In this course the student is guided through advanced forensic investigations of the Windows Registry system. From the Registry’s background to its basic topics—e.g., hive files, information in keys and values—to discovering the trove of available data, the learner will be prepared to prove that a specific user performed specific actions in a Windows platform.