Tuesday, March 15, 2016

Registry Recon

Arsenal Recon has developed a registry parser on steroids. Registry Recon is a program that resurrects the full registry, rather then a parser that pieces the registry together.  This makes it much easier for analysts to find any data that someone may have been trying to hide. The cost is steep at $599. But for that you do get tool that some consider the gold standard for registry forensics.

https://arsenalrecon.com/apps/recon/

Use Key History to view a key's values at a particular time

No comments:

Post a Comment