University lab / 2026
Windows Registry investigation
Examining Windows Registry artefacts from a forensic image in a university lab.
Disk imageRead-only evidence
FTK ImagerHive extraction
RegRipperArtefact analysis
Case notesRecord findings
University exercise; no original evidence or personal data published.
The investigation
In a university forensics lab, I extracted Registry hives from a supplied disk image and used them to investigate system configuration.
What I examined
- Used FTK Imager to access the supplied forensic image and extract SYSTEM, SOFTWARE, SAM and SECURITY hives.
- Ran appropriate RegRipper plugins to inspect Registry artefacts and system information.
- Checked system details and the time-zone configuration in the SYSTEM hive, including a Mountain Standard Time entry.
What the artefacts told me
The time-zone entry tells me how the system was configured. It does not, by itself, prove where someone was. That distinction matters when writing up findings.
ABOUT THE EXAMPLES SHOWN
Based on a controlled teaching exercise. The visual shown is an illustration, not an exported forensic exhibit.