This video was created for students in my college Digital Forensics class at tonysako.com. It’s part of the series on Windows Registry forensics, and registry analysis in FTK. In this video students learn how to discover which specific registry keys are being used by using RegSnap, which makes snapshots of registry settings and allows you to compare different snapshots to find changes.
