DFIRHub

Windows registry artifactMacrium Reflect

Macrium Reflect image storage directory

  • Third Party Applications
  • 11 keys
  • NTUSERSYSTEMSOFTWARE

Registry keys

11 keys that RECmd reads for this artifact

  • NTUSER
    Software\Macrium\Reflect\Recent Folders\Image\*

    Macrium Reflect image storage directory

  • SYSTEMrecursive
    ControlSet*\Control\BackupRestore\FilesNotToSnapshotMacriumImage

    Displays files that are not to be included in Macrium Reflect images

  • SOFTWARELastRunrecursive
    Macrium

    Command last ran by user

  • SOFTWARELicenseerecursive
    Macrium

    registered user

  • SOFTWARErecursive
    Macrium\Reflect\CBT\Sequence

    Displays timestamps related to Macrium Reflect's CBT feature

  • SOFTWARErecursive
    Macrium\Reflect\Defaults

    Displays default settings associated with Macrium Reflect on this computer

  • SOFTWARE
    Macrium\Reflect\ImageGuardian

    Displays Macrium Image Guardian status

  • SOFTWARESIDrecursive
    Macrium\Reflect\Security

    Displays SID associated with Macrium Reflect on this computer

  • SOFTWAREApp Pathrecursive
    Macrium\Reflect\Security

    Displays the application path associated with Macrium Reflect on this computer

  • SOFTWARErecursive
    Macrium\Reflect\MIG\Verified

    Macrium Image Guardian Status, 1 = protected

  • SOFTWARErecursive
    Macrium\Reflect\VSS

    Displays settings related to Macrium Reflect's interaction with VSS

References

3 links

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)