Windows Registry Forensics: Advanced Digital Forensic Analysis of the Windows Registry
Harlan Carvey · Syngress (Elsevier) · Second edition · 2016
Identifier: ISBN 978-0-12-803291-6
Access and status
Cost
Paid
Costs money to buy outright — a book, a licence, a registration.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
The standing treatment of the Windows registry as evidence: hive file structure, the tools and process for parsing it, then separate analysis passes over the system hives and the user hives, with case studies and RegRipper.
Who it is for, and when
Read it when registry keys are going to carry weight in a finding — program execution, device connection, user activity, persistence. The structural chapters explain why a key's last-write time means what it means, which is the part you will be asked about on the stand. Also the best written explanation of how to build and validate your own RegRipper plugin.
What it does not cover
Targets the Windows 7/8.x era; nothing on later Windows 10 build or Windows 11 registry changes, nor on the modern Amcache/BAM/DAM-era interpretation debates. The companion-site tooling is superseded — pull current RegRipper plugin sets from the project repository rather than the book.
Go to the source
Open at shop.elsevier.com (opens in a new tab)https://shop.elsevier.com/books/windows-registry-forensics/carvey/978-0-12-803291-6
Details
- Type
- Book
- Written for
- Working examinerAdvancedWorking examiner, Advanced
- Author
- Harlan Carvey
- Publisher
- Syngress (Elsevier)
- Version verified
- Second edition
- Year
- 2016
- Identifier
- ISBN 978-0-12-803291-6
- Topics
- windows, registry, timeline
- Checked at source
Related entries
A large collection of free single-purpose Windows artefact parsers — among them MFTECmd, PECmd, LECmd, JLECmd, AmcacheParser, SBECmd, EvtxECmd, RECmd, and the Timeline Explorer and Registry Explorer GUIs. The tools are still distributed from ericzimmerman.github.io, with a Get-ZimmermanTools helper that pulls the current set.
David Cowen's daily-blog project, running to over 800 numbered posts plus the Sunday Funday challenges, Solution Saturday write-ups and the Forensic Lunch video series, covering Windows artifacts, NTFS internals, cloud logging and DFIR programming.
An open-source Python framework that extracts timestamps from hundreds of artefact types across a disk image or directory and writes them into a single normalised storage file. log2timeline is the extraction front end; psort and psteal filter, sort, and export the result.
A download library of reference posters and cheat sheets, of which 37 are filed under Digital Forensics and Incident Response — artifact maps, timestamp reference tables, tool command references and filter syntax sheets. Download requires a free SANS account rather than payment.
Harlan Carvey's long-running blog on Windows incident response, registry analysis, investigative methodology and the discipline of documenting how you reached a conclusion.