Intro to Windows Forensics: Windows Registry Artifacts - TryHackMe Walkthrough

TryHackMe recently released a room dedicated to Windows Forensics! We do a walkthrough of the TryHackMe WindowsForensics1 room and learn all about the Windows Registry in digital investigations. This room covers Windows Registry Hive locations, software tools used for investigation, Windows Registry artifacts, and their meanings.

Learn to analyze UserAssist, MRUs, ShellBags, external devices, and so much more.

Thank you to our Members and Patrons, but especially to our Investigators TheRantingGeek and Roman! Thank you so much!

Sign up for the room free here to follow along: https://tryhackme.com/room/windowsforensics1

00:00 TryHackMe WindowsForensics
00:19 Open TryHackMe Windows Forensics room
00:35 Introduction to Windows Forensics
02:34 Windows Registry and Forensics
06:31 Exploring Windows Registry
08:30 System Information and System Accounts
14:17 Usage or knowledge of files/folders
17:48 Evidence of Execution
20:56 External Devices/USB device forensics
24:42 Hands-on Challenge
32:08 Conclusion

I had a lot of fun with this room. I hope you did too! Let me know if you would like to see more digital forensic walkthroughs, and don't forget to subscribe!

https://bit.ly/2Ij9Ojc -