<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Analyzing Windows Registry

## RegRipper

```bash
# Parse SAM hive
regripper -r SAM -f sam

# Parse SYSTEM hive
regripper -r SYSTEM -f system

# Parse SOFTWARE hive
regripper -r SOFTWARE -f software

# Parse NTUSER.DAT
regripper -r NTUSER.DAT -f ntuser

# Run specific plugin
rip.pl -r SAM -p samparse
rip.pl -r SYSTEM -p usbstor
rip.pl -r NTUSER.DAT -p userassist
rip.pl -r SOFTWARE -p networklist
```

| Plugin | Hive | Description |
|--------|------|-------------|
| `samparse` | SAM | User account details |
| `usbstor` | SYSTEM | USB device history |
| `userassist` | NTUSER.DAT | Program execution (ROT13) |
| `appcompatcache` | SYSTEM | ShimCache entries |
| `networklist` | SOFTWARE | Network connection history |
| `run` | SOFTWARE/NTUSER | Autorun entries |
| `services` | SYSTEM | Installed services |
| `shutdown` | SYSTEM | Last shutdown time |
| `compname` | SYSTEM | Computer name |
| `timezone` | SYSTEM | System timezone |

## python-registry

```python
from Registry import Registry

reg = Registry.Registry("NTUSER.DAT")

# Open a key
key = reg.open("Software\\Microsoft\\Windows\\CurrentVersion\\Run")

# Iterate values
for value in key.values():
    print(f"{value.name()} = {value.value()}")

# Key timestamp
print(f"Last write: {key.timestamp()}")

# Iterate subkeys
for subkey in key.subkeys():
    print(f"Subkey: {subkey.name()} (modified: {subkey.timestamp()})")
```

## Registry Explorer (Eric Zimmerman)

```bash
# GUI — load hive and browse
RegistryExplorer.exe

# RECmd — command line
RECmd.exe -f NTUSER.DAT --kn "Software\Microsoft\Windows\CurrentVersion\Run"
RECmd.exe -f SYSTEM --bn BatchExamples\BasicSystemInfo.reb --csv .
```

## Key Forensic Registry Paths

### Persistence (T1547.001)
```
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\SYSTEM\CurrentControlSet\Services
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
```

### Execution Evidence
```
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache
SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Amcache
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
```

### USB Devices
```
SYSTEM\CurrentControlSet\Enum\USBSTOR   — Device class and serial
SYSTEM\CurrentControlSet\Enum\USB        — Vendor/Product IDs
SYSTEM\MountedDevices                    — Drive letter mapping
SOFTWARE\Microsoft\Windows Portable Devices\Devices  — Friendly names
```

### Network
```
SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles
SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Unmanaged
```
