Windows Registry Forensics: There’s Always Something New

Windows Registry analysis is fundamental to forensics, but are your tools on a strong foundation? We wanted a fast, cross-platform library for parsing registry hives with full support for transaction logs, but nothing was available. So, we wrote our own in Rust and open-sourced it! We'll show you how to use it with real DFIR use cases and how to integrate it with TimeSketch, Excel, and other tools. Finally, we'll use it to dive deep into Shellbags and uncommon extension …

analysis fast forensics foundation hives library logs own parsing platform registry rust support tools transaction windows