Index: trunk/doc/Makefile
===================================================================
--- trunk/doc/Makefile	(revision 118)
+++ trunk/doc/Makefile	(revision 119)
@@ -1,15 +1,21 @@
 # $Id$
 
-BUILD_FILES=$(BUILD_DOC)/man/man1/reglookup.1.gz $(BUILD_DOC)/man/man1/reglookup-timeline.1.gz
+BUILD_FILES=$(BUILD_DOC)/man/man1/reglookup.1.gz\
+	$(BUILD_DOC)/man/man1/reglookup-timeline.1.gz\
+	$(BUILD_DOC)/man/man1/reglookup-recover.1.gz
 
 default: $(BUILD_FILES)
 
-$(BUILD_DOC)/man/man1/reglookup.1.gz: man/man1/reglookup.1.gz
+$(BUILD_DOC)/man/man1:
 	mkdir -p $(BUILD_DOC)/man/man1
+
+$(BUILD_DOC)/man/man1/reglookup.1.gz: man/man1/reglookup.1.gz $(BUILD_DOC)/man/man1
 	cp man/man1/reglookup.1.gz $@
 
-$(BUILD_DOC)/man/man1/reglookup-timeline.1.gz: man/man1/reglookup-timeline.1.gz
-	mkdir -p $(BUILD_DOC)/man/man1
+$(BUILD_DOC)/man/man1/reglookup-timeline.1.gz: man/man1/reglookup-timeline.1.gz $(BUILD_DOC)/man/man1
 	cp man/man1/reglookup-timeline.1.gz $@
+
+$(BUILD_DOC)/man/man1/reglookup-recover.1.gz: man/man1/reglookup-recover.1.gz $(BUILD_DOC)/man/man1
+	cp man/man1/reglookup-recover.1.gz $@
 
