User Profiling Using the Windows Registry
In this chapter, we will be using the knowledge of the Windows Registry from the previous chapter to profile user activity.
As forensic examiners, we face cases in which we need to investigate user activity and profile it based on available evidence. In this chapter, we will learn more about initiating investigations and gathering information related to users by diving into the Windows Registry.
We will cover the following main topics in this chapter:
- Profiling system details
- Profiling user activities
We will conclude the chapter with a short section of exercises.