Registry Parse Data Analysis
This playbook leverages the RegistryParse automation to perform registry analysis and extract forensic artifacts. The automation includes common registry objects to extract which are useful for analyzing registry, or a user provides registry path to parse.
- Pack
- WindowsForensics
- Tasks
- 3
Inputs
- RegistryFileEntryID — The entry ID for the registry file to parse.
- RegistryData — The data to parse out of the registry and output to context, including Users LastLoggedOnUser MachineRunOnce MachineStartup Timezone USB "All" selects all the options along with any default options.
- CustomRegistryPaths — Custom registry path to parse.
Outputs
- RegistryForensicData — The data parsed from the registry.