 install:
@@ -22,4 +28,6 @@
 	docbook2x-man --to-stdout reglookup.1.docbook > man/man1/reglookup.1
 	docbook2x-man --to-stdout reglookup-timeline.1.docbook > man/man1/reglookup-timeline.1
+	docbook2x-man --to-stdout reglookup-recover.1.docbook > man/man1/reglookup-recover.1
 	cd man/man1 && gzip -9 -f reglookup.1
 	cd man/man1 && gzip -9 -f reglookup-timeline.1
+	cd man/man1 && gzip -9 -f reglookup-recover.1
Index: trunk/doc/reglookup-recover.1.docbook
===================================================================
--- trunk/doc/reglookup-recover.1.docbook	(revision 119)
+++ trunk/doc/reglookup-recover.1.docbook	(revision 119)
@@ -0,0 +1,235 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<refentry id='reglookup-recover.1'>
+  <!--  $Id$ -->
+  <refmeta>
+    <refentrytitle>reglookup</refentrytitle>
+    <manvolnum>1</manvolnum>
+    <refmiscinfo class="sectdesc">File Conversion Utilities</refmiscinfo>
+  </refmeta>
+  <refnamediv id='name'>
+    <refname>reglookup-recover</refname>
+    <refpurpose>Windows NT+ registry deleted data recovery tool</refpurpose>
+  </refnamediv>
+
+  <refsect1 id='synopsis'>
+    <title>SYNOPSIS</title>
+    <para>
+      <command>
+	reglookup-recover [options] <replaceable>registry-file</replaceable>
+      </command> 
+    </para>
+  </refsect1>
+
+  <refsect1 id='description'>
+    <title>DESCRIPTION</title>
+    <para>
+        reglookup-recover attempts to scour a Windows registry hive for 
+        deleted data structures and outputs those found in a CSV-like format.
+        print them out to stdout in a CSV-like format.
+    </para>
+  </refsect1>
+
+  <refsect1 id='options'>
+    <title>OPTIONS</title>
+    <para>
+      <command>reglookup-recover</command> accepts the following parameters:
+    </para>
+
+    <variablelist remap='IP'>
+      <varlistentry>
+        <term>
+          <option>-v</option>
+        </term>
+        <listitem>
+	  <para>
+	    Verbose output. (Currently does little to nothing.)
+	  </para>
+        </listitem>
+      </varlistentry>
+    </variablelist>
+
+    <variablelist remap='IP'>
+      <varlistentry>
+        <term>
+          <option>-h</option>
+        </term>
+        <listitem>
+	  <para>
+	    Enables the printing of a column header row. (default)
+	  </para>
+        </listitem>
+      </varlistentry>
+    </variablelist>
+
+    <variablelist remap='IP'>
+      <varlistentry>
+        <term>
+          <option>-H</option>
+        </term>
+        <listitem>
+	  <para>
+	    Disables the printing of a column header row.
+	  </para>
+        </listitem>
+      </varlistentry>
+    </variablelist>
+
+    <variablelist remap='IP'>
+      <varlistentry>
+        <term>
+          <option>-l</option>
+        </term>
+        <listitem>
+	  <para>
+            Display cells which could not be interpreted as valid
+            registry structures at the end of the output.
+	  </para>
+        </listitem>
+      </varlistentry>
+    </variablelist>
+
+    <variablelist remap='IP'>
+      <varlistentry>
+        <term>
+          <option>-L</option>
+        </term>
+        <listitem>
+	  <para>
+            Do not display cells which could not be interpreted as valid
+            registry structures.  This is the default behavior.
+	  </para>
+        </listitem>
+      </varlistentry>
+    </variablelist>
+
+    <variablelist remap='IP'>
+      <varlistentry>
+        <term>
+          <option>-r</option>
+        </term>
+        <listitem>
+	  <para>
+            Display raw cell contents for cells which were interpreted as intact
+            data structures.  This additional output will appear on the same
+            line as the interpreted data.
+	  </para>
+        </listitem>
+      </varlistentry>
+    </variablelist>
+
+    <variablelist remap='IP'>
+      <varlistentry>
+        <term>
+          <option>-R</option>
+        </term>
+        <listitem>
+	  <para>
+            Do not display raw cell contents for cells which were interpreted
+            as intact data structures.  This is the default behavior.
+	  </para>
+        </listitem>
+      </varlistentry>
+    </variablelist>
+
+    <variablelist remap='IP'>
+      <varlistentry>
+        <term>
+          <option><replaceable>registry-file</replaceable></option>
+        </term>
+        <listitem>
+	  <para>
+	    Required argument.  Specifies the location of the
+	    registry file to read.  The system registry files should be
+	    found under:
+	    <command>%SystemRoot%/system32/config</command>.
+	  </para>
+        </listitem>
+      </varlistentry>
+    </variablelist>
+  </refsect1>
+
+  <refsect1 id='output'>
+    <title>OUTPUT</title>
+    <para>
+      <!-- XXX: this should be a bit more formal -->
+      <command>reglookup-recover</command> generates a comma-separated values (CSV) 
+      like output and writes it to stdout. For more information on the syntax of 
+      the general format, see <command>reglookup(1)</command>.
+    </para>
+    <para>
+      This tool is new and the output format, particularly the included columns, 
+      may change in future revisions.  When this format stablizes, additional
+      documentation will be included here.
+    </para>
+  </refsect1>
+
+  <refsect1 id='examples'>
+    <title>EXAMPLES</title>
+    <para>
+      To dump the recoverable contents of a system registry hive:
+    </para>
+    <para>
+      <screen>
+	reglookup-recover /mnt/win/c/WINDOWS/system32/config/system
+      </screen>
+    </para>
+    <para>
+      Extract all available unallocated data, including unparsable unallocated
+      space and the raw data associated with parsed cells in a user-specific
+      registry:
+    </para>
+    <para>
+      <screen>
+	reglookup-recover -r -l '/mnt/win/c/Documents and Settings/user/NTUSER.DAT'
+      </screen>
+    </para>
+  </refsect1>
+
+  <refsect1 id='bugs'>
+    <title>BUGS</title>
+    <para>
+      This program has been smoke-tested against most current Windows target 
+      platforms, but a comprehensive test suite has not yet been developed.
+      (Please report results to the development mailing list if you encounter
+       any bugs.  Sample registry files and/or patches are greatly appreciated.)
+    </para>
+    <para>
+      This program is new as of RegLookup release 0.9.0 and should be considered 
+      unstable.
+    </para>
+    <para>
+      For more information on registry format details and the recovery 
+      algorithm, see:
+        http://sentinelchicken.com/research/registry_format/
+        http://sentinelchicken.com/research/registry_recovery/
+    </para>
+  </refsect1>
+
+  <refsect1 id='credits'>
+    <title>CREDITS</title>
+    <para>
+      This program was written by Timothy D. Morgan.
+    </para>
+  </refsect1>
+
+  <refsect1 id='license'>
+    <title>LICENSE</title>
+    <para>
+      Please see the file "LICENSE" included with this software
+      distribution.
+    </para>
+    <para>      
+      This program is distributed in the hope that it will be useful,
+      but WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+      GNU General Public License version 3 for more details.
+    </para>
+  </refsect1>
+
+  <refsect1 id='seealso'>
+    <title>SEE ALSO</title>
+    <para>
+      reglookup-timeline(1) reglookup-recover(1)
+    </para>
+  </refsect1>
+</refentry>
Index: trunk/doc/reglookup-timeline.1.docbook
===================================================================
--- trunk/doc/reglookup-timeline.1.docbook	(revision 118)
+++ trunk/doc/reglookup-timeline.1.docbook	(revision 119)
@@ -9,5 +9,5 @@
   <refnamediv id='name'>
     <refname>reglookup-timeline</refname>
-    <refpurpose>windows NT+ registry MTIME timeline generator</refpurpose>
+    <refpurpose>Windows NT+ registry MTIME timeline generator</refpurpose>
   </refnamediv>
 
