Autopsy-Registry-Explorer

Autopsy Module to analyze Registry Hives based on bookmarks provided by EricZimmerman for his tool RegistryExplorer

Specification

  • Tested Autopsy version: 4.19.3
  • OS’s supported on: Windows
  • License: GNU General Public License Version 3

Features

  1. Analyse Registry hives based on bookmarks provided by EricZimmerman
  2. Ability to analyze registry hives independently without the need to load a full disk image
  3. Categorize Keys according to their usage

Screenshot

Alt Text

Installation

  1. git clone https://github.com/0xMohammed/Autopsy-Registry-Explorer.git
  2. copy Module folder to 'C:\Users\{Username}\AppData\Roaming\autopsy\python_modules'

TO-DO

  1. Add Transaction logs analysis

Refrences

Autopsy discussion group
Sleuthkit API Reference
Python Registry Parser

GitHub

View Github