📂 02 - D3FEND Windows Registry
Overview
Registry hives (NTUSER.DAT, UsrClass.dat, SYSTEM, SOFTWARE…) and their transaction logs. Analysis recovers user and system activity recorded in keys and values — shellbags, RecentDocs, UserAssist, Run keys and similar.
D3FEND artifact: Windows Registry
🧠 Techniques
| File | Created |
|---|
📦 Tech Stack
| File | Created |
|---|
🛠️ Tools
| File | Created |
|---|
🚩 Related CTF Operations
| File | difficulty |
|---|---|
| HTB Sherlock - Baggage | Very Easy |