NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Forensics
Registry and Windows Artifact Analysis
Master Windows Registry forensics. Learn to parse hives, uncover malware persistence, track user activity via ShellBags, and analyze execution artifacts.
Room tasks
1What Is the Windows Registry and Why Does It Matter for Forensics
2Key Registry Hives for Investigations
3Recently Used Files, USB History and Shellbags
4Guided Lab: Extracting User Activity from the Registry
Frequently Asked Questions
What is Windows registry forensics?
It is analysing registry hives to learn about system configuration and user activity. Investigators find installed software, USB use, program execution and malware persistence in the registry.
What do ShellBags and UserAssist show?
ShellBags record folders a user browsed, even after deletion, while UserAssist logs programs launched through the interface. Both help reconstruct what a user did on a system.
What is Shimcache used for?
Shimcache records executables the system encountered, which can prove a file existed or ran. This advanced Codelivly room is free and shows how to interpret it alongside other artifacts.