Technology and tools
What is Windows Registry?
Windows' central configuration database, which also records traces of user and program activity that forensic analysts rely on.
The Windows Registry is a hierarchical database that stores configuration for the operating system, programs and users. It is organised into hives such as SYSTEM, SOFTWARE, SAM and each user's NTUSER.DAT.
For attackers it is a place to hide persistence, for example in Run keys. For forensic analysts it is a record of activity: recently opened files, connected USB devices, programs executed and network connections, each with useful timestamps.