Read the Windows registry with Registry Explorer
The Windows registry keeps a quiet record of what was plugged in, what ran, and what a user opened. Registry Explorer, one of Eric Zimmerman's tools, is the quickest way to read a hive, and its bookmarks point you straight at the keys worth looking at.
Get Registry Explorer
Registry Explorer is part of Eric Zimmerman's free tools and needs the .NET runtime. Download it from ericzimmerman.github.io. The Tools & setup page has the rest.
Load a hive, and its logs
Registry data lives in hive files, each covering a different part of the system:
NTUSER.DAT: one per user, holding their activity, recent files and run history.SYSTEM: devices, services and the current control set.SOFTWARE: installed programs and system-wide settings.SAM: local accounts.USRCLASS.DAT: shellbags and more.
When you open a hive, Registry Explorer may say it's "dirty", meaning recent changes are still sitting in the transaction logs (.LOG1 and .LOG2). Point it at those logs when it asks, so you're reading the current state and not a stale one. The sample lab includes NTUSER.DAT, SYSTEM and SOFTWARE to try this on.
Use the bookmarks
The Bookmarks panel is what makes Registry Explorer quick. It jumps to the keys that matter for each hive, already decoded, so you don't have to remember every path.
Keys worth knowing
- USB history:
SYSTEM\...\Enum\USBSTORandMountedDevicesshow what was plugged in, and when. - UserAssist: GUI programs the user ran, with run counts. The values are ROT13-encoded, and Registry Explorer decodes them.
- RecentDocs and RunMRU: files opened, and commands typed into the Run box.
- Run and RunOnce: what launches at logon, a common place for persistence.
- TypedURLs: addresses the user typed into the browser.
Two things to watch
Registry timestamps are in UTC, so put everything else in UTC too before you build a timeline. And a key's last-write time tells you when the key changed, not necessarily when one value inside it did.
How it fits a Red Herrings case
Our Windows cases put their answers in real hive files, so the keys you read here are the ones that solve the case. Every student gets a different device serial, user and run history, verified before release. The Windows forensics pathway is a good place to build the skill.
Run the free First Look cases or download the sample lab, or start the 30-day trial with sample cases to try, and generate a per-student case.
