Registry Hive Forensic Analysis Tool In Python — Complete Documentation & Simulation

Overview & System Context

Registry Hive Forensic Analysis Tool In Python: Comprehensive Web-Sourced Technical Investigation Exhaustive Research Dossier · Pure Web-Scraped Content: ~7692 Words · Real Software Screenshots: 1 1. Executive Overview & Technical Background The Windows Registry Toolkit is a versatile Python-based utility for analyzing and extracting data from the Windows Registry.

Designed with both live system interrogation and offline forensics in mind, this tool is ideal for cybersecurity professionals, digital forensics analysts, red teamers, and system administrators. With built-in support for interactive exploration, sensitive hive dumping, and offline hive parsing, the tool provides deep visibility into Windows system configuration, user activity, credential storage, and much more. Whether you're conducting incident response, malware analysis, or system auditing, the Windows Registry Toolkit empowers you to automate and streamline your registry investigation workflow.

Live Registry Exploration G Interactively navigate the Windows Registry in real-time. G Select from main registry hives (e.g., HKLM, HKCU, HKU, etc.). G Recursively list subkeys and view registry values, including type information. G Built-in support for back, exit, and direct value inspection via numbered input. Hive Dumping (Live Extraction) G Automatically dump critical registry hives (SAM, SYSTEM, SECURITY, SOFTWARE, .DEFAULT) from the live system. G Uses Windows-native reg save command for consistent and secure extraction. G Default save location is set to C:\Users\Public, but easily customizable.

Offline Hive Analysis G Load and parse offline .hiv registry hive files (ideal for forensic investigations). G Recursively traverse all keys, subkeys, and values—including binary blobs. G Handles binary data with proper hex encoding for safe viewing and processing. G Supports exporting the full structure and data into a clean, human-readable JSON format. Figure 1: Video Demonstration & Practical Interface Overview Dump Sensitive Registry Hives python registry_tool.py -dump Dumps: G HKEY_LOCAL_MACHINE\SAM G HKEY_LOCAL_MACHINE\SYSTEM G HKEY_LOCAL_MACHINE\SECURITY G HKEY_LOCAL_MACHINE\SOFTWARE G HKEY_USERS.DEFAULT Output: All dumped hives are saved in a dumped_hives/ folder as .hiv files.

Load and Parse Offline Hive File python registry_tool.py -load [-output ] If -output is not specified, the output defaults to registry_output.json. JSON file contains the full recursive structure: { "CurrentControlSet": { "Enum": { "PCI": { "VEN_8086&DEV_1234": { "DeviceDesc": "Intel PCI Controller", "LocationInformation": "PCI bus 0, device 2" } } } } A Python-based tool for exploring and analyzing the Windows registry. The tool supports both live system registry exploration and offline hive analysis, providing detailed insights into registry keys, values, and structure.

This repository contains the source code, sample data, and documentation for the diploma project "Development of a Method for Automatic Extraction of Windows Registry Data in Digital Forensics" completed at Astana IT University , 2025. "Development of a Method for Automatic Extraction of Windows Registry Data in Digital Forensics" Submitted to: Astana IT University, 2025 Student: IIIIIII [Your Last Name] Supervisor: [Supervisor Name] This code is provided for academic and forensic research purposes. Use responsibly and only on systems you are authorized to analyze.

I’ve been working on something that’s made my digital forensics workflow significantly faster, and I wanted to share it with the community. If you’re tired of juggling multiple tools to parse Windows artifacts, keep reading. What do you do? You probably reach for multiple tools: RegistryExplorer for registry, PECmd for prefetch, a different tool for EVTX, and something else for LNK files. Each has its own syntax, output format, and quirks.

What if you could use one tool that automatically detects what you’re analyzing and does the right thing? I built a Python-based forensic toolkit that automatically detects artifact types and parses them accordingly. It’s not trying to replace specialized tools, but rather provide a unified interface for common forensic parsing tasks. The best part? You don’t need to tell it what type of file you’re analyzing. It figures it out.

Extracts all forensically significant keys (not just autoruns, but also network profiles, installed apps, USB devices, etc.) The output includes everything in the Run keys, RunOnce, Services, scheduled tasks created via registry - basically all the persistence mechanisms you care about. This is where things get interesting. You suspect PowerShell was used during an incident: The tool extracts all PowerShell commands from Event IDs 4103 and 4104, and automatically flags suspicious patterns : Here’s where the directory parsing really shines. You’ve got an entire C:\Windows\System32\winevt\Logs directory: One of my favorite features is how easy it is to customize. All the forensic event mappings are in a separate evtx_mapping.py file: The code is on GitHub ( https://github.com/Prof-GP/forensic-toolbox ). I’d love feedback from the community. What other artifacts would you like to see supported? What features would make your investigations faster? This isn’t about replacing your favorite specialized tools. It’s about having a fast, unified interface for common parsing tasks.

When you’re triaging an incident at 2 AM, sometimes you just want one command that does the right thing. The forensics community has built amazing tools over the years. This is my attempt to tie some of them together in a way that makes our jobs a little easier. What forensic artifacts do you spend the most time parsing? Let me know in the comments - I’m always looking for ideas on what to add next.

