DIGITAL FORENSICS LAB / VERSION 1.0.5

Windows Registry Studio

Start with the synthetic case. Then examine an authorized Windows computer using the included local, read-only helper. Explore raw registry keys or focused artifact views, and export your findings.

Before a classroom deployment: the browser application and synthetic parsers were tested. The live helper was developed in a Linux environment and has not been executed on Windows. Run the preflight and a pilot collection on your intended classroom Windows image. This is not a validated forensic acquisition suite.
Starting live access: On a hosted/offline page, use Download Run_Studio.cmd. On the local page opened by that launcher, the control becomes Check connection. Use the page's Download Run_Studio.cmd button or extract it from the ZIP, then double-click it in File Explorer and type YES. If the browser does not open, copy the complete Local page: address from the console into your browser, including #token=. Keep that console open. Run_Studio_Manual.cmd starts the same helper without attempting to open a browser.

1. Try the training case

Open the application and select Load training demo. The case is handcrafted and visibly marked synthetic; it does not inspect this computer.

Open Windows Registry Studio

The application includes seven guided labs, artifact cautions, source-key inspection, raw hex previews, search, filtering, sorting and case notes. All required scripts and styles are embedded in the HTML.

2. Download the one-click launcher

The normal student path uses only:

Run_Studio.cmd

The launcher contains the helper and local HTML and creates its runtime copy under your Windows profile. The ZIP retains the separate source files for instructor review and validation. No extension, Python, Node.js or cloud account is required.

3. Collect from an authorized Windows machine

  1. Review and approve the helper. For the initial deployment, run Validate_On_Windows.ps1 in an approved Windows PowerShell session. It syntax-checks the collector, compiles the native wrapper and performs a few read-only API checks.
  2. Double-click Run_Studio.cmd. Type YES in its console. Keep that window open. Use the local browser page it launches, rather than another hosted or standalone copy.
  3. Choose the evidence. In Connect & collect, verify the collector identity, select artifacts and supporting inventory, acknowledge authorization, and collect. Security logon events are separately opt-in.
  4. Check coverage before interpreting. Review inaccessible, missing, truncated and unsupported records. Read focused artifact tables or use Entire registry to navigate and capture a branch or all accessible roots for the selected view.
  5. Export and stop. Add case notes. Export full JSON to preserve a re-importable snapshot, plus CSV and/or an HTML report. Save a SHA-256 sidecar when available. Stop the helper or close its console.

An elevated collector can read more data but is not always required. Running under a different account changes HKCU. This tool does not mount unloaded hives, recover deleted data, edit registry values, or decrypt Wi-Fi passwords.

Script blocked?

Follow your organization's policy. For reviewed, approved downloads, the file's Properties > Unblock option or these scoped commands may be appropriate:

Unblock-File -LiteralPath .\Registry_Collector.ps1
Unblock-File -LiteralPath .\Validate_On_Windows.ps1

The launcher uses -ExecutionPolicy Bypass for its PowerShell process only, not a permanent user or machine policy change. Group Policy still takes precedence. Do not disable enterprise application control, endpoint protection or Group Policy. Ask the administrator to approve or sign the helper instead.

Collect a JSON file instead

Run from an approved Windows PowerShell session in this folder:

.\Registry_Collector.ps1 -ExportOnly -OutputFile .\classroom_registry.json

Then open the HTML and select Import evidence. Add -IncludeEvents to request the limited Security-event query.

This explicit command gathers the selected artifact set, writes JSON plus a hash sidecar and does not start the local web listener.

What “complete” means here

Complete acquired dataset means everything successfully acquired during that session, including raw values, coverage and notices. It does not mean every record on the original machine. Full traversal is separate, permission-limited and capped. Supported ShellBags and ShimCache structures are decoded; unknown formats remain raw with notices.

Launching any live program changes a running system through normal execution traces. Use an approved classroom machine. A read-only API request is not a write-blocked, atomic forensic image. Review exports for personal or sensitive information before sharing.

For file formats, hosting, detailed scope, collection caps and the validation checklist, read README.md and VALIDATION.md. To host the lab, upload the standalone HTML; its setup screen supplies the helper downloads. A hosted page cannot silently inspect a visitor's registry.