@@ -28,5 +28,5 @@
       This script is a wrapper for <command>reglookup(1)</command>, and reads
       one or more registry
-      files to produce an MTIME sorted output.  This is helpful when building
+      files to produce an MTIME-sorted output.  This is helpful when building
       timelines for forensic investigations.
     </para>
@@ -99,9 +99,9 @@
       distribution.
     </para>
-    <para>      
+    <para>
       This program is distributed in the hope that it will be useful,
       but WITHOUT ANY WARRANTY; without even the implied warranty of
       MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-      GNU General Public License version 2 for more details.
+      GNU General Public License version 3 for more details.
     </para>
   </refsect1>
@@ -110,5 +110,5 @@
     <title>SEE ALSO</title>
     <para>
-      reglookup(1)
+      reglookup(1) reglookup-recover(1)
     </para>
   </refsect1>
Index: trunk/doc/reglookup.1.docbook
===================================================================
--- trunk/doc/reglookup.1.docbook	(revision 118)
+++ trunk/doc/reglookup.1.docbook	(revision 119)
@@ -9,5 +9,5 @@
   <refnamediv id='name'>
     <refname>reglookup</refname>
-    <refpurpose>windows NT+ registry reader/lookup tool</refpurpose>
+    <refpurpose>Windows NT+ registry reader/lookup tool</refpurpose>
   </refnamediv>
 
@@ -27,6 +27,6 @@
         print them out to stdout in a CSV-like format.  It has filtering
         options to narrow the focus of the output.  This tool is
-        designed to work with on windows NT/2K/XP/2K3 registries, though
-        your mileage may vary.
+        designed to work with on Windows NT/2K/XP/2K3/Vista registries, 
+        though your mileage may vary.
     </para>
   </refsect1>
@@ -61,5 +61,5 @@
 	    Specify a type filter.  Only elements which match this
 	    registry data type will be printed.  Acceptable values
-	    are: 
+	    are:
             <command>
 	      NONE, SZ, EXPAND_SZ, BINARY, DWORD, DWORD_BE,
@@ -111,5 +111,5 @@
 	    information from key security descriptors.  The columns 
 	    are: owner, group, sacl, dacl.
-	    (This feature's output probably contains bugs right now.)
+	    (This feature's output has not been extensively tested.)
 	  </para>
         </listitem>
@@ -152,6 +152,6 @@
 	  <para>
 	    Required argument.  Specifies the location of the
-	    registry file to read.  Typically, these files will be
-	    found on a NTFS partition under
+	    registry file to read.  The system registry files should be
+	    found under:
 	    <command>%SystemRoot%/system32/config</command>.
 	  </para>
@@ -293,8 +293,8 @@
     <title>BUGS</title>
     <para>
-      This program has only been tested on a few different systems.
-      (Please report results to the development list if you test it 
-      on Windows NT 4.0, 2003, or Vista registries.  Also, if you 
-      test on any 64-bit architecture, please contact us.)
+      This program has been smoke-tested against most current Windows target 
+      platforms, but a comprehensive test suite has not yet been developed.
+      (Please report results to the development mailing list if you encounter
+       any bugs.  Sample registry files and/or patches are greatly appreciated.)
     </para>
     <para>
@@ -314,13 +314,9 @@
       Backslashes are currently considered special characters, to make 
       parsing easier for automated tools.  However, this causes paths 
-      to be difficult to read.
-    </para>
-    <para>
-      You'll notice that registry paths aren't all the same as the
-      equivalents you see in the windows registry editor.  This is because
-      Windows constructs the registry view from multiple registry files, 
-      each with their own roots.  This utility merely shows what exists 
-      under a single root.  This isn't really a bug, but one should be 
-      aware of the differences in path.
+      to be difficult to read by mere mortals.
+    </para>
+    <para>
+      For more information on registry format details, see:
+        http://sentinelchicken.com/research/registry_format/
     </para>
   </refsect1>
@@ -350,5 +346,5 @@
       but WITHOUT ANY WARRANTY; without even the implied warranty of
       MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-      GNU General Public License version 2 for more details.
+      GNU General Public License version 3 for more details.
     </para>
   </refsect1>
@@ -357,5 +353,5 @@
     <title>SEE ALSO</title>
     <para>
-      reglookup-timeline(1)
+      reglookup-timeline(1) reglookup-recover(1)
     </para>
   </refsect1>