2. System Architecture & Core Working Principles Using the yarp library to open Windows registry hives using a class structure that is very portable and flexible. This class demonstrates how to open a registry hive file with the yarp tool. This library not only allows us to open a single offline hive, but also leverage any available transaction logs to include additional information otherwise available on the Window’s system. This class handles both the opening of the primary hive and attempted recovery of the transaction logs.

Base class containing common registry parsing code. Will open a hive and attempt recovery using available transaction logs Using the yarp library to parse NTUSER.DAT Windows registry hives using a class structure that is very portable and flexible. Parses the MountPoints2 and TrustRecords keys for with string and binary values. Since we have a strong base class providing functionality to open hives, we can build hive specific parsing classes that are tailored to handle artifacts distinct to a single hive type. In this case we set up a class to handle NTUSER.DAT files, though could get more specific on Windows versions, etc. In this class we store a few useful details including fixed values used by other methods and metadata about the class.

With an open hive, we can begin to parse values from a known key location within the hive. This method allows us to specify a key path and inspect each of the sub-keys. For each of the sub-keys, we can then get the names and data associated with each value in the key. Additionally we could - if needed - continue to recurse on sub-keys here. Instead we return this cursory information for the caller to display as they wish. Since the values within MountPoints2 store string data, we don’t need to perform further parsing of the record.

Similarly to our prior example, we can get a key by path. In this case we don’t have a sense of what Office versions are available in the key and have elected to iterate through each of those using the parse_office_versions() method. Using each of the versions, we then access the respective TrustRecords key. If found, we then parse the binary data (retrieved with the same .data() method) using Struct to extract a timestamp and integer marking whether a trusted macro was used. These parsed attributes are then returned to the caller to be displayed.

Regipy is a python library for parsing offline registry hives (Hive files with REGF header). regipy has a lot of capabilities: NOTE: regipy[full] installs dependencies that require compilation tools and might take some time. It is possible to install a version with relaxed dependencies, by omitting the [full] . An optional Rust implementation of the core REGF parser is available as an opt-in backend, published separately to PyPI as regipy-rs : It is a drop-in replacement validated 1:1 against the pure-Python parser over the entire test-hive corpus — every key path, timestamp, value and plugin output, notarized by matching SHA-256 traversal digests (see regipy_tests/comparison_test.py and the Forensic parity evidence section of regipy-rs/BENCHMARKS.md ).

cProfile shows why: in the Python backend, traversal time is dominated by per-record construct struct parsing and value decoding; with the Rust backend, the parser disappears from the profile entirely and the only remaining Python cost is constructing the returned Subkey dataclasses. The full profiles, per-hive digests and a disclaimer documenting the few intentional divergences (exception types on corrupted hives, cycle-guard behavior) are in regipy-rs/BENCHMARKS.md ; python regipy-rs/benchmark.py regenerates the entire report.

The pure-Python parser remains the default and is unaffected when the Rust backend is not installed. The hive type will be detected automatically and the relevant plugins will be executed. See the plugins section for more information Compare registry hives of the same type and output to CSV (if -o is not specified output will be printed to screen) All new plugins should have one or more basic validation cases (which can be expanded in the future), for example: A comprehensive Python toolkit for parsing forensic artifacts including Registry hives, Prefetch files, Windows shortcuts (.lnk files), Windows Event Logs (.evtx), and Memory Dumps. New tools added periodically The toolbox accepts memory dumps from any source. Recommended approach for VM analysis: For issues, questions, or contributions, please visit: https://github.com/Prof-GP/forensic-toolbox/issues A comprehensive Python toolbox for parsing Windows forensic artifacts including Registry hives, Prefetch files, Windows shortcuts (.lnk files) and WIndows Event Logs (.evtx).

A Python tool for performing comprehensive Windows registry forensics from memory dumps or extracted hive files. Built for digital forensics students and practitioners. This tool is intended exclusively for authorized forensic investigations, academic research, and CTF challenges. Only analyze systems and memory images you own or have explicit written permission to examine. Unauthorized access to computer systems is illegal.

How forensic cybersecurity specialists extract and interpret the artifacts hidden inside the Windows Registry to reconstruct what happened on a system. The Windows Registry is a hierarchical database made up of discrete binary files called hives, and it is one of the richest forensic data sources available to an investigator. Every logon session, every GUI application launch, every USB storage device connection, and a significant portion of attacker persistence activity leaves a traceable mark in at least one registry hive. As NIST SP 800-86 (Guide to Integrating Forensic Techniques into Incident Response) establishes, operating system data — including registry contents — forms one of the four core forensic data categories alongside files, network traffic, and applications. Knowing exactly where to look in the registry, what the binary data structures mean, and how to extract artifacts without contaminating evidence separates a skilled DFIR analyst from someone who can only run a scan and wait.

This guide covers the full forensic registry analysis workflow that a specialist would apply during a real investigation: acquiring hives safely, understanding the binary hive format at a structural level, and then working through each of the four core artifact categories in technical detail. Every registry path, every key name, every cell signature, and every tool mentioned here reflects current Windows 10 and Windows 11 forensic practice. Where artifacts behave differently across Windows versions, those distinctions are documented. The tools referenced have been validated through the NIST Computer Forensic Tool Testing (CFTT) program or are widely peer-reviewed in the DFIR community.

