Most of the Registry hives are located in the \Windows\system32\config directory but some in other locations like Document and Settings. To analyze the NTuser hive one would load the file NTUSER.DAT which is located in the \Documents and Settings\username\ directory, select a name for the text document in the second step, select ntuser from the plugin list and click the Rip It button.

The analysis will save various system information in the text document which depend on the analyzed Registry hive. The analysis of the NTuser hive will for example reveal information about the logon username, installed applications, system and remote drives, various recent files lists, the programs that have been accessed recently and software that will start with the computer system.

Registry Ripper is a Registry analyzer that requires some knowledge about the locations of the various Registry hives on the computer system. It clearly aims at more advanced users and can provide the user with all kinds of useful information about a computer system and its users.