Some interesting scripts, probably outdated but still useful. In 2012 Jacky Fox, on her MSc dissertation focused on to extraction and correlation of Windows registry artifacts. During her research she realised a set of bash script for forensic interpretation of Windows registry keys, including UserAssist and the keys related to USB devices. A useful starting…
Article Link: https://andreafortuna.org/dfir/some-useful-scripts-for-extraction-and-correlation-of-forensic-artifacts-in-windows-registry/