Before any analysis begins, the investigator needs to understand what the registry is at the file level. The registry is not a single file. As Mark Russinovich documents in Windows Internals, the registry on disk is a set of discrete binary files called hives, each containing a tree structure with a root key and all subordinate subkeys, values, and data beneath it. The Configuration Manager logically divides each hive into allocation units called blocks in much the same way that a file system divides a disk into clusters. Understanding which hive stores which data determines where you go to find any given artifact.

The system-wide hives live in C:\Windows\System32\config\ on a live system. The five you will work with in almost every investigation are as follows. The SAM hive stores local account information including password hashes and account metadata. The SECURITY hive contains security policy data and cached domain credentials. The SOFTWARE hive holds application configurations, installed software records, and OS settings. The SYSTEM hive records hardware configuration, services, and driver data. The DEFAULT hive stores the default user profile applied to new accounts.

3. Software Implementation, Frameworks & Protocols In addition to these system hives, every user account has two hives stored in their profile directory. The NTUSER.DAT file at C:\Users\[username]\NTUSER.DAT stores per-user settings, preferences, and activity artifacts. The UsrClass.dat file at C:\Users\[username]\AppData\Local\Microsoft\Windows\UsrClass.dat stores shell settings, file associations, and additional user activity data including shellbags. These per-user hives are where most user activity forensics happens. Note that the HKEY_LOCAL_MACHINE\HARDWARE hive is volatile — it exists entirely in memory and is regenerated at each boot from hardware detection. It has no on-disk file and is not part of the forensic acquisition from the config directory.

Each hive has associated transaction log files with .LOG1 and .LOG2 extensions in the same directory. When Windows writes to the registry, it first commits the change to a transaction log before writing to the primary hive file. Windows uses a dual-logging mechanism: if a crash occurs during a write to the transaction log, the primary hive remains consistent; if a crash occurs during the write to the primary hive, the transaction log contains enough data to recover the primary hive to a consistent state. On Windows 10 and later, the kernel may delay writing modified data from memory to the primary hive file for up to an hour. This means that on a live system, the primary hive file may be significantly out of date compared to what the OS holds in memory, and the transaction logs may contain data that has not yet been flushed. A forensically complete acquisition must include both the primary hive files and their transaction logs. Tools such as Eric Zimmermann's Registry Explorer handle log replay automatically during loading, but if you are doing raw hive parsing, you need to apply the transaction logs or acknowledge the gap in your report.

The registry hive files are locked by the operating system on a running machine. You cannot simply copy NTUSER.DAT or SYSTEM while Windows is using them. Forensic acquisition uses one of three approaches depending on the investigation context. The cleanest approach is offline acquisition from a forensic image or a write-blocked drive. After imaging the drive with a tool such as FTK Imager or dd, you mount the image and navigate directly to the config directory and user profile paths. There is no lock contention, no risk of altering evidence, and the hive state is exactly what existed at image time.

For live acquisition from a running system âII which is sometimes necessary during incident response when shutting down is not an option âII you use the Volume Shadow Copy Service or a tool capable of reading locked files. FTK Imager has a built-in capability to acquire locked registry files from a live Windows system. The Windows built-in utility reg save can also export a copy of a hive branch, though it captures only the loaded hive content and does not include unallocated cells where deleted data may reside.

Volume Shadow Copies (VSCs) are a third source that is often overlooked. If shadow copies exist on the target system, each one contains a snapshot of the registry hives at the time the shadow copy was created. This allows an investigator to reconstruct registry state at multiple points in time âII an extremely powerful capability when building a timeline or examining how persistence mechanisms were installed and then removed.

Always calculate and record cryptographic hashes (MD5 and SHA-256) for each acquired hive file before and after acquisition. Document the acquisition tool, version, date, time, and examiner. Any analysis performed on original evidence without write blocking is a chain-of-custody problem that can undermine findings in legal proceedings. Registry hive files use a proprietary binary format that Microsoft has never officially published a specification for, though its structures are effectively public through PDB kernel symbols and independent reverse-engineering efforts. The file begins with a 4096-byte base block (also called the header), which contains the regf ASCII signature that identifies the file as a registry hive, primary and secondary sequence numbers used to verify write consistency, a last-written timestamp, a version number, the root cell offset, and a checksum calculated over the first 508 bytes. The NIST Computer Forensic Tool Testing program (CFTT) documents the base block structure in its Windows Registry Forensic Tool Specification. Following the base block are one or more hive bins, each identified by an hbin signature. Each bin is variable in length but always a multiple of 4096 bytes, with a minimum size of 4096 bytes. Within each bin are cells, which are variable-length structures aligned to 8-byte boundaries that hold keys (identified by nk signatures), values ( vk ), subkey lists ( lf , lh , ri , li ), security descriptors ( sk ), or raw data. Each cell's size field uses a sign convention: a negative value means the cell is allocated, and a positive value means it is unallocated. Deleted cells are not immediately zeroed — they are marked as unallocated and remain in place until the space is reused. This is why registry carving can recover deleted keys and values from unallocated hive space, and it is why forensic tools that parse the full binary hive (rather than relying on the Windows API to read only active keys) are essential in a serious investigation.

