Windows Registry Forensics, 2nd Edition

2

Processes and Tools

Abstract

The purpose of this chapter is to discuss how to perform analysis of the Windows Registry from a “postmortem” perspective.

Keywords

Analysis; Autoruns; Registry; RegRipper; Rip; Tools

Information in this chapter

• Forensic Analysis

Introduction

When I sat down to address and update/rewrite this chapter for the second edition of the book, I wanted to do two things. First, I removed the “Live Analysis” section of the chapter. The reason for this was that for digital forensic analysis, we’re not accessing live systems; access to live systems most often occurs during enterprise incident response, and many organizations already have a capability for accessing the Windows Registry on live systems during ...