Forensic examination in the registry has long been referred to the analysis of only readily available Registries from Microsoft Windows®, often one at a time, in vain takes a lot of time and an archaic way. Registry Recon is not just another Registry parser. Digital forensics experts armed with Hibernation Recon are now able to leverage not only the active contents of Windows hibernation files, but also massive volumes of information in the multiple types (and levels) of slack space that often exist within them.
Mark Spencer noted in his article a new one in the latest Hibernation Recon. The latest Hibernation Recon now provides a streamlined graphical user interface, parallel processing of multiple hibernation files, and advanced NTFS metadata recovery