The Windows Registry tracks a surprisingly detailed record of what a user did on a system âII which files they opened, which locations they typed into the address bar, what was searched for, and which applications were recently used. These artifacts are stored primarily in NTUSER.DAT, the per-user hive. The RecentDocs key records files that were recently opened through the Windows shell. The path is: The root key contains subkeys organized by file extension (e.g., .pdf , .docx , .xlsx ). Each subkey holds a list of binary values representing recently opened files of that type. The data is stored as binary blobs containing the filename and a shell link (LNK) reference. The MRUListEx value within each subkey gives the order of access, with the most recently accessed file listed first. Forensically, RecentDocs tells you which files a user opened and in what order. It does not tell you what the user did with the file âII only that they opened it.

When a user types a path directly into Windows Explorer's address bar, it is recorded in: Similarly, URLs typed directly into Internet Explorer or the legacy Edge are recorded in: Both keys store the typed strings in sequentially numbered value names (url1, url2, and so on). TypedPaths is particularly valuable because it captures paths that might not appear anywhere else âII a user navigating directly to a network share, a removable drive, or a system directory they should not be accessing would show up here.

Each value stores a search string entered by the user. The MRUListEx value provides access order. This key is valuable in investigations involving data exfiltration, insider threats, or cases where you need to establish what a user was looking for on their own machine. Commands typed into Run are stored as individual values. The MRUList value indicates order. Attackers and insiders frequently use Run to launch programs, execute scripts, or access network resources. Entries such as cmd.exe , powershell.exe -enc [base64] , or UNC paths to network shares are red flags worth noting.

When a user opens or saves a file through a Windows dialog box (such as File > Open in any application), the paths they navigated to are stored in: These keys are rich sources of evidence for data exfiltration investigations. If a user copied files to a USB drive or uploaded them through a save dialog, the directory path they navigated to will appear here.

Shellbags deserve their own discussion because they are among the most forensically powerful artifacts in the entire registry. Windows records the display preferences (view mode, icon size, sort order, window size) for every folder a user has opened through Windows Explorer. Those preferences are stored in the UsrClass.dat hive: What makes shellbags extraordinary is that the entry persists even after the folder is deleted. If a user opened a folder on a USB drive, on a network share, or within a since-deleted directory, the shellbag entry remains. This means that a forensic analyst can prove a user interacted with a folder that no longer exists on the file system. Shellbag analysis requires specialized tools âII SBECmd from Eric Zimmermann's toolkit or the shellbag plugin in Autopsy are the standard options.

Determining whether a specific program was executed on a system is a central question in many investigations âII malware analysis, insider threat cases, and compliance audits all need this. The registry provides several independent sources of execution evidence, each with different characteristics and coverage. UserAssist is one of the most widely cited execution artifacts. Windows records every GUI application launched through the shell (Start menu, desktop shortcuts, file associations) in the following location within NTUSER.DAT: Two primary GUIDs are used on Windows 10 and 11. The GUID {CEBFF5CD-ACE2-4F4F-9178-9926F41749EA} tracks applications and executables launched directly. The GUID {F4E57C4B-2036-45F0-A9AB-443BCFE33D9F} tracks launches initiated through shortcut (.lnk) files, such as Start Menu or taskbar shortcuts. Each value name under the Count subkey is ROT-13 encoded — a substitution cipher that shifts each alphabetic character by 13 positions. Decoding the value name gives you the full path to the launched item. The binary data for each value contains a structured blob that includes a run count, the last execution time as a FILETIME timestamp, and — on Windows Vista and later — a Focus Time field recording in milliseconds how long the application window was in the foreground. The Focus Time metric was introduced in Windows Vista and refined through Windows 8 and 10, where Microsoft also added tracking for Universal Windows Platform (UWP) applications. As Kaspersky's GReAT team documented in their 2025 analysis, UserAssist data can sometimes show inconsistencies, making cross-correlation with other execution artifacts critical. Note also that shortcut (.lnk) interactions can register in UserAssist without actual program execution, so verifying genuine usage through non-zero Focus Time values adds confidence to any finding. Tools such as RegRipper automatically decode ROT-13 and parse the binary data into human-readable timestamps. UserAssist only captures applications launched through the shell GUI — programs launched from the command line, via services, or through parent process injection will not appear here.

The MUICache key stores the friendly display names of applications that have been executed. The key location is: Each value name is a path to an executable (or the executable's resource section), and the value data is the corresponding friendly name extracted from the executable's resource table. MUICache is populated the first time an application is run. It does not store timestamps or run counts, but its presence confirms that a specific binary was executed by that user account.

Because the value name contains the full path, it can also confirm the exact location from which the binary ran âII which matters greatly when you are tracking a binary that was launched from a removable drive, temp directory, or user profile folder. AppCompatCache, commonly called ShimCache, is a system-wide execution artifact stored in the SYSTEM hive: ShimCache is maintained by the Application Compatibility subsystem. It records files that were accessed by the compatibility layer, which in practice includes most executables that have been run or even browsed in Windows Explorer if the OS checked them for compatibility purposes. On Windows 10 and 11, executables viewed in File Explorer are added to ShimCache without execution — simply navigating to a folder containing .exe files in Explorer is sufficient to generate entries.

