Intermediate
Registry Analysis
Windows Registry forensics: structure, hives, keys, values, and artifacts revealing user activity, USB history, and network evidence.
- Duration
- 3h
- Labs
- 3
- Videos
- 4
Skills Acquired
- Understand Windows Registry structure and components
- Analyze hives, keys, and values in forensic investigations
- Identify user activity traces such as logins and program execution
- Track USB device history through Registry artifacts
- Extract network configurations, RDP sessions, and cached data
Curriculum
- Registry Structure
- Windows Registry overview and purpose
- Registry hives, keys, and values
- Common data types and forensic relevance
- Registry Artifacts
- User activity artifacts (logins, UserAssist, RunMRU, Shellbags)
- USB device artifacts and mounted devices
- Network artifacts including SSIDs, RDP connections, and cached bitmaps
Included in these pathways
Master Digital Forensics and Incident Response