# Where can I check for Regestry files in autopsy? **URL:** \ **Category:** Autopsy Online Training\ **Created:** [April 19, 2020, 12:00pm UTC](https://sleuthkit.discourse.group/t/where-can-i-check-for-regestry-files-in-autopsy/1045 "2020-04-19T12:00:10Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![The\_Hacksmith](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/the_hacksmith/32/571_2.png) [@The\_Hacksmith](https://sleuthkit.discourse.group/u/The_Hacksmith)\ **Post date:** [April 19, 2020, 12:00pm UTC](https://sleuthkit.discourse.group/t/where-can-i-check-for-regestry-files-in-autopsy/1045/1 "2020-04-19T12:00:10Z")
If a mischief administrator has turned off a server using putty (SSH) and post which he/she deleted the putty. Forensics needs to be performed for the same admin system image. How come an investigator will come to know about putty. Its ok if investigator came to know via deleted files. Now How he can make sure that Putty was ran against that server and post which which all activities have been performed using putty. NOTE: Putty was not installed and it was run portably. ---
**Author:** ![Tic-Tac](https://avatars.discourse-cdn.com/v4/letter/t/977dab/32.png) [@Tic-Tac](https://sleuthkit.discourse.group/u/Tic-Tac)\ **Post date:** [April 20, 2020, 3:46pm UTC](https://sleuthkit.discourse.group/t/where-can-i-check-for-regestry-files-in-autopsy/1045/2 "2020-04-20T15:46:28Z")
If it was Linux, I would check bash history first. Is there such a thing as cmd or powershell history on Win? If an app was run portably there is a chance that a shellbag was generated. Check UsrClass.dat with Zimmermans Shellbag explorer. ---
**Author:** ![The\_Hacksmith](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/the_hacksmith/32/571_2.png) [@The\_Hacksmith](https://sleuthkit.discourse.group/u/The_Hacksmith)\ **Post date:** [April 20, 2020, 4:01pm UTC](https://sleuthkit.discourse.group/t/where-can-i-check-for-regestry-files-in-autopsy/1045/3 "2020-04-20T16:01:55Z")
Hey, Thanks buddy for the help will definitly check it out and revert you with POCs. Regards, Abhishek Sharma, Mob: +91-9458406845 [abhigyan17@gmail.com](mailto:abhigyan17@gmail.com)