skills.rest
mgreen27
mgreen27COMMUNITY
Explore all skills by this author →
Website𝕏@mgreen27GitHub

windows-registry-analysis

Retrieve Windows registry information from disk images via Velociraptor.

Updated Aug 27, 2026
Search Tags:#investigation#registry#Windows#artifact#forensics#Velociraptor
One-click install
npx skills add https://github.com/mgreen27/dfir-skills --skill windows-registry-analysis
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: windows-registry-analysis
Source: https://github.com/mgreen27/dfir-skills/tree/main/skills/windows-registry-analysis
Command: npx skills add https://github.com/mgreen27/dfir-skills --skill windows-registry-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill enables comprehensive small-to-large scale registry triage on Windows images by executing Velociraptor's Registry.Hunter artifact, streamlining the process of forensic analysis.

Core Features & Use Cases

  • Broad Registry Triage: Run Velociraptor's Registry.Hunter with specific parameters to target multiple registry categories efficiently.
  • Targeted Investigations: Split collection waves by registry category to focus on relevant areas like installed software, user accounts, or system info.
  • Use Case: For incident response, quickly gather registry data from remote systems to identify anomalies such as unauthorized software or suspicious user accounts.

Quick Start

Confirm the Velociraptor server is set up locally, verify the target system is online, then run Registry.Hunter with RemappingStrategy set to None to obtain registry details.

Frequently Asked Questions about windows-registry-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze Windows Registry data from disk images for forensic investigations?▼

Analyze Windows Registry data from disk images by executing Velociraptor's Registry.Hunter artifact to retrieve detailed registry views for forensic investigation and incident response triage.

What is the best way to triage Windows registry artifacts across multiple categories?▼

Triage Windows registry artifacts by splitting collection waves by registry category, targeting relevant areas like installed software, user accounts, or system info to focus your investigation efficiently.

Do I need to remap registry views externally before running Registry.Hunter?▼

Yes, this Skill requires registry views to be remapped externally. You must run Registry.Hunter with RemappingStrategy set to None to retrieve detailed registry information from target disk images.

Can I use Velociraptor for large scale registry triage on remote Windows systems?▼

Yes, Velociraptor supports comprehensive small-to-large scale registry triage on Windows images, allowing you to quickly gather registry data from remote systems to identify anomalies like unauthorized software or suspicious user accounts.

What limitations exist when fetching registry analysis results scopes from Velociraptor?▼

This Skill requires executing Registry.Hunter with specific category sets and fetching results scopes. You must ensure the Velociraptor server is set up locally and the target system is online before collection.

Related Skills

Explore More Software Engineering Skills→
zenobi-uszenobi-us
68

incident-responder

Coordinate incident response for security breaches and operational incidents.

Official
Advanced
p-o-ke-naep-o-ke-nae

memory-forensics

Analyze memory dumps to extract forensic artifacts and identify suspicious activity.

Community
Advanced
refractionPOINTrefractionPOINT
29

velociraptor

Launch Velociraptor forensic collections on endpoints via LimaCharlie API.

Official
Advanced
SherifEldeebSherifEldeeb
5

registry-forensics

Parse Windows Registry hives to extract artifacts and generate timelines.

Community
Advanced