Learn Windows Registry Forensics

The Windows Registry Forensics learning path will enable you to understand the purpose and structure of the files that create the Windows Registry. You will learn to identify, extract and interpret important data from a live and non-live Windows Registry.

8 courses  //   31 videos  //   8 hours of training

Free training week — 700+ on-demand courses and hands-on labs

Windows Registry Forensics training

This learning path teaches you the necessary skills to conduct a complete and accurate examination of the Windows Registry. As you progress through eight courses and the hands-on project, you’ll build the necessary skills to define and understand the Windows Registry. You will be able to locate the registry files within a computer’s file system, both live and non-live. The path will show you how to examine the registry and locate data significant to your investigation, correctly interpret the significant data found within the registry and put all your findings together to form a fact-based conclusion for your report.

Learning path components

Windows Registry Forensics Assessment
Assessment
Windows Registry Forensics Assessment

Windows Registry Forensics Assessment

See how your Windows Registry Forensics skills stack up against other professionals in your field.

Number of questions: 20

Windows Registry Forensics Project
Practice Exam
Windows Registry Forensics Project

Windows Registry Forensics Project

Test your Windows Registry Forensics skills by answering 25 challenges. You must first locate the registry files within the file system and export them to be examined. Then you'll use tools such as Registry Explorer, Decode and ShellBag to find the answers. You can use any registry tool to answer the questions, but the layout of the tool and terms used may be slightly different.

Number of questions: 25

Introduction to the Windows Registry
Course
Introduction to the Windows Registry

Introduction to the Windows Registry

Discover what the Windows Registry is and why it is important in digital forensic investigations.

2 videos
16 minutes of training

Preparing to Examine the Windows Registry
Course
Preparing to Examine the Windows Registry

Preparing to Examine the Windows Registry

Learn how to set up a forensic workstation to properly examine the Windows Registry.

4 videos
57 minutes of training

NTUser.Dat Hive File Analysis
Course
NTUser.Dat Hive File Analysis

NTUser.Dat Hive File Analysis

This course demonstrates an in-depth analysis of the artifacts contained within the NTUser.Dat hive file.

10 videos
146 minutes of training

SAM Hive File
Course
SAM Hive File

SAM Hive File

This course explains forensic artifacts found in the SAM (Security Account Manager) file, which stores and organizes information about each user on a system.

5 videos
50 minutes of training

Software Hive File
Course
Software Hive File

Software Hive File

This course will show examiners how to locate information of forensic value relating to application execution and installation contained within the software hive file.

3 videos
64 minutes of training

System Hive File
Course
System Hive File

System Hive File

This course will demonstrate evidence of forensic value contained within the system hive file.

3 videos
73 minutes of training

USRClass.dat Hive File
Course
USRClass.dat Hive File

USRClass.dat Hive File

This course identifies and explains forensic artifacts found in the UsrClass.dat hive file.

2 videos
33 minutes of training

AmCache Hive File
Course
AmCache Hive File

AmCache Hive File

This course will examine the AmCache hive file, which stores information relating to the execution of applications.

2 videos
32 minutes of training

 

What you’ll learn.

  • Structure of registry hives
  • Types of forensic evidence
  • Common forensics software and tools
  • Finding information on different hive files (NTUser.Dat, software, system, UsrClass.dat, AmCache)
  • Exporting and interpreting data

Who is this for?

  • Forensic investigators
  • Cybercrime analysts
  • Cybersecurity professionals
  • Law enforcement professionals
  • Anyone looking to learn more about Windows Registry Forensics

Train on your schedule

Personal
Teams

Infosec Skills subscription

Monthly
Annually
  • 80+ role-based learning paths (Ethical Hacking, Threat Hunting, etc.)
  • 100s of hands-on labs in cloud-hosted cyber ranges
  • Custom certification practice exams (CISSP, Security+, etc.)
  • Skill assessments
  • Infosec peer community support
  • Create custom learning paths from 100s of courses

Infosec Skills boot camp

Request a quote for pricing

 

Request Quote Browse Boot Camps
  • Exam Pass Guarantee
    If you don’t pass your exam on the first attempt, you'll get a second attempt for free. Includes the ability to re-sit the course for free for up to one year.
  • 100% Satisfaction Guarantee
    If you’re not 100% satisfied with your training at the end of the first day, you may withdraw and enroll in a different online or in-person course.
  • Live, instructor-led training (available in-person or online)
  • 90 day extended access to recordings of daily lessons
  • Certification exam voucher
  • Learn by doing with hundreds of additional hands-on courses and labs Infosec Skills Annual

Infosec Skills subscription

Annual

$599 per learner / year

Request Quote Free Team Trial
  • Team administration and reporting
  • Transferable licenses
  • 80+ role-based learning paths (Ethical Hacking, Threat Hunting, etc.)
  • 100s of hands-on labs in cloud-hosted cyber ranges
  • Custom certification practice exams (CISSP, Security+, etc.)
  • Skill assessments
  • Create and assign custom learning paths
  • Dedicated client success manager

Infosec Skills boot camp

Request a quote for pricing

 

Request Quote Browse Boot Camps
  • Team boot camp administration and reporting
  • Exam Pass Guarantee
    If you don’t pass your exam on the first attempt, you'll get a second attempt for free. Includes the ability to re-sit the course for free for up to one year.
  • 100% Satisfaction Guarantee
    If you’re not 100% satisfied with your training at the end of the first day, you may withdraw and enroll in a different online or in-person course.
  • Knowledge Transfer Guarantee
    If an employee leaves within three months of obtaining certification, Infosec will train a different employee at the same organization tuition-free for up to one year.
  • Certification exam vouchers
  • Live, instructor-led training (available onsite, in-person or online)
  • 90 days extended access to recordings of daily lessons
  • Build your team's skills with hundreds of additional hands-on courses and labs

Award-winning training that you can trust

Best Software - Highest Satisfaction

Best Software - Highest Satisfaction

Infosec Skills

Best IT Security-related Training Program

Best IT Security-related Training Program

Infosec Skills

Best Cybersecurity Education Provider & Best Security Education Platform

Best Cybersecurity Education Provider & Best Security Education Platform

Infosec Skills

Most Innovative Product - Cybersecurity Training for Infosec Professionals

Most Innovative Product - Cybersecurity Training for Infosec Professionals

Infosec Skills

Global Excellence - Cyber Security Education & Training

Global Excellence - Cyber Security Education & Training

Infosec Skills

Exceptional learning experiences powered by LX Labs cyber expertise

Infosec Skills courses and labs are powered by LX Labs — our elite team of cyber SMEs, learning specialists and community of top-ranked security instructors, published authors and sought-after industry leaders. We rigorously vet all Infosec Skills training resources to guarantee they meet certification and compliance requirements and align with recognized guidelines like the NICE Cybersecurity Workforce Framework.

LX Labs

SC Media names Infosec Skills Best IT Security Training

See for yourself why Infosec Skills leads the cybersecurity training industry.