How to use the Windows Registry Forensics agent skill

What does the skill make the agent do?

When installed, the skill guides the agent through a step-by-step forensic workflow for Windows registry files that have been copied from a disk image. The workflow covers mounting the image read-only, hashing the extracted hives, running RegRipper plugins, and using Python to read the hives directly.

The source material lists these targets: autorun and persistence keys, UserAssist program-run history, recent documents, typed URLs, typed paths, installed software, USB device records and network history. The skill is written for incident responders and digital forensics analysts, not for general users.

• Mount a forensic image read-only and copy the registry hives out of it
• Hash the extracted hives so the copies can be verified later
• Run RegRipper plugins against SAM, SYSTEM, SOFTWARE, NTUSER.DAT and UsrClass.dat
• Use python-registry, and regipy in the bundled script, to list Run and RunOnce keys
• Decode UserAssist entries and pull recent documents, typed URLs and network history

How do you install the skill?

Download the skill ZIP from the page you are reading. Unzip it into one of two locations. For a personal install, use ~/.claude/skills/. For a single project, put it in that project's .claude/skills/ folder. Either way, the skill folder should contain SKILL.md, scripts/agent.py and references/api-reference.md.

If you use the Claude apps instead of the file system, open Settings, go to Capabilities, and upload the skill under Skills.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into the project's .claude/skills/ folder
• Claude apps: Settings, then Capabilities, then Skills, then upload

What do you need before you start?

The skill assumes you already have evidence to work on. You need a forensic image or extracted registry hive files. The workflow also depends on several tools, listed below. Only Perl and Python 3 are strictly required for the command-line steps; Registry Explorer and a SIFT Workstation are optional.

• Perl, to run RegRipper
• RegRipper, cloned from the keydet89 RegRipper3.0 repository on GitHub
• Python 3 with the python-registry and regipy packages
• A forensic image or extracted registry hive files (SAM, SYSTEM, SOFTWARE, SECURITY, DEFAULT, NTUSER.DAT, UsrClass.dat)
• Optional: Registry Explorer on Windows, or a SIFT Workstation

How do you trigger the skill with a natural request?

Agents decide when to load a skill from its description, so describe the job in forensic terms. The skill's own description points to registry-based persistence, reconstructing user or system activity, and DFIR triage on a Windows image. Name the artifact, the hive and the image or hive location when you can.

Good requests say what you want to find and what you have to work with. Vague requests such as 'check this computer' are less likely to load the right workflow.

• Triage the NTUSER.DAT and SOFTWARE hives from this image for autorun and persistence entries
• Using the hives in /cases/case-001/registry, list UserAssist program-run history for this user
• Find typed URLs and recent documents in this NTUSER.DAT and hash the hive copies first
• Check the SYSTEM hive for the computer name, network interfaces and time zone

What does a typical workflow look like?

The skill's workflow starts with a read-only mount and ends with reports saved to an analysis folder. Each RegRipper run writes its output to a text file, so you can review results later and keep a record of what you ran. The commands below come from the skill's workflow and use the case paths from its examples; change them to match your own case.

The Python steps open the hive with python-registry and print each value with its last-modified timestamp. The bundled reference also shows how to do the same with regipy.

• Mount read-only: mount -o ro,loop,offset to the image path
• Copy the hives, then hash them with sha256sum
• Run rip.pl with -f for full profiles or -p for single plugins such as userassist, usbstor or typedurls

Which safety rules should you follow?

The skill is for offline analysis. Its workflow assumes you are working on copies of hives, and running tools against a live production machine can alter evidence. Mount the image read-only and keep the originals untouched.

The skill runs scripts and uses the network. The source shows git cloning RegRipper from GitHub and pip installing python-registry, so review those steps and the bundled scripts/agent.py before you run them on a case workstation. Only examine systems or images you are authorised to examine, because the work targets personal or employee data.

• Work only on copies of hives, never on a live system
• Confirm you have authorisation before examining an image
• Check the bundled scripts and the network downloads before running them
• The output is investigative guidance, not a validated forensic procedure

What tips help you get better results?

Hash your hive copies before analysis, and keep the transaction logs (the .LOG files) with the hives so dirty hives can be recovered. Compare autorun entries against the known Run key paths listed in the reference, and check the timestamp on each key, since that is when the key was last modified, not necessarily when a program ran.

Check the Run keys in both SOFTWARE and NTUSER.DAT, since autostart entries can live in either. UserAssist values are ROT13-encoded, so decode them before reading program names.

• Keep the .LOG transaction files with the hives
• Check both machine-wide and per-user Run keys
• Read UserAssist names after ROT13 decoding
• Correlate registry timestamps with other artifacts before drawing conclusions