registry_key
Read Windows registry hives to inspect a key's values, last-write time, and subkeys up to depth 4 for forensic analysis.
Instructions
Read a Windows registry hive (SYSTEM, SOFTWARE, SAM, NTUSER.DAT, UsrClass.dat, Amcache.hve): a key's values, last-write time and subkeys to depth (max 4).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| key | No | ||
| ref | No | ||
| part | No | ||
| depth | No | ||
| image | No | ||
| local_path | No | ||
| max_values | No |