# Windows Registry Studio

Version 1.0.5 | September 7, 2026

A self-contained, light-themed teaching application for examining a Windows computer's registry and selected supporting system information. The HTML includes all JavaScript, CSS, a synthetic training case, seven guided labs, and downloadable copies of the Windows helper and launcher. No browser extension, Python installation, Node.js installation, database, cloud service, or third-party runtime package is required for normal use.

**Validation status:** browser-side functionality and synthetic parsers were exercised in Chromium and Node.js. The Windows helper and Windows preflight script have not been executed in the development environment, which is Linux. Run the supplied preflight and a pilot collection on the intended Windows classroom image before distributing this as a working classroom exercise. This is a teaching/live-triage application, not a field-validated forensic acquisition suite.

## Startup correction in 1.0.5

On a hosted/offline page, the setup action now downloads a **self-contained `Run_Studio.cmd`**. That one file embeds the helper and local HTML. Run it from File Explorer, type `YES`, keep the console open, and use the separate local browser page it launches. In a local helper session the same control becomes **Check connection**.

The Windows PowerShell 5.1 or PowerShell 7 compile step now explicitly references the framework assemblies used by the native wrapper (including System.Xml.dll); the preflight uses the same references. The launcher checks for missing files and keeps errors visible. Browser-launch failure no longer terminates the running helper. Copy the complete `Local page:` address (including `#token=`) from the console into your browser. Do not share it.

`Run_Studio_Manual.cmd` is an optional shortcut that skips automatic browser opening. Alternatively, in a terminal in the extracted folder:

```powershell
powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File .\Registry_Collector.ps1 -NoBrowser
```

Review/approve the collector before running or unblocking it. Execution-policy and enterprise controls still apply. No machine-wide security settings are changed.

## Start here

### Training/demo mode

Open `Windows_Registry_Studio.html` in a modern browser. Select **Load training demo**. The records are handcrafted and visibly labeled synthetic. They are not read from the computer. Use **Guided labs & reference** for the seven exercises.

### Live analysis of the Windows machine

1. For the normal student path, download or extract `Run_Studio.cmd` and run it from File Explorer. It contains the helper and local HTML. The ZIP also includes the separate source files for review and validation.
2. Review the scripts and obtain authorization to examine that machine. For an instructor's first deployment, run `Validate_On_Windows.ps1` from an approved Windows PowerShell session and review its output.
3. Double-click `Run_Studio.cmd`. At the console prompt, type `YES`. Keep the console open.
4. Use the **local browser page that the launcher opens**, not a separately opened hosted or `file://` page. The page uses an ephemeral local port and session token.
5. In **Connect & collect**, verify the collector identity. Select the artifacts and supporting inventory. Security logon events are optional and separately selected. Acknowledge the authorization/live-collection notice, then collect.
6. Review **Collection coverage**, including missing keys, access-denied reads, partial values, target caps and parser notices.
7. Use the artifact tables or **Entire registry**. Click a row to inspect provenance, raw values, supported binary previews and finding notes.
8. Enter case details under **Export & case notes**. Export the complete acquired dataset as JSON before closing. Also export CSV and/or HTML. Save the hash sidecar when available.
9. Stop the helper using the page's stop control or by closing the collector console.

The intended live environment is a modern Windows 10/11 classroom installation with Windows PowerShell 5.1 or PowerShell 7 and .NET Framework, a full-language PowerShell session, and a modern browser. Older Windows builds, Server editions, ARM64, 32-bit hosts, restricted enterprise policies and individual artifact layouts require separate validation. The default launcher prefers the 64-bit Windows PowerShell executable when invoked from a 32-bit process.

### Downloaded-script restrictions

The launcher starts Windows PowerShell with **`-ExecutionPolicy Bypass` for that process only**; it does not change `CurrentUser` or `LocalMachine` execution policy. If `MachinePolicy` or `UserPolicy` enforces script signing, Group Policy takes precedence and the helper must be administrator-approved or signed. For separate source-file testing, the following commands can be used after review:

```powershell
Unblock-File -LiteralPath .\Registry_Collector.ps1
Unblock-File -LiteralPath .\Validate_On_Windows.ps1
```

Enterprise Group Policy, application control, constrained language mode or endpoint protection may still block execution or `Add-Type`. Do not disable those controls to run the lab. Use an approved classroom image or ask the administrator to approve/sign the helper. No registry permissions are changed by the collector.

