Details in Windows

[paulobreim]

Normally, when analyzing Windows, we have some questions that I would like to know if it is possible to find them in IPED, for example:
Last boot date.
Login date for each user.
USB accesses, what was connected, when, etc.
Last commands executed
etc

Some of these questions, I think, can be obtained by regripper.

Does anyone know anything else about this?

tks
paulo

[lfcnassif]

Some of these questions, I think, can be obtained by regripper

Yes, you can find most of those infos in Regripper reports imported by IPED in "Windows Registry" category, search for files with *-Report suffix, e.g. SAM-Report, SOFTWARE-Report, SYSTEM-Report, NTUSER.DAT-Report...

[paulobreim]

I didn't find a category with the name "windows registry", but filtering with SAM-Report, SOFTWARE-Report, SYSTEM-Report, NTUSER.DAT-Report I found a lot of information.

tks