skills.rest
SherifEldeeb
SherifEldeebCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

registry-forensics

Parse Windows Registry hives to extract artifacts and generate timelines.

5|Updated Jan 12, 2026
Search Tags:#timeline#registry#malware#windows#forensics#hives
One-click install
npx skills add https://github.com/SherifEldeeb/agentskills --skill registry-forensics
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: registry-forensics
Source: https://github.com/SherifEldeeb/agentskills/tree/main/skills/forensics/registry-forensics
Command: npx skills add https://github.com/SherifEldeeb/agentskills --skill registry-forensics

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps investigators quickly identify user activity, persistence mechanisms, and malware indicators by analyzing Windows registry hives offline.

Core Features & Use Cases

  • Registry Hive Parsing: Parse SAM, SYSTEM, SOFTWARE, NTUSER.DAT, USRCLASS.DAT to extract keys and values.
  • Persistence & Activity: Detect autoruns, services, UserAssist, and Shimcache patterns to map attacker moves.
  • Timeline & Reporting: Generate activity timelines and comprehensive reports from collected hives for incident response.

Quick Start

Use the registry-forensics skill to load a directory containing registry hives (e.g., NTUSER.DAT, SAM, SYSTEM, SOFTWARE) and run the provided examples to extract artifacts and generate a report.

Frequently Asked Questions about registry-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze Windows Registry hives offline for malware indicators?▼

Offline Windows Registry analysis parses hives like SAM, SYSTEM, SOFTWARE, and NTUSER.DAT to extract keys and values, detecting autoruns, services, UserAssist, and Shimcache patterns to uncover malware persistence mechanisms.

What artifacts can I extract from NTUSER.DAT and USRCLASS.DAT for user activity forensics?▼

NTUSER.DAT and USRCLASS.DAT parsing extracts UserAssist entries and shellbag artifacts, mapping user activity and attacker moves through recently executed programs and accessed folders during forensic investigations.

Can I generate an activity timeline from multiple Windows Registry hives?▼

Yes, Windows Registry forensics correlates events across SAM, SYSTEM, SOFTWARE, and NTUSER.DAT hives to generate activity timelines, mapping persistence mechanisms and user actions for incident response reporting.

Does offline registry analysis work with extracted hive files or do I need a live Windows system?▼

Offline registry analysis operates on extracted hive files from disk images, requiring no live Windows system. It parses SAM, SYSTEM, SOFTWARE, and NTUSER.DAT directly to uncover persistence and malware indicators.

What's the best way to detect persistence mechanisms in Windows Registry hives?▼

Detecting persistence in Windows Registry hives involves analyzing autoruns, services, and Shimcache entries. Parsing SYSTEM and SOFTWARE hives reveals installed services and auto-start locations used by attackers.

Why parse the SAM hive during a Windows forensic investigation?▼

Parsing the SAM hive during Windows forensics extracts user account information and password hashes. Combined with SYSTEM hive analysis, it maps user activity and persistence indicators for incident response.

Related Skills

Explore More Education & Research Skills→
maigenticmaigentic
37

market-opportunity-analyzer

Estimate TAM, SAM, and SOM with competitive landscape analysis.

Community
Advanced
refractionPOINTrefractionPOINT
29

velociraptor

Launch Velociraptor forensic collections on endpoints via LimaCharlie API.

Official
Advanced
rjonhaasrjonhaas
1

File System & Carving (The Sleuth Kit / EWF Tools)

Verify, mount read-only, enumerate filesystems, and carve artifacts from E01/EWF images with Sleuth Kit and EWF tools.

Community
Intermediate
sungaoxiang-backendsungaoxiang-backend

evidence-household-handler

Extract household registry image data into structured card_features slots.

Community
Advanced