Re: [sleuthkit-users] Autopsy 3 - Registry Analysis

[Jason L. <jle...@ba...>]

The registry is analyzed during ingest for the Recent Activity results under Extracted Content (devices attached, installed programs, etc.).

In 3.0.7 (just released), raw RegRipper output is available in Extracted Content as well under Raw Tool Output.  We'd like to evolve the registry analysis, so any feedback logged in the Github issues would be really helpful - especially when comparing to other tools, or what you'd like to see that other tools aren't doing.

Jason 






------------------------------------------------

Jason Letourneau
Product Manager, Digital Forensics
Basis Technology
jle...@ba...
617-386-2000 ext. 152




On Sep 21, 2013, at 9:49 PM, Mitch Wander <mw...@gm...> wrote:

> Can someone please describe to me the Autopsy 3 capabailities when it comes to registry analysis?
>  
> For comparison purposes, I'm looking through the NIST Dell Hacking Case (that we have previously reviewed using other tools) and trying to analyze the same case using Autopsy 3.
>  
> Thanks.
>  
> Mitch
> ------------------------------------------------------------------------------
> LIMITED TIME SALE - Full Year of Microsoft Training For Just $49.99!
> 1,500+ hours of tutorials including VisualStudio 2012, Windows 8, SharePoint
> 2013, SQL 2012, MVC 4, more. BEST VALUE: New Multi-Library Power Pack includes
> Mobile, Cloud, Java, and UX Design. Lowest price ever! Ends 9/22/13. 
> http://pubads.g.doubleclick.net/gampad/clk?id=64545871&iu=/4140/ostg.clktrk_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org