credog
asked on
Windows 7 Registry Viewing tools
I have to do some post incident analysis on a Windows 7 registry and I wanted to get some recommendations on some tools that would help be view the users registry HIVE. This is just some looking around so there is no chain of custody type of thing, just looking to try to see what changed (modified) in a given time frame and something I can read the values with. Looking for something free and easy to use to try to learn a few things before we wile the system. Any recommendations?
John
Free, easy to use and work is the Windows Registry Editor. That is probably what you should use (and what I use on those occasions I wish to look something up).
ASKER
I was looking for something that I could search for changes within a specified time frame. I don't want to have to export all the keys to txt to determine when they were modified.
Without a snapshot of before changes, not sure if there's a tool that helps.
Else, a popular one is Regshot, an open-source (LGPL) project hosted on SourceForge. See http://www.howtogeek.com/198679/how-to-use-regshot-to-monitor-your-registry/
Else, a popular one is Regshot, an open-source (LGPL) project hosted on SourceForge. See http://www.howtogeek.com/198679/how-to-use-regshot-to-monitor-your-registry/
That sounds like you could use the auditing feature. Registry branches have ACLs and we can audit changes which get logged to the security event log.
ASKER
I probably wasn't clear in my original question.
This is an after the fact look at the registry to determine what changed or was modified on a certain day/time. I've seen regfinder, regscanner, etc. and others out there, but haven't used any of them.
I was just asking if anyone has anything that they recommend. I just want a tool where I can search the registry for items that were modified within a certain time frame.
This is an after the fact look at the registry to determine what changed or was modified on a certain day/time. I've seen regfinder, regscanner, etc. and others out there, but haven't used any of them.
I was just asking if anyone has anything that they recommend. I just want a tool where I can search the registry for items that were modified within a certain time frame.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
I've requested that this question be deleted for the following reason:
Not enough information to confirm an answer.
Not enough information to confirm an answer.
Answer was given by multiple experts. Points should be spread evenly.