Course
Introduction to the Windows Registry
Discover what the Windows Registry is and why it is important in digital forensic investigations.
Course description
This course will explore the location and structure of the registry hives in a live and non-live environment, as well as the types of forensic evidence found in the Windows Registry. This will include: user account information, system-wide and user-specific settings, file access, program installation and execution, search terms, auto-start locations and devices attached to the system.
Syllabus
File Downloads
File - 00:10:00
A zip file containing most files needed for this path.
Tools We Will Use
File - 00:10:00
Contains links for all file downloads needed for this path.
Windows 10 VM
File - 00:10:00
VM with files needed for this path.
Welcome to Windows Registry Forensics!
Video - 00:03:00
Structure of the Windows Registry
Video - 00:06:00
Analyzing the structure and values contained within the Registry, as seen using specialized tools to view the Registry.
What is the registry and why it is important
Video - 00:10:00
Determining the location and identifying registry files. Properly interpreting and understanding the data and how and why it gets created.
Unlock 7 days of free training
- 1,400+ hands-on courses and labs
- Certification practice exams
- Skill assessments
Associated NICE Work Roles
All Infosec training maps directly to the NICE Workforce Framework for Cybersecurity to guide you from beginner to expert across 52 Work Roles.
- Cyber Operator
- Law Enforcement / Counterintelligence Forensics Analyst
- Cyber Defense Forensics Analyst
Plans & pricing
Infosec Skills Personal
$299 / year
- 190+ role-guided learning paths (e.g., Ethical Hacking, Threat Hunting)
- 100s of hands-on labs in cloud-hosted cyber ranges
- Custom certification practice exams (e.g., CISSP, Security+)
- Skill assessments
- Infosec peer community support
Infosec Skills Teams
$799 per license / year
- Team administration and reporting
- Dedicated client success manager
-
Single sign-on (SSO)
Easily authenticate and manage your learners by connecting to any identity provider that supports the SAML 2.0 standard.
-
Integrations via API
Retrieve training performance and engagement metrics and integrate learner data into your existing LMS or HRS.
- 190+ role-guided learning paths and assessments (e.g., Incident Response)
- 100s of hands-on labs in cloud-hosted cyber ranges
- Create and assign custom learning paths
- Custom certification practice exams (e.g., CISSP, CISA)
- Optional upgrade: Guarantee team certification with live boot camps
Award-winning training you can trust




