Windows Forensics 1

Walkthrough summary

Windows Forensics 1 TryHackMe walkthrough with 27 answered prompts and lab methodology notes.

Sample prompts covered

• What is the most used Desktop Operating System right now?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the short form for HKEY_LOCAL_MACHINE?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the path for the five main registry hives, DEFAULT, SAM, SECURITY, SOFTWARE, and SYSTEM?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the path for the AmCache hive?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the Current Build Number of the machine whose data is being investigated?
  Open the walkthrough page to inspect the full answer and command flow.