Registry Analysis

---

Registry analysis from memory allows interrogation of registry keys and values as they existed at the time of image capture — including keys that may have been deleted before imaging, or values held only in memory that differ from the on-disk hive.

---

Hive Enumeration

hivelist — List Loaded Registry Hives

Lists all registry hives loaded in memory with their virtual and physical addresses, and their mapped file paths. First step before any registry key interrogation.

vol.py -f <image> --profile=<profile> hivelist

Vol3 Equivalent

vol3 -f <image> windows.registry.hivelist

Common hives and their significance:

Hive Path	Contents
\REGISTRY\MACHINE\SYSTEM	Services, drivers, boot configuration
\REGISTRY\MACHINE\SOFTWARE	Installed software, run keys, shimcache
\REGISTRY\MACHINE\SAM	Local user accounts and password hashes
\REGISTRY\MACHINE\SECURITY	LSA secrets, cached domain credentials
\...\NTUSER.DAT	Per-user settings, userassist, MRU lists
\...\UsrClass.dat	Per-user COM settings, shellbags

---

Key and Value Reading

printkey — Read a Registry Key and Its Values

Reads the contents of a specific registry key from memory. Requires the virtual offset of the hive from hivelist.

# Using hive virtual offset
vol.py -f <image> --profile=<profile> printkey \
    -o <hive_virtual_offset> -K "<key_path>"

# Example — read the Run key for persistence
vol.py -f <image> --profile=<profile> printkey \
    -o 0xe1035b60 -K "Microsoft\Windows\CurrentVersion\Run"

Vol3 Equivalent

vol3 -f <image> windows.registry.printkey \
    --offset <hive_virtual_offset> --key "Microsoft\Windows\CurrentVersion\Run"

# Without offset — searches all hives
vol3 -f <image> windows.registry.printkey \
    --key "Microsoft\Windows\CurrentVersion\Run"

---

Persistence Locations

Key registry locations commonly abused for persistence. Run printkey against each for a quick persistence sweep:

# SOFTWARE hive — system-wide run keys
vol.py -f <image> --profile=<profile> printkey -o <SOFTWARE_offset> \
    -K "Microsoft\Windows\CurrentVersion\Run"

vol.py -f <image> --profile=<profile> printkey -o <SOFTWARE_offset> \
    -K "Microsoft\Windows\CurrentVersion\RunOnce"

# SYSTEM hive — services
vol.py -f <image> --profile=<profile> printkey -o <SYSTEM_offset> \
    -K "ControlSet001\Services"

# NTUSER.DAT — per-user run keys
vol.py -f <image> --profile=<profile> printkey -o <NTUSER_offset> \
    -K "Software\Microsoft\Windows\CurrentVersion\Run"

# Winlogon for credential provider abuse
vol.py -f <image> --profile=<profile> printkey -o <SOFTWARE_offset> \
    -K "Microsoft\Windows NT\CurrentVersion\Winlogon"

# AppInit_DLLs — DLL injection via registry
vol.py -f <image> --profile=<profile> printkey -o <SOFTWARE_offset> \
    -K "Microsoft\Windows NT\CurrentVersion\Windows"

---

User Activity Artifacts

userassist — GUI Program Execution History

Parses the UserAssist registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist) which records GUI program execution counts and last execution times. Values are ROT-13 encoded.

vol.py -f <image> --profile=<profile> userassist

Vol3 Equivalent

No direct Vol3 equivalent. Extract the NTUSER.DAT hive (see Data Carving — Registry Hive Carving) and parse with regipy or Registry Explorer:

# Using regipy after extracting NTUSER.DAT
regipy-parse --hive /output/NTUSER.DAT --plugin userassist

---

shimcache — Application Compatibility Cache

Parses the shimcache (Application Compatibility Cache) from the SYSTEM hive. Records programs that have been executed or exist on disk — useful for establishing execution history even after the file is deleted. Located at SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache.

vol.py -f <image> --profile=<profile> shimcache

Vol3 Equivalent

vol3 -f <image> windows.shimcachemem.ShimCacheMem

Note: Vol3's shimcache plugin reads from memory rather than the hive and may produce different results. For comprehensive shimcache analysis, extract and parse the SYSTEM hive offline with AppCompatCacheParser:

AppCompatCacheParser.exe -f SYSTEM --csv /output/ --csvf shimcache.csv

---

shellbags — Folder Access History (Vol2 Only)

Parses shellbags from the UsrClass.dat hive — records folders the user has accessed via Windows Explorer, including network shares, removable media, and recently deleted folders.

vol.py -f <image> --profile=<profile> shellbags

Vol3 Only

shellbags is a Vol2-only plugin. For Vol3, extract the UsrClass.dat hive from memory (see Data Carving — Registry Hive Carving) and parse with ShellBagsExplorer or SBECmd:

SBECmd.exe -d /output/ --csv /output/shellbags/

---

Registry Search

dumpregistry — Dump Entire Hive for Offline Analysis

When you need to perform deep analysis of a registry hive beyond what individual printkey queries can provide, dump the entire hive and analyze it with dedicated registry tools.

vol.py -f <image> --profile=<profile> hivelist
vol.py -f <image> --profile=<profile> dumpregistry -o <hive_virtual_offset> -D <output_dir>

Then analyze the extracted .hiv file with:

• Registry Explorer (Windows GUI) — Eric Zimmerman
• regipy (Python) — regipy-parse --hive <hive.hiv>
• python-registry — programmatic access

Vol3 Equivalent

vol3 -f <image> windows.registry.hivelist --dump

---