Is there a way to browse the registry using Autopsy?

I know Autopsy runs Regripper, but is there a way to browser through registry hives Autopsy?

If you browse to the registry hive, the Application tab will let you browse through the data.

Thanks @apriestman ! That was pretty simple. I’ve been clicking around in a hive but have not yet seen any regkey modification times though. Do you know if there is a way to see those?

Sorry I don’t know. @Mark_McKinnon might.

If you mean something like this:

image

No, it does not but it can. I can make a PR for this soon.

The PR for this is Add Registry Key Modification Time To Registry Content Viewer by markmckinnon · Pull Request #6961 · sleuthkit/autopsy (github.com) here is what it will look like:

image

1 Like

That’d be awesome @Mark_McKinnon!

FYI it unfortunately won’t show up until the release after next - it’s too late to include in our upcoming 4.19 release.