665,000+ skills indexed

AxxxxxxaaannCOMMUNITY

Explore all skills by this author →

Verified:GitHub

analyzing-windows-registry-for-artifacts

Extracts Windows registry artifacts from SAM, SYSTEM, SOFTWARE, NTUSER.DAT, and UsrClass.dat hives.

Updated Aug 23, 2026

Search Tags:#registry #forensics #artifact-analysis #windows-registry #userassist #regipy #regripper

One-click install

npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill analyzing-windows-registry-for-artifacts

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: analyzing-windows-registry-for-artifacts
Source: https://github.com/Axxxxxxaaann/KAIRI-Skills/tree/main/skills/analyzing-windows-registry-for-artifacts
Command: npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill analyzing-windows-registry-for-artifacts

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires regipy, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Windows Registry data stores user activity, software installation, and persistence evidence. This skill provides structured extraction and analysis of multiple hives (SAM, SYSTEM, SOFTWARE, NTUSER.DAT, UsrClass.dat) to reconstruct activity timelines and system state for incident response and investigations.

Core Features & Use Cases

Automated extraction of registry artifacts using RegRipper, Registry Explorer, and python-registry.
Analysis of autorun, UserAssist, RecentDocs, typed URLs/paths, and installed software to build event timelines.
Supports cross-hive correlation (registry hives + USB history + network info) for malware and insider-threat investigations.

Quick Start

Mount the target registry hives and run the agent to generate a structured JSON report.

Frequently Asked Questions about analyzing-windows-registry-for-artifacts

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I extract UserAssist and autorun entries from Windows Registry hives for forensics?▼

Analyze Windows Registry artifacts by extracting UserAssist, RecentDocs, and autorun entries from SAM, SYSTEM, SOFTWARE, NTUSER.DAT, and UsrClass.dat hives to reconstruct user activity and system state.

What Windows Registry artifacts can I use to reconstruct user activity during incident response?▼

Reconstruct user activity during incident response by analyzing Registry artifacts including UserAssist data, recent documents, typed URLs, installed software, USB history, and network configuration from multiple hives.

Do I need RegRipper and python-registry installed to analyze Windows Registry hives?▼

Yes, structured extraction of Registry artifacts requires RegRipper, Registry Explorer, python-registry, and RECmd tooling to parse SAM, SYSTEM, SOFTWARE, NTUSER.DAT, and UsrClass.dat hives and generate artifact-rich reports.

Can I correlate USB history and network configuration across different Registry hives for malware analysis?▼

Yes, cross-hive correlation of USB history, network configuration, autorun entries, and installed software from Registry hives supports malware analysis and insider-threat investigations by reconstructing system state.

What is the best way to parse NTUSER.DAT and UsrClass.dat hives for digital forensics?▼

Parse NTUSER.DAT and UsrClass.dat hives by mounting target files and running automated extraction with RegRipper, Registry Explorer, or python-registry to generate structured JSON reports of Registry artifacts.

What limitations exist when extracting Registry artifacts from UsrClass.dat and SAM hives?▼

Extraction of Registry artifacts from SAM, SYSTEM, SOFTWARE, NTUSER.DAT, and UsrClass.dat hives requires proper mounting and tool dependencies; corrupted hives or missing tools will limit artifact-rich report generation.

Related Skills

Explore More Data & Analytics Skills→

registry-forensics

Parse Windows Registry hives to extract artifacts and generate timelines.

forensic-reporting

Generate formal forensic reports from investigation findings and evidence.

mlflow

Track ML experiments, manage model versions, and deploy pipelines with MLflow.

analyzing-windows-lnk-files-for-artifacts

Extract forensic artifacts from Windows LNK shortcut files.