Each entry stores the full file path and the last modified timestamp of the file (not the execution time — a critical distinction that forensic analysts must document carefully in reports). On Windows 7 and 8/8.1, an Insert Flag in the data structure could indicate whether a file was executed rather than merely shimmed. On Windows 10 and later, the original Insert Flag was removed. However, recent research by forensic analysts has revealed that the last 4 bytes of the data field in Windows 10/11 ShimCache entries may serve as an execution indicator — Eric Zimmerman's AppCompatCacheParser now parses this field and reports Yes/No values in the execution column. That said, this interpretation was reverse-engineered through observation rather than official documentation, so findings should always be corroborated with other artifacts. The cache holds a limited number of entries (typically 1024 on Windows 7 and later) and flushes to the registry only on system shutdown or reboot — not during normal operation. This means that on a system that was powered off abruptly or imaged live, the most recent entries may exist only in kernel memory and will not appear in the registry hive on disk. The Mandiant shimcachemem Volatility plugin can recover unflushed ShimCache data from memory dumps. ShimCache must be parsed with a tool like AppCompatCacheParser or RegRipper — it is stored as a raw binary blob and is not directly human-readable.

4. Practical Deployment, Analysis & Case Studies Amcache is a separate hive file located at C:\Windows\AppCompat\Programs\Amcache.hve . Introduced in Windows 8 (and also present on updated Windows 7 systems), it is not part of the standard registry hive set under System32\config , but it is analyzed using the same registry parsing tools. Amcache stores detailed metadata about programs that have been executed, including the full file path, file size, last modified time, compile time embedded in the PE header, and — critically — the SHA-1 hash of the executable. The SHA-1 hash is the standout forensic value of Amcache. It allows an analyst to look up the hash in threat intelligence databases such as VirusTotal even after the binary itself has been deleted from the file system. Like ShimCache, Amcache entries persist after file deletion, which is critical when attackers clean up their tooling. Amcache entries are organized by application GUID under: Microsoft has changed the Amcache database structure at least four times since its introduction, with changes tied not to OS version but to specific DLL versions and patch levels. This means that the same tool may produce different output structures depending on the exact build. Analysts should also be aware that the Microsoft Compatibility Appraiser scheduled task (under \Microsoft\Windows\Application Experience\ ) is responsible for populating much of the Amcache data — if this task has been disabled, Amcache may be incomplete. Eric Zimmermann's AmcacheParser is the standard tool for extracting and parsing Amcache data into structured CSV output compatible with timeline analysis tools.

Introduced in Windows 10 version 1709 (Fall Creators Update), the Background Activity Moderator tracks processes to manage their background resource usage. The forensic byproduct is a per-user record of programs that were executed, along with the last execution timestamp stored as a 64-bit FILETIME value. The original registry location was bam\UserSettings , but in current Windows 10 and 11 builds the data resides at: BAM entries are useful because they record a reliable last execution timestamp for a broader range of processes than UserAssist, including processes without a GUI. However, BAM has important forensic limitations that must be understood.

Entries expire and are purged approximately seven days after the last execution when the system boots, so BAM is primarily useful for investigating recent activity. Console applications launched through a command-line interface do not generate BAM entries. Executables residing on network shares or removable media such as USB drives also do not produce BAM entries. If an executable is deleted from disk, its BAM entry may also be removed on the next system boot, though this behavior is not consistent in all cases. Additionally, the execution timestamps in BAM may differ by a small margin from the actual process launch time. Despite these limitations, BAM provides per-user attribution tied to the SID, so cross-referencing the SID against the SAM hive or domain records identifies which account each entry belongs to — a capability that Prefetch, for example, does not offer.

No single execution artifact tells the complete story. A skilled analyst triangulates across UserAssist, ShimCache, Amcache, and BAM simultaneously. Presence in multiple sources strengthens the finding. Presence in Amcache with a known-malicious SHA-1 hash but absence from UserAssist suggests the binary ran as a non-GUI process âII consistent with malware behavior.

USB device forensics in the registry allows an investigator to reconstruct which storage devices were connected to a system, when they were connected, which drive letter they were assigned, and in some cases the volume name and serial number of the media. This is critical evidence in data theft cases, policy violation investigations, and endpoint security assessments. The structure under USBSTOR is hierarchical. The first subkey level uses a device class string that encodes the device type, vendor name, and product name in the format Disk&Ven_[Vendor]&Prod_[Product]&Rev_[Revision] . Under that is a subkey whose name is the device's unique instance ID, which for most USB storage devices corresponds to the hardware serial number. This serial number is assigned by the device manufacturer and is generally unique to that specific physical device âII a critical distinction from volume serial numbers which can be spoofed. Under the instance ID key, a Properties subkey contains timestamps that reveal when the device was first installed and when it was last connected.

