I know Autopsy runs Regripper, but is there a way to browser through registry hives Autopsy?
Thanks @apriestman ! That was pretty simple. I’ve been clicking around in a hive but have not yet seen any regkey modification times though. Do you know if there is a way to see those?
Sorry I don’t know. @Mark_McKinnon might.
If you mean something like this:
No, it does not but it can. I can make a PR for this soon.
The PR for this is Add Registry Key Modification Time To Registry Content Viewer by markmckinnon · Pull Request #6961 · sleuthkit/autopsy (github.com) here is what it will look like:
That’d be awesome @Mark_McKinnon!
FYI it unfortunately won’t show up until the release after next - it’s too late to include in our upcoming 4.19 release.