corpus.blog
Claim your blog
Record · corpus.blog/posts/01a0c518-88d0-7030-8c3e-75f00c01f81e

Exporting registry hives from a live system

dfir.ru · published 3 October 2020

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at dfir.ru Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
External links
11
Words captured
1,435

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
http://windowsir.blogspot.com/2019/11/activitescachedb-vs-ntuserdat.html
windowsir.blogspot.com
https://blog.rapid7.com/2012/01/16/adventures-in-the-windows-nt-registry-a-step-into-the-world-of-forensics-and-ig/
blog.rapid7.com
https://docs.microsoft.com/en-us/windows/win32/api/winreg/nf-winreg-regloadappkeya
docs.microsoft.com
https://docs.microsoft.com/en-us/windows/win32/api/winreg/nf-winreg-regsavekeyexa
docs.microsoft.com
https://docs.microsoft.com/en-us/windows/win32/api/winreg/nf-winreg-regsavekeya
docs.microsoft.com
https://github.com/msuhanov/regf/blob/master/Windows%20registry%20file%20format%20specification.md
github.com
https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-domain-controller-hashes-via-wmic-and-shadow-copy-using-vssadmin
ired.team
https://docs.microsoft.com/en-us/windows/win32/vss/shadow-copies-and-shadow-copy-sets
docs.microsoft.com
https://github.com/msuhanov/regf-samples/blob/master/8.1-unreconciled/Flush%20strategies%20in%20the%20Windows%20registry.md
github.com
https://accessdata.com/product-download/ftk-imager-lite-version-3-1-1
accessdata.com
https://github.com/jschicht/RawCopy
github.com
Elsewhere on dfir.ru (3)