|
2 | 2 |
|
3 | 3 | > Advanced Windows Registry forensics reference and search engine
|
4 | 4 |
|
5 |
| -RegSeek is a comprehensive reference tool for Windows Registry forensics artifacts. It provides detailed information about registry locations that are valuable for digital forensics investigations, incident response, and malware analysis. |
6 |
| - |
7 |
| -# Features |
8 |
| - |
9 |
| -- Extensive collection of Windows Registry forensics artifacts |
10 |
| -- Multi-criteria search with filters for category, criticality, investigation type, and more |
11 |
| -- Filter by Windows version, registry hive, criticality level, and analysis tools |
12 |
| -- Each artifact includes forensic value, data structure, examples, and analysis tools |
13 |
| -- Artifacts tagged by investigation scenarios (malware analysis, data exfiltration, etc.) |
14 |
| - |
15 |
| -# Categories |
16 |
| - |
17 |
| -- **Execution**: Program execution tracking and artifacts |
18 |
| -- **Network**: Network connections, shares, and communication |
19 |
| -- **Persistence**: Autostart locations and persistence mechanisms |
20 |
| -- **User Activity**: User behavior and document access patterns |
21 |
| -- **System**: System configuration and installed software |
22 |
| -- **USB/Storage**: USB device history and storage artifacts |
23 |
| -- **Security**: Security settings and access controls |
24 |
| -- **Browser**: Web browser artifacts and configurations |
25 |
| -- **Malware**: Malware-specific registry artifacts |
26 |
| -- **Communication**: Messaging and communication applications |
27 |
| - |
28 |
| -# Advanced Search |
29 |
| - |
30 |
| -- **Category**: Filter by artifact category |
31 |
| -- **Criticality**: High/Medium/Low priority filtering |
32 |
| -- **Investigation Type**: Filter by investigation scenario |
33 |
| -- **Windows Version**: Version-specific artifacts |
34 |
| -- **Registry Hive**: HKLM, HKCU, HKCR, etc. |
35 |
| -- **Analysis Tools**: Artifacts with or without tools |
36 |
| - |
37 |
| -# Quick Start |
| 5 | +## What is RegSeek? |
| 6 | + |
| 7 | +RegSeek is a comprehensive reference tool for Windows Registry forensics artifacts. It provides detailed information about registry locations that are valuable for digital forensics investigations, incident response, and malware analysis including: |
| 8 | + |
| 9 | +- **Forensic limitations** and what artifacts **cannot prove** |
| 10 | +- **Correlation requirements** for definitive conclusions |
| 11 | +- **Analysis tools** and investigation techniques |
| 12 | +- **Real-world examples** and data structures |
| 13 | +- **Windows version compatibility** |
| 14 | + |
| 15 | +## Artifact Categories |
| 16 | + |
| 17 | +| Category | Count | Key Use Cases | |
| 18 | +|----------|-------|---------------| |
| 19 | +| **Program Execution** | 15+ | Application usage, malware execution tracking | |
| 20 | +| **Browser Activity** | 8+ | Web browsing history, security zone configurations | |
| 21 | +| **User Behavior** | 20+ | Application usage patterns, cloud storage sync | |
| 22 | +| **File Operations** | 12+ | Recent documents, file associations, jump lists | |
| 23 | +| **External Storage** | 5+ | USB device history, removable media tracking | |
| 24 | +| **Persistence Methods** | 10+ | Autostart locations, service configurations | |
| 25 | +| **System Modifications** | 15+ | Windows settings, security configurations | |
| 26 | +| **Network Infrastructure** | 12+ | Network connections, DNS configurations | |
| 27 | +| **Remote Access** | 8+ | RDP settings, VPN configurations | |
| 28 | +| **Security Monitoring** | 10+ | Windows Defender, audit configurations | |
| 29 | +| **Communication Apps** | 7+ | Teams, Discord, email client settings | |
| 30 | +| **Virtualization** | 6+ | VMware, VirtualBox, container settings | |
| 31 | +| **Authentication** | 4+ | Credential providers, account information | |
| 32 | + |
| 33 | +## Key Features |
| 34 | + |
| 35 | +### **Advanced Search & Filtering** |
| 36 | +- Full-text search across artifact titles, descriptions, and registry paths |
| 37 | +- Filter by category, criticality level, Windows version, and registry hive |
| 38 | +- Investigation type filtering (incident response, malware analysis, etc.) |
| 39 | + |
| 40 | +### **Forensic Intelligence** |
| 41 | +- **Limitations warnings**: What each artifact CANNOT prove |
| 42 | +- **Correlation requirements**: Additional artifacts needed for conclusions |
| 43 | +- **Criticality levels**: High/Medium/Low priority classifications |
| 44 | +- **Tool recommendations**: Specific analysis tools for each artifact |
| 45 | + |
| 46 | +### **Investigation-Focused** |
| 47 | +- Organized by forensic investigation types |
| 48 | +- Real-world examples and data structures |
| 49 | +- Windows version compatibility information |
| 50 | +- Direct links to analysis tools and references |
| 51 | + |
| 52 | + |
| 53 | +## Quick Start |
38 | 54 |
|
39 | 55 | ### Using the Web Interface
|
40 | 56 |
|
@@ -74,10 +90,17 @@ Visit the deployed site: [https://regseek.github.io/](https://regseek.github.io/
|
74 | 90 | start site/index.html # Windows
|
75 | 91 | ```
|
76 | 92 |
|
77 |
| -# Contributing |
| 93 | +## Contributing |
| 94 | + |
| 95 | +We welcome contributions from the digital forensics community! See our [Contributing Guidelines](CONTRIBUTING.md) for details on: |
| 96 | + |
| 97 | +- Adding new registry artifacts |
| 98 | +- Improving existing documentation |
| 99 | +- Suggesting new features or categories |
| 100 | +- Reporting bugs or inaccuracies |
78 | 101 |
|
79 |
| -We welcome contributions! Please see our [Contributing Guide](CONTRIBUTING.md) for details. |
| 102 | +## License |
80 | 103 |
|
81 |
| -# License |
| 104 | +This project is licensed under GPL-3.0 license - see [LICENSE](LICENSE) file for details. |
82 | 105 |
|
83 |
| -GPL-3.0 license - see [LICENSE](LICENSE) file for details. |
| 106 | +*RegSeek is a comprehensive Windows Registry forensics reference tool designed to assist digital forensics professionals, incident response teams, and cybersecurity analysts in their investigations.* |
0 commit comments