From the course: Learning Cyber Incident Response and Digital Forensics

Unlock this course with a free trial

Join today to access over 24,700 courses taught by industry experts.

Analyzing the windows registry

Analyzing the windows registry

From the course: Learning Cyber Incident Response and Digital Forensics

Start my 1-month free trial Buy for my team

Analyzing the windows registry

“

- [Instructor] In this lesson, we're going to take a look at our suspect system by looking through their registry. Now this is important because the registry holds a lot of information that can be really useful during your forensic investigations. From within that registry, you can get a lot of details such as operating system information, user account information, recent documents that were accessed by the user, bookmarks and cookies from the suspect's web browser, and much more by parsing that information from within the registry. Now you can either look at the registry by using the Windows registry editor if you've taken a full copy of that registry database from the system during your collection process, or you can do it from within autopsy itself if you have a disc image from that window system. Now, personally I like to use autopsy because this lets me get a lot of those details automatically as autopsy will go…

Contents