Start with a standard account. Elevated access is optional and may expose additional keys or permit Security-log reads. Running as a *different* administrator changes HKCU and the current-user context. Loaded user hives are enumerated, but unloaded hives are never mounted automatically.

### File-based collection, without the local web listener

From an authorized Windows PowerShell session in the extracted folder:

```powershell
.\Registry_Collector.ps1 -ExportOnly -OutputFile .\classroom_registry.json
```

To include the limited Security-event query:

```powershell
.\Registry_Collector.ps1 -ExportOnly -IncludeEvents -OutputFile .\classroom_registry_with_logons.json
```

The explicit command performs collection without starting the listener. It writes JSON and a SHA-256 sidecar to the specified existing folder, refusing to replace an existing output. Open the standalone HTML and import that JSON. The collector's export-only mode gathers the selected artifact set and supporting inventory, not every key in all registry roots.

### Website hosting

Upload only `Windows_Registry_Studio.html` to the desired course website. It works as a standalone demo, file-import viewer and instructional page. Its **Connect & collect** screen supplies download buttons for the HTML, helper and launcher.

A hosted page does not directly inspect the visitor's registry. Students explicitly download and run the self-contained `Run_Studio.cmd`. Live work occurs on the local page it launches. The helper intentionally does not grant cross-origin access to the hosted website. Alternatively, students can collect JSON with `-ExportOnly` and import it into the hosted viewer. Evidence is parsed locally, not uploaded by this application. Only selected reference links lead to external websites.

## Included evidence views

| View | Implemented scope |
|---|---|
| Computer details | CIM/WMI OS, computer, BIOS, board, CPU, RAM, disks, logical drives, video and IP-enabled network adapters; selected system registry values. |
| Entire registry | HKLM, HKCU, HKU, HKCR and HKCC navigation; explicit 32-/64-bit requested views; key values, type, source and last-write metadata; captured-data search; branch/all-root capture. |
| Recent application indicators | Combined supported UserAssist, BAM and DAM rows, with artifact identity and time meaning retained. |
| UserAssist | ROT13 names; supported modern 68-/72-byte and legacy 16-byte layouts; counts, focus fields and FILETIME where defined. Legacy run counts remain raw. |
| BAM / DAM | Known 24-byte entries, path, user SID and recorded execution-related FILETIME. Other lengths remain raw. |
| ShimCache | Modern `10ts` records with `0x30`/`0x34` headers; cached file modification time and path. CRC is not independently validated. Unknown/legacy layouts remain raw with notices. |
| ShellBags | BagMRU hierarchy and MRU rank; common root GUID, named volume and file/directory shell items; supported BEEF0004 names and metadata. Raw Bags/BagMRU keys also remain available. |
| USB and mounted volumes | USBSTOR/USB enumeration, MountedDevices mappings, MountPoints2 and selected portable-device raw keys. No asserted plug/unplug timestamps. |
| Wi-Fi and networks | Native WLAN saved profile names/SSID/authentication/encryption plus NetworkList profiles and signatures. NetworkList can represent wired networks. No password recovery or profile XML export. |
| Installed applications | Machine and loaded-user uninstall registrations in requested views; current collector-user AppX packages. Not an exhaustive inventory of portable applications. |
| Users and current sessions | ProfileList, loaded-profile information, LastLoggedOn UI fields and Windows Terminal Services sessions. |
| Logon events | Optional newest 2,000 Security events 4624/4625/4634/4647 from the prior seven days; depends on audit policy, retention and permissions. |
| Recent documents and typed activity | RecentDocs names, raw common-dialog PIDLs, TypedPaths, RunMRU and legacy TypedURLs. No Jump List/LNK/browser-database collection. |
| Running processes | Current process IDs, parent IDs, executable paths where permitted and creation times. No command-line collection or historical process tracing. |
| Startup entries | Selected Run, RunOnce and Winlogon registrations. Not a comprehensive persistence scan. |

## Entire-registry scope and limits

**Entire registry is a navigation/capture mode, not a claim of complete forensic acquisition.** The student can request any readable key and can traverse a branch or all five visible roots for the selected view. Switch views and repeat when examining redirected keys. Alias/merged roots can overlap; counts are logical captured records, not unique physical hive cells.

