Is there a way to browse the registry using Autopsy?

Autopsy Help
1

I know Autopsy runs Regripper, but is there a way to browser through registry hives Autopsy?

2

If you browse to the registry hive, the Application tab will let you browse through the data.

content_viewer_registry
content_viewer_registry840×354 23.1 KB

3

Thanks @apriestman ! That was pretty simple. I’ve been clicking around in a hive but have not yet seen any regkey modification times though. Do you know if there is a way to see those?

4

Sorry I don’t know. @Mark_McKinnon might.

5

If you mean something like this:

image

No, it does not but it can. I can make a PR for this soon.

6

The PR for this is Add Registry Key Modification Time To Registry Content Viewer by markmckinnon · Pull Request #6961 · sleuthkit/autopsy (github.com) here is what it will look like:

image

1 Like
7

That’d be awesome @Mark_McKinnon!

8

FYI it unfortunately won’t show up until the release after next - it’s too late to include in our upcoming 4.19 release.