Recipe Difficulty: Medium

Python Version: 2.7

Operating System: Linux

The Windows registry contains many important details related to the operating system configuration, user activity, software installation and usage, and so much more. These files are often heavily scrutinized and researched due to the number of artifacts they contain and their relevance to Windows systems. Parsing registry files gives us access to the keys and values that can reveal basic operating system information, access to folders and files, application usage, USB devices, and more. In this recipe, we focus on accessing common baseline information from the SYSTEM and SOFTWARE hives.