Default artifact acquisition uses **4,000 keys per target**, a **25-second per-target traversal budget**, and artifact-specific depth boundaries. `-MaxKeysPerTarget` can set the count from 100 to 50,000. Values larger than **8 MiB** are omitted by the binary-value collector with an explicit error. Whole-branch/all-root UI capture uses **100 to 100,000 keys per run**, depth **128**, and an approximate **256 MiB response budget**. The budget is checked between batches and is not a strict process-memory ceiling. A pending traversal can be continued while that page/session remains open. The queue itself is not restored by re-importing a JSON export. JSON imports are capped at 256 MiB and 500,000 key records.

Stopping takes effect after the current request finishes. A helper request has a five-minute browser timeout. The helper is synchronous: do not run simultaneous collection requests from multiple tabs. It exits after about 30 minutes without a received request.

Protected keys may be denied even to an administrator. Missing, denied, uncollected, unsupported and truly empty records are different states. Unloaded profiles, deleted hive cells, slack, transaction-log replay and offline hive parsing are outside this tool's scope. Binary `NTUSER.DAT`, `UsrClass.dat`, `SYSTEM`, `SOFTWARE`, `SAM` or `SECURITY` hive files are **not** accepted directly.

## Imports and exports

**Full JSON:** preserves raw acquired registry values, metadata, supporting inventory, coverage, notices, analysis and case findings. Can be re-imported. Binary data is base64; DWORD/QWORD values are decimal strings to preserve precision. Do not confuse a single-table JSON extract with the full re-importable dataset.

**CSV:** includes every row in the selected scope, not only the current page. A current-view export follows its filters. Whole-case export includes metadata, raw registry rows, parsed groups, coverage and findings. Arrays and objects are JSON within cells. Formula-like prefixes are apostrophe-prefixed to reduce spreadsheet formula injection; use full JSON for unchanged original data.

**HTML:** a self-contained static report containing escaped evidence text, case information, collection notices and selected or full acquired content. There is no active report JavaScript. Wide tables scroll horizontally. Use browser printing as appropriate.

**Integrity:** browser exports compute SHA-256 of the exact output bytes when Web Crypto is available. Otherwise the interface explicitly reports that hashing is unavailable and disables the sidecar button. Collector JSON exports also receive a SHA-256 sidecar. Hashes detect subsequent byte changes; they are not digital signatures, do not authenticate the acquisition and do not prove completeness.

**REG text import:** accepts `Windows Registry Editor Version 5.00` and `REGEDIT4` text files, including common UTF-16LE/BOM and UTF-8 exports. The application parses the file as data and never imports it into Windows. Deletion directives are ignored and logged. REG text generally lacks acquisition metadata, source view and key timestamps; the viewer does not invent them. REGEDIT4 files in legacy, non-UTF encodings can have character-decoding limitations.

## Interpretation and privacy

A UserAssist or BAM/DAM indicator is not exhaustive execution history. ShimCache is not labeled as proof of execution. ShellBags show shell-folder interaction, not proof that a contained file was read. A profile registration is not a logon event; the logon view distinguishes network, service and interactive logons. Registry key last write is not a per-value last access time. NetworkList SYSTEMTIME remains local/unspecified, and unsupported timestamps are not guessed.

The helper requests read-only registry access and does not set/delete values, mount hives, install services, change firewall rules, decrypt passwords or offer arbitrary command execution. Nevertheless, launching any live tool creates normal activity traces on a running system. Use disposable/approved classroom machines; do not treat this as a write-blocked forensic acquisition.

The local HTTP service listens only on IPv4 loopback. API calls require the exact Host, exact Origin and a random 256-bit session token. There is no CORS permission for outside websites. This is not a defense against an attacker already controlling the collector account or computer. Exported data can contain personal names, SIDs, device serials, network identifiers and sensitive application values. Full-registry mode is **not** a credential-redaction filter. Review and secure reports before sharing.

## Development and validation

`build.py` assembles the HTML from `page_template.html`, `app.js`, `parsers.js`, the demo and the helper files. Python is needed only for rebuilding, not for using the delivered tool. `build_demo.py` regenerates the handcrafted training fixture. Developer parser tests run with:

```text
node test_parsers.cjs
```

See `VALIDATION.md` for completed checks and the Windows pilot checklist. `Validate_On_Windows.ps1` is an optional native preflight, not an exhaustive validation. Primary Microsoft API and independent forensic-format references are linked in **Guided labs & reference** and exported reports. The parsers are independently written teaching implementations; no third-party parser library is bundled.