Lion Cipher Lab
Analyze Windows Registry forensic artifacts
- Digital Forensics & IR (DFIR)
- Intermediate
- ~60 min
- Free · no account required
Why it matters
The Windows Registry is a giant, structured database the operating system and its programs read and write constantly, and it quietly records a huge amount of what happened on a machine: what is set to start automatically, which programs a user actually ran, which files and folders they opened, and which USB devices were ever plugged in. For a defender or investigator that makes it one of the richest single sources of evidence on the whole system -- persistence often hides here, and so does the proof that a program ran or a device was connected. But the Registry is also easy to misread: its…
What you'll learn
- understanding what the Windows Registry, a hive, a key, and a value are
- naming the hives that matter for forensics (SYSTEM, SOFTWARE, NTUSER.DAT) and what each holds
- navigating the live Registry safely with regedit and reading keys with reg query
- finding autostart and persistence in the Run and RunOnce keys and mapping it to MITRE ATT&CK T1547.001
- recovering evidence of program execution from UserAssist and recent-file activity from RecentDocs
- reconstructing USB device history from the USBSTOR key
- exporting a hive with reg save and analysing the copy offline with RegRipper
- reading a key last-write timestamp correctly and knowing its limits
Steps in this lab
- What the Registry, a hive, a key, and a value are
- Why it is a forensic goldmine -- and the two rules before you touch it
- The three hives that matter most
- Open the live Registry safely and read a key
- Persistence: the Run and RunOnce keys (ATT&CK T1547.001)
- What ran, what was opened, and what was plugged in
- Do it the real way: export a hive and run RegRipper on the copy
- What you actually learned, and the one habit to keep