Within this GUID subkey, value 0064 holds the first installation time, value 0066 holds the last connection time, and value 0067 holds the last removal time. These values are not human-readable without parsing the FILETIME binary format, which all major registry forensic tools handle automatically. This key records every USB device âII not just storage âII including keyboards, mice, hubs, network adapters, and phones. For storage-specific forensics, USBSTOR is the targeted key, but Enum\USB is useful when you need to account for all USB activity, such as tracking whether a USB-to-Ethernet adapter or a smartphone was connected (which could indicate data transfer via a non-storage protocol).

Knowing that a USB device connected is valuable. Knowing which drive letter it was assigned and what the volume was named is more so. This mapping is stored in: MountedDevices maps drive letters and volume GUID paths to device signatures stored as binary data. Correlating the device signature in MountedDevices against the USBSTOR instance ID can tie a specific physical device to a specific drive letter assignment. The volume name (as labeled by the user, such as "MyDrive" or "KINGSTON") is tracked in: This key caches the volume labels that Windows Search has indexed, and it persists the label even after the device is removed.

The MountPoints2 key in each user's NTUSER.DAT associates the connected volume with the specific user who was logged in at the time: Each subkey name here is a volume GUID that corresponds to a device that was connected and accessed while that user was logged in. If multiple user accounts are on the system, comparing MountPoints2 across all NTUSER.DAT hives tells you which user(s) interacted with a specific removable device âII a distinction that is essential in shared workstation investigations.

Combine USB registry artifacts with shellbag data from UsrClass.dat to determine whether a user not only connected a USB device but also opened folders on it. MountPoints2 establishes the device was accessible under that user account; shellbags establish the user navigated into the device's directory structure. Together, they build a significantly stronger evidentiary picture than either source alone.

Registry-based persistence is one of the most widely documented techniques in attacker tradecraft. MITRE ATT&CK catalogs 14 registry-related persistence sub-techniques under T1547 (Boot or Logon Autostart Execution) and additional modification techniques under T1112 (Modify Registry). According to the Picus Security Red Report 2026, T1547 ranked 7th among the most frequently observed techniques across over one million analyzed malware samples, marking its third consecutive year in the top ten. Nextron Systems' analysis of ATT&CK data found that T1547.001 (Registry Run Keys / Startup Folder) alone is linked to 54 tracked threat actor groups — more than any other persistence sub-technique. A forensic specialist examining a potentially compromised system needs to systematically audit each of these locations rather than relying on a single scan.

The Run keys are the most commonly abused persistence locations in Windows. They cause specified programs to execute at user logon. There are four primary variants: HKCU\Run applies only to the logged-in user. HKLM\Run applies to all users system-wide and requires administrator or SYSTEM privileges to write, making it a common target for elevated malware. RunOnce keys execute once and then delete themselves, which can be used to trigger a payload that removes its own persistence after execution. The Wow6432Node variants of these paths also exist under HKLM\Software to serve 32-bit applications running on 64-bit Windows: When auditing Run keys, examine each value for signs of abuse: paths pointing to temp directories, AppData, or user-writable locations; base64-encoded command-line arguments; use of living-off-the-land binaries such as mshta.exe , wscript.exe , rundll32.exe , or regsvr32.exe ; and unusual value names designed to blend in with legitimate entries.

Malicious services are a high-privilege persistence mechanism. All installed services are enumerated under: Each subkey represents a service or driver. The forensically significant values within each service key are Start (which controls when the service starts: 0=Boot, 1=System, 2=Automatic, 3=Manual, 4=Disabled), Type (which distinguishes kernel drivers from user-mode services), ImagePath (the full path to the binary or command line), Description, and DisplayName.

Malicious services frequently use ImagePaths pointing to user-writable directories, binaries named to mimic legitimate Windows services, or cmd.exe and powershell.exe command lines rather than standalone binaries. The forensic analyst should look for services with a Start value of 2 (Automatic) or 0/1 (Boot/System) that were recently created, have ImagePaths outside of System32 or Program Files, or lack legitimate Description values.

The Winlogon key controls the logon process and is a historically abused persistence vector: The Userinit value specifies what executes after the user authenticates. Its default and expected value is C:\Windows\system32\userinit.exe, (note the trailing comma). If an attacker appends a malicious binary path after the comma, it will execute at every logon for all users. The Shell value specifies the Windows shell, normally explorer.exe . Replacing or supplementing this with a malicious binary gives an attacker a persistent execution point. The Notify value, present in older Windows versions, allowed DLL notification packages to load at logon. Any deviation from the default values in Winlogon warrants immediate investigation.

specifies DLLs that are loaded into every process that loads user32.dll âII which is essentially every GUI application. On a clean Windows 10 or 11 system, this value should be empty and the LoadAppInit_DLLs value should be set to 0. Any DLL path listed here will be injected into nearly every user-mode process on the system. This is a powerful but noisy technique that some malware families have used, and its presence strongly indicates compromise. Secure Boot and Driver Signature Enforcement have limited the effectiveness of AppInit_DLLs on modern systems, but it remains worth auditing.

When a Debugger value is set under a named executable's subkey, Windows launches the specified debugger instead of (or in addition to) the target process. Attackers use this to replace accessibility tools on the Windows logon screen âII setting sethc.exe (Sticky Keys), osk.exe , or utilman.exe as the key name and cmd.exe as the Debugger value gives an attacker a SYSTEM-level command prompt from the logon screen without any credentials. Any process name subkey under IFEO that contains a Debugger value pointing to anything other than a legitimate debugging tool is a significant finding.

The BootExecute value specifies processes that run before the operating system fully loads: The default and expected value is autocheck autochk * . Any additional entries here execute at the very start of the boot process before most security tooling is loaded, before user accounts are available, and before most logging is active. This makes it a preferred persistence location for rootkits and bootkit-adjacent malware. Any modification to BootExecute should be treated as a critical finding.

5. Performance Evaluation & Extended Technical Observations Active Setup is a legitimate Windows mechanism for applying per-user configuration the first time a user logs on after a system-level change. It is located at: Each subkey has a StubPath value that specifies a command to run once per user account when that user first logs on after the component was installed. Because the command runs in the context of each new user, attackers can use Active Setup to ensure their payload executes for every user who logs into the system âII including accounts created after the initial compromise. Audit the StubPath values for all subkeys and cross-reference against known-legitimate Active Setup components.

While scheduled tasks are typically managed through XML files in C:\Windows\System32\Tasks , task metadata is also recorded in the registry at: The TaskCache\Tree hive mirrors the folder structure of the Task Scheduler UI. Each task GUID under TaskCache\Tasks contains the actions (what the task runs), triggers (when it runs), and security descriptor (which account it runs under).

Searching for tasks with actions pointing to scripts, encoded PowerShell, or binaries in user-writable paths is a standard part of persistence auditing. The Windows print spooler service loads port monitor DLLs at system boot from the following registry location: Each subkey represents a port monitor, and the Driver value within each subkey specifies the DLL to load. Because the print spooler service ( spoolsv.exe ) runs under SYSTEM-level permissions, a malicious DLL placed here gains SYSTEM execution at boot without requiring any user interaction. An attacker with write access to this key can create a new arbitrarily named subkey and set the Driver value to a fully-qualified path of their DLL. Legitimate port monitors ship with Windows and have DLLs located in C:\Windows\System32 with recognizable names. Any Driver value pointing to an unusual path warrants investigation.

Programs specified in this value execute automatically at user logon. MITRE ATT&CK documents real-world abuse of this key by threat groups including APT42, with malware families such as xCaon and BoxCaon using it for persistence. On a clean system, this value should be empty. Any entry here is a significant finding. Microsoft periodically mitigates specific persistence vectors by enforcing restrictions in newer Windows builds. AppInit_DLLs has been significantly limited by Secure Boot; some IFEO techniques require disabling protections that are on by default.

Always verify that a finding is actionable on the specific Windows build you are analyzing, and note the OS version in your report. No analyst parses hive binary format by hand. The following tools are the standard toolkit for registry forensics in professional DFIR practice.

RegRipper, created by Harlan Carvey, is a Perl-based registry analysis tool that uses a plugin architecture. Each plugin targets a specific registry artifact âII there are plugins for UserAssist, RecentDocs, USBSTOR, Run keys, ShimCache, and dozens more. Running RegRipper against a hive file with a selected plugin or a full profile of plugins produces a plaintext report extracting and interpreting the targeted artifacts. RegRipper parses the raw binary hive rather than going through the Windows registry API, which means it works on offline hives and can access unallocated cells. It is available on GitHub and is included in many DFIR Linux distributions.

Registry Explorer is a GUI-based hive browser that provides a clean interface for navigating hive files, searching for keys and values, and viewing bookmarks of forensically significant locations. It handles transaction log replay automatically. RECmd is the command-line companion that accepts a hive file and a batch file of targeted key paths, outputting structured CSV results for each artifact. The batch files maintained by the DFIR community cover virtually every known forensic artifact location and are regularly updated as new Windows versions introduce changes. Both tools are part of Eric Zimmermann's free DFIR toolkit available at ericzimmerman.github.io.

Autopsy is a full-featured open-source DFIR platform with a Registry Analysis ingest module. It can parse hive files from a forensic image, extract key artifacts, and integrate registry findings with file system, browser history, and other evidence sources in a unified case view. Autopsy is appropriate for investigations where you need a single case management platform rather than running multiple standalone tools.

Shellbag analysis requires dedicated parsing because of the complexity of the binary data format. SBECmd (Shellbag Explorer Command Line), also from Eric Zimmermann, parses both the BagMRU and Bags subkeys from UsrClass.dat and outputs a structured view of every folder interaction recorded. The output includes the full folder path, the last interacted time, and whether the folder was on a local drive, network share, or removable device.

AppCompatCacheParser extracts and decodes the ShimCache binary blob from the SYSTEM hive and outputs a CSV with file paths and timestamps. AmcacheParser does the same for Amcache.hve, including the SHA-1 hash field that is the artifact's primary forensic value. Both are part of Zimmermann's toolkit and produce output compatible with timeline analysis tools such as log2timeline/Plaso.

Registry forensics does not happen in isolation. It is one layer of a broader digital forensic investigation that also includes file system analysis, memory forensics, event log analysis, and network artifact examination. NIST SP 800-86 defines the forensic process as four phases — collection, examination, analysis, and reporting — and registry analysis fits within each phase. The registry fills specific gaps that other sources cannot: it provides a persistent record of activity that survives file deletion, records device connections that may not appear in logs, and exposes attacker persistence that is invisible to casual system inspection.

A structured workflow for registry analysis begins with acquiring all hive files — both system hives and all per-user NTUSER.DAT and UsrClass.dat files — with their corresponding .LOG1 and .LOG2 transaction logs. Hash everything with both MD5 and SHA-256 before analysis begins. For triage-speed collection, Kroll Artifact Parser and Extractor (KAPE) can automate the acquisition of registry hives and other forensic artifacts from a live system or mounted image in seconds. Load the hives into Registry Explorer to verify integrity and replay transaction logs. Run RECmd with the full community batch file against each hive to produce a comprehensive CSV artifact dump. Run RegRipper with appropriate plugins for any artifacts not covered by RECmd's batch files. Parse ShimCache and Amcache with their dedicated parsers (AppCompatCacheParser and AmcacheParser). Parse BAM entries from the SYSTEM hive. Parse shellbags from each UsrClass.dat with SBECmd.

Once the raw artifact data is extracted, integrate it into a timeline. Tools such as log2timeline/Plaso can ingest registry CSV output alongside event logs, file system metadata ($MFT, $UsnJrnl), and browser history to build a unified MACB (Modified, Accessed, Changed, Born) timeline. Within that timeline, correlate execution artifacts with user activity artifacts: does a suspicious binary execution in ShimCache coincide with a TypedPath pointing to a removable drive? Does a new Run key value appear at the same timestamp as a USB device connection event? Does BAM show execution of a binary whose SHA-1 hash in Amcache matches a known threat indicator? These correlations are where registry forensics moves from artifact enumeration to answering the questions that matter in an investigation.

Finally, document every artifact in your report with the specific registry path, the value name, the data, and the timestamp. Include the tool used to extract it, the hive file it came from, and the hash of that hive file. Note the Windows OS build number, as artifact locations and behavior change between builds. Forensic findings that cannot be traced back to a specific, verified source have no evidentiary weight. The registry is full of answers — the analyst's job is to extract them precisely, interpret them accurately, and present them in a form that holds up to scrutiny.

Common questions about Windows Registry forensic analysis from students and practitioners working through DFIR investigations. USB device history is stored primarily in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR, which records the device class, vendor, product, and serial number for every USB storage device that has ever connected to the system. The HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB hive records all USB device classes, not just storage.

Several keys track program execution. UserAssist under NTUSER.DAT records GUI application launches with encoded counts and timestamps. The MUICache key records the friendly names of executed programs. AppCompatCache (ShimCache) in the SYSTEM hive records executables that the compatibility layer has processed, and Amcache.hve stores SHA-1 hashes and file metadata for recently run applications.

The primary persistence Run keys are HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run, along with their RunOnce counterparts. Forensic analysts also examine the Services key under HKLM\SYSTEM\CurrentControlSet\Services, Winlogon values such as Userinit and Shell, the BootExecute value under HKLM\SYSTEM\CurrentControlSet\Control\Session Manager, Image File Execution Options Debugger values, Active Setup StubPath values, Port Monitor Driver values under HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors, and the Windows\load value under HKCU.

Yes. Windows does not immediately overwrite deleted registry cells; it marks them as unallocated. Tools such as RegRipper, Autopsy, and dedicated carving utilities can parse unallocated space within hive files to recover deleted keys, values, and data. The success rate depends on how much subsequent write activity has occurred and whether the cells have been overwritten.

Analysts acquire hives offline by mounting a forensic image or connecting a write-blocked drive and navigating to the Windows\System32\config directory for system hives, or to the user profile directory for NTUSER.DAT and UsrClass.dat. Tools such as FTK Imager, Arsenal Image Mounter, and the Windows Volume Shadow Copy service can expose hive files for extraction while preserving the original evidence.

The Windows Registry Security Scanner is a Python-based tool designed to analyze Windows registry hives for potential security issues and suspicious configurations. It checks for misconfigurations, unauthorized modifications, and indicators of malicious activity in critical registry paths, such as auto-run entries, services, Winlogon settings, and more. The tool also integrates with VirusTotal for file hash analysis and generates detailed JSON reports for identified issues.

This tool is intended for security researchers, system administrators, and forensic analysts to detect potential threats and ensure system integrity. Ensure the freqtable2018.freq file is present in the project directory for frequency analysis. Harvested Online Documentation & Reference Sources • https://github.com/Moataz51201/Reg-Extract • https://github.com/Rahymkozhieva/registry-forensics-diploma • https://practicalforensics.substack.com/p/building-a-python-based-digital-forensics • https://chapinb.com/python-forensics-handbook/ch02_registry.html • https://github.com/mkorman90/regipy • https://github.com/Prof-GP/forensic-toolbox • https://github.com/Ritik9845/WinRegForensics • https://kandibrian.com/articles/windows-registry-forensic-analysis.html • https://github.com/KirlosYounes123/Windows-Registry-Forensics-V1