2025 Guide to Registry Forensics Tools

Registry forensics can play a critical role in an investigation because many types of artifacts can be obtained from registry hives.

You can get:

• Evidence of Persistence: Scheduled Tasks and autorun keys.
• Evidence of Execution: RunMRU, MuiCache, Amache, Bam/Dam, etc.
• Evidence of Data Accessed: Shellbags, Open/SaveMRU, Office MRU, etc.
• OS Config Information: System audit settings, event log settings, etc.

(And more!)

This isn’t a comprehensive overview of the Windows registry. There are entire books about registry forensics, and much to discuss. Instead, we’ll provide an introductory overview of the registry and the registry forensics tools you can use to parse it.

Now let’s get started.

Jump to…
What Is the Windows Registry?
Where Do Registry Files Exist?
How to Access the Registry
Registry Forensics Tools
What to Watch Out for Doing Registry Analysis
The Fastest Registry Analysis Tools

What Is the Windows Registry?

The Windows Registry is made up of multiple registry files that are essentially databases that organize data in a tree structure similar to a file system.

There are several key terms one should understand when discussing the registry.

They are:

Where Do Registry Files Exist?

This isn’t a comprehensive list of every registry hive on the system, just the most common with forensic value.

HKLM\SOFTWARE

C:\windows\system32\config\SOFTWARE

HKLM\SYSTEM

C:\windows\system32\config\SYSTEM

HKLM\SAM

C:\windows\system32\config\SAM

HKLM\SECURITY

C:\windows\system32\config\SECURITY

HKU\.DEFAULT and HKU\S-1-5-18

C:\windows\system32\config\DEFAULT

HKU\{USER_SID}

%userprofile% (default: c:\users\USER_NAME\)

c:\Windows\ServiceProfiles\*\

HKU\{USER_SID}_Class

%localappdata%\microsoft\windows (default: c:\users\USER_NAME\appdata\local\microsoft\windows)

C:\Windows\appcompat\Programs\Amcache.hve

C:\Users\{USER}\AppData\Local\Packages\{APP_PACKAGE_NAME}\SystemAppData\Helium\User.dat\

C:\Users\{USER}\AppData\Local\Packages\{APP_PACKAGE_NAME}\SystemAppData\Helium\UserClasses.dat\

Interested in learning more about the actual binary structure of registry files and how data is stored?

Check out these references:

• Maxim Suhanov: Windows registry file format specification
• Joachim Metz: Windows NT Registry File (REGF) format specification
• Timothy D. Morgan: The Windows NT∗Registry File Format Version 0.4

Another great resource for learning more about the registry and its format is registry parsing libraries.

We will discuss these in our next section.

How to Access the Registry

Accessing registry data will depend on what type of analysis you are performing.

If you are doing a live triage, you can use System APIs or other tools to access the in-memory (loaded version) of registry hives. However, if you are processing a memory dump, a disk image, or offline registry files you’ll need different tools.

Our main focus will be on analyzing and parsing offline registry files, but we will briefly talk about the other two.

Memory Dump Analysis

Two common tools to process registry data from memory are:

• volatility
• MemProcFS

Live System Analysis

Accessing registry hives currently loaded by the system can be done many ways, including:

• Using PowerShell cmdlets.
• Directly through Windows APIs.
• Using command line tools like reg.
• Using a forensic tool that can parse registry files.
• Using Regedit.exe or the more feature-rich Total Registry.

Offline Registry File Analysis

To access the data inside a registry file, you first need to parse the data. There are many registry parsers and libraries available in various programming languages.

Common ones we’ve seen:

Many of the registry parsing tools (both command line and GUI-based) are built off of these registry parsing libraries. You aren’t normally going to use one of these libraries directly unless you plan on building your own scripts/app to do registry processing.

Registry Forensics Tools

Here are some common registry forensics tools that are actually used to view the registry or pull important registry data automatically:

What to Watch Out for Doing Registry Analysis

If analyzing offline files:

• Ensure your tool handles transaction logs.
• If it does not you can first rebuild the registry using a tool like RLA.

If doing live analysis:

• Ensure your tool can handle registry redirection if it’s a 32-bit application.
• Check to see if your tool will parse artifacts from new MSIX registry files. Learn more about this here.

When doing both:

• Be careful when inferring an artifact was added/updated based solely on a registry key’s last write timestamp. They can be updated for many reasons and can also be timestamped. Read more about this here.
• Understand your tool’s limitations. For example, if a registry key or value name has a NULL character in it, it will prevent that key and subkeys from being displayed in the regedit UI. You can read more about this here.