# Registry and Windows Artifact Analysis

> Master Windows Registry forensics. Learn to parse hives, uncover malware persistence, track user activity via ShellBags, and analyze execution artifacts.

Canonical: https://codelivly.com/rooms/registry-and-windows-artifact-analysis
Last updated: 2026-09-12

| | |
|---|---|
| Level | Advanced |
| Category | Forensics |
| Lessons | 4 |
| Estimated time | 30 min |
| XP | 100 |

This module dives deep into the Windows Registry and critical system artifacts essential for advanced digital forensics and incident response (DFIR). You will learn to parse registry hives (NTUSER.DAT, SYSTEM, SAM, SOFTWARE), identify malware persistence mechanisms (Run keys, Services), track user activity via UserAssist and ShellBags, and analyze recent file execution evidence (ShimCache, Amcache). From a cybersecurity perspective, mastering these artifacts is critical for reconstructing attacker timelines, uncovering hidden backdoors, and proving the execution of malicious payloads on compromised Windows systems.

## Lessons

1. What Is the Windows Registry and Why Does It Matter for Forensics (30 min)
2. Key Registry Hives for Investigations (30 min)
3. Recently Used Files, USB History and Shellbags (30 min)
4. Guided Lab: Extracting User Activity from the Registry (30 min)

## Related

- [Learning path: Disk and File System Forensics](https://codelivly.com/learning-paths/disk-and-file-system-forensics)
- [All rooms](https://codelivly.com/rooms)