DFIRHub

RegistryHives

System and user related Registry hives

  • Compound
  • 56 paths from 3 artifacts
  • Per-user data
  • Version 1.2
  • Eric Zimmerman

Paths on disk

56 paths from 3 targets

Paths use Windows environment variable syntax

Includes 3 targets

Each one is collected with this target

Notes

Please note, this Compound Target does NOT include the RegistryHivesOther Target on purpose. While they are technically Registry hives, they are not currently identified as being forensically significant.

However, for the purpose of KapeResearch_Registry Modules that will dump hives from the ROOT key to JSON for the purpose of (hopefully) finding forensically relevant data in one of these Registry hives, RegistryHivesOther exists for that very reason.

If you want to pull every single Registry hive possible, combine this Compound Target along with the RegistryHivesOther Target.