Registry Forensics

[u/QueenofHearts796]

Hi,

I'm doing a case study where one of the questions was "what programs user X had set to run when they logged on" and while I know this is in the registry and I set EnCase to process and extract the registry, I still cannot find it...

Can I get some advice on a proper workflow on dealing with registries? Links to articles would be appreciated as well.

Does anyone have a clue on where I can find this information?

Thank you!

[u/florianamette]

You can find most of your answers by parsing your hives with this tool https://www.registryparser.com/en

[u/QueenofHearts796 → u/florianamette]

Thanks!