top of page

Mastering Windows Registry Forensics:

Pages Count

17 Pages

Links for the courses

The Windows Registry: The Black Box Flight Recorder of Your PC	Click Me
The Registry's Dirty Little Secret: Transaction Logs	Click Me

SAM Hive: The Registry Knows Who You Are

System Configuration

System Configuration: Reading the Machine's Own Biography	Click Me
System Configuration: Network Artifacts & Filesystem Timestamps	Click Me
2.1 Windows Registry: A Forensic Goldmine for Installed Applications	Click Me
2.2 Tracking Microphone and Camera Usage in Windows (Program Execution: CompatibilityAccessManager)	Click Me
Registries related to System configuration	Click Me
System Configuration: Persistence & Shutdown	Click Me

NTUSER.Dat

NTUSER.Dat : What the User Was Looking For	Click Me
1.1 RecentDocs: Uncovering User Activity Through Recently Opened Files	Click Me
1.2 Tracking Recently Opened Files in Microsoft Office: A Forensic Guide	Click Me
1.3 Tracking Trusted Office Documents: A Key to Investigating Macro-Based Malware	Click Me

Additional Evidence

The Run Dialog: Small Key, Loud Evidence	Click Me

Tools

The Registry Analyst's Toolkit: Choosing Your Weapon	Click Me

Your Instructor

Dean

Dean

bottom of page