete

Tool: https://github.com/sailay1996/HiveOracle