Autopsy-Registry-Explorer
Autopsy Module to analyze Registry Hives based on bookmarks provided by EricZimmerman for his tool RegistryExplorer
Specification
- Tested Autopsy version: 4.19.3
- OS's supported on: Windows
- License: GNU General Public License Version 3
Features
- Analyse Registry hives based on bookmarks provided by EricZimmerman
- Ability to analyze registry hives independently without the need to load a full disk image
- Categorize Keys according to their usage
Screenshot
Installation
git clone https://github.com/0xMohammed/Autopsy-Registry-Explorer.git
copy Module folder to 'C:\Users\{Username}\AppData\Roaming\autopsy\python_modules'
TO-DO
- Add Transaction logs analysis
Refrences
Autopsy discussion group
Sleuthkit API Reference
Python Registry Parser