# DataSourceingestmodule get certain registries

**URL:** <https://sleuthkit.discourse.group/t/datasourceingestmodule-get-certain-registries/2201>\
**Category:** Autopsy Development\
**Created:** [October 6, 2020, 12:52pm UTC](https://sleuthkit.discourse.group/t/datasourceingestmodule-get-certain-registries/2201 "2020-10-06T12:52:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![lebronjames06](https://avatars.discourse-cdn.com/v4/letter/l/3be4f8/32.png) [@lebronjames06](https://sleuthkit.discourse.group/u/lebronjames06)\
**Post date:** [October 6, 2020, 12:52pm UTC](https://sleuthkit.discourse.group/t/datasourceingestmodule-get-certain-registries/2201/1 "2020-10-06T12:52:59Z")

</div>

Hi,

How can I search for registry keys ? And return them in results view?  
The keys or subkeys are in below format. How can I search for registries?

HKEY\_ CURRENT\_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU

HKEY\_LOCAL\_ MACHINE\SOFTWARE\Microsoft\WindoWs\CurrentVersion(AppPaths)

HKEY\_USERS\SID\Software\SpeedBit\Download Accelerator

Flags/REG\_DWORD/(media type)

PackageFamilyName/REG\_SZ/microsoft.windowsphotos\_8wekyb3d8bbwe

---

<div class="post-metadata">

**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\
**Post date:** [October 6, 2020, 1:50pm UTC](https://sleuthkit.discourse.group/t/datasourceingestmodule-get-certain-registries/2201/2 "2020-10-06T13:50:53Z")

</div>

It depends on how you want to search for them. One spot to look is the regripper reports to see if regripper has already parsed it out but it was not brought into Autopsy as extracted content, Regripper is run as part of Recent Activity ingest. If you want to use a python module to do it you can look at [https://github.com/markmckinnon/Autopsy-Plugins/tree/master/Bam\_Key](https://github.com/markmckinnon/Autopsy-Plugins/tree/master/Bam_Key) to see how that will process registry keys. If you want to manually do it then use the application viewer for registry files which should show up when you highlight a registry file (may have to run file id ingest first, I do not remember).