Windows注册表工件分析
原名：analyzing-windows-registry-for-artifacts
使用 RegRipper 等工具提取并分析 Windows 注册表 hive 文件。
- 分类
- 开发提效
- 版本
- v1.0
- 作者
- 弈韬(@ra1nzzz)
- 下载
- 1
- 收藏
- 0
- 发布
- 2026-08-18
- 更新
- 2026-08-20
- TRACE 评分
- 3.8 / 5
内容概览
- When investigating user activity on a Windows system during an incident - For identifying autorun/persistence mechanisms used by malware - When tracing installed software, USB devices, and network connections - During insider threat investigations to reconstruct user actions - For correlating registry timestamps with other forensic artifacts - Forensic image or extracted registry hive files - RegRipper, Registry Explorer (Eric Zimmerman), or python-registry - Access to registry hive locations (SAM, SYSTEM, SOFTWARE, NTUSER.DAT, UsrClass.dat) - Understanding of Windows Registry structure (hives, keys, values) - SIFT Workstation or forensic analysis environment Concept Description --------- ------------- Registry hive Binary file storing a section of the registry (SAM, SYSTEM, SOFTWARE, NTUSER.DAT) MRU (Most Recently Used) Lists tracking recently accessed files, commands, and search term…