34. Third-Party Registry Viewers

• Many freeware or low-cost third-party registry viewer/editor programs exist.

  • Usually have some features beyond regedit.

• Resplendence Registry Manager

  • Notably useful for computer forensics, because it can open any NTUSER.DAT or .REG file.

• Before you begin, copy NTUSER.DAT from target system onto "forensics box".

• Run program and File -> Import the .DAT or .REG file

• See resplendence.com for details.