Skip to content

Commit cf4a294

Browse files
committed
Resolve merge conflicts by keeping local deletions
2 parents 33e16c1 + 35b3dd0 commit cf4a294

File tree

6 files changed

+1771
-518
lines changed

6 files changed

+1771
-518
lines changed

README.md

Lines changed: 60 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -2,39 +2,55 @@
22

33
> Advanced Windows Registry forensics reference and search engine
44
5-
RegSeek is a comprehensive reference tool for Windows Registry forensics artifacts. It provides detailed information about registry locations that are valuable for digital forensics investigations, incident response, and malware analysis.
6-
7-
# Features
8-
9-
- Extensive collection of Windows Registry forensics artifacts
10-
- Multi-criteria search with filters for category, criticality, investigation type, and more
11-
- Filter by Windows version, registry hive, criticality level, and analysis tools
12-
- Each artifact includes forensic value, data structure, examples, and analysis tools
13-
- Artifacts tagged by investigation scenarios (malware analysis, data exfiltration, etc.)
14-
15-
# Categories
16-
17-
- **Execution**: Program execution tracking and artifacts
18-
- **Network**: Network connections, shares, and communication
19-
- **Persistence**: Autostart locations and persistence mechanisms
20-
- **User Activity**: User behavior and document access patterns
21-
- **System**: System configuration and installed software
22-
- **USB/Storage**: USB device history and storage artifacts
23-
- **Security**: Security settings and access controls
24-
- **Browser**: Web browser artifacts and configurations
25-
- **Malware**: Malware-specific registry artifacts
26-
- **Communication**: Messaging and communication applications
27-
28-
# Advanced Search
29-
30-
- **Category**: Filter by artifact category
31-
- **Criticality**: High/Medium/Low priority filtering
32-
- **Investigation Type**: Filter by investigation scenario
33-
- **Windows Version**: Version-specific artifacts
34-
- **Registry Hive**: HKLM, HKCU, HKCR, etc.
35-
- **Analysis Tools**: Artifacts with or without tools
36-
37-
# Quick Start
5+
## What is RegSeek?
6+
7+
RegSeek is a comprehensive reference tool for Windows Registry forensics artifacts. It provides detailed information about registry locations that are valuable for digital forensics investigations, incident response, and malware analysis including:
8+
9+
- **Forensic limitations** and what artifacts **cannot prove**
10+
- **Correlation requirements** for definitive conclusions
11+
- **Analysis tools** and investigation techniques
12+
- **Real-world examples** and data structures
13+
- **Windows version compatibility**
14+
15+
## Artifact Categories
16+
17+
| Category | Count | Key Use Cases |
18+
|----------|-------|---------------|
19+
| **Program Execution** | 15+ | Application usage, malware execution tracking |
20+
| **Browser Activity** | 8+ | Web browsing history, security zone configurations |
21+
| **User Behavior** | 20+ | Application usage patterns, cloud storage sync |
22+
| **File Operations** | 12+ | Recent documents, file associations, jump lists |
23+
| **External Storage** | 5+ | USB device history, removable media tracking |
24+
| **Persistence Methods** | 10+ | Autostart locations, service configurations |
25+
| **System Modifications** | 15+ | Windows settings, security configurations |
26+
| **Network Infrastructure** | 12+ | Network connections, DNS configurations |
27+
| **Remote Access** | 8+ | RDP settings, VPN configurations |
28+
| **Security Monitoring** | 10+ | Windows Defender, audit configurations |
29+
| **Communication Apps** | 7+ | Teams, Discord, email client settings |
30+
| **Virtualization** | 6+ | VMware, VirtualBox, container settings |
31+
| **Authentication** | 4+ | Credential providers, account information |
32+
33+
## Key Features
34+
35+
### **Advanced Search & Filtering**
36+
- Full-text search across artifact titles, descriptions, and registry paths
37+
- Filter by category, criticality level, Windows version, and registry hive
38+
- Investigation type filtering (incident response, malware analysis, etc.)
39+
40+
### **Forensic Intelligence**
41+
- **Limitations warnings**: What each artifact CANNOT prove
42+
- **Correlation requirements**: Additional artifacts needed for conclusions
43+
- **Criticality levels**: High/Medium/Low priority classifications
44+
- **Tool recommendations**: Specific analysis tools for each artifact
45+
46+
### **Investigation-Focused**
47+
- Organized by forensic investigation types
48+
- Real-world examples and data structures
49+
- Windows version compatibility information
50+
- Direct links to analysis tools and references
51+
52+
53+
## Quick Start
3854

3955
### Using the Web Interface
4056

@@ -74,10 +90,17 @@ Visit the deployed site: [https://regseek.github.io/](https://regseek.github.io/
7490
start site/index.html # Windows
7591
```
7692

77-
# Contributing
93+
## Contributing
94+
95+
We welcome contributions from the digital forensics community! See our [Contributing Guidelines](CONTRIBUTING.md) for details on:
96+
97+
- Adding new registry artifacts
98+
- Improving existing documentation
99+
- Suggesting new features or categories
100+
- Reporting bugs or inaccuracies
78101

79-
We welcome contributions! Please see our [Contributing Guide](CONTRIBUTING.md) for details.
102+
## License
80103

81-
# License
104+
This project is licensed under GPL-3.0 license - see [LICENSE](LICENSE) file for details.
82105

83-
GPL-3.0 license - see [LICENSE](LICENSE) file for details.
106+
*RegSeek is a comprehensive Windows Registry forensics reference tool designed to assist digital forensics professionals, incident response teams, and cybersecurity analysts in their investigations.*

scripts/robots.txt

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
User-agent: *
2+
Allow: /
3+
4+
5+
# Block access to build files except the main artifacts.json
6+
User-agent: *
7+
Disallow: /build/
8+
Allow: /build/artifacts.json
9+
10+
# Allow CSS and JS files
11+
Allow: /css/
12+
Allow: /js/
13+
14+
# Block any temporary or development files
15+
Disallow: /*.tmp$
16+
Disallow: /*.bak$
17+
Disallow: /*~$
18+
Disallow: /node_modules/
19+
Disallow: /.git/
20+
Disallow: /.github/
21+

0 commit comments

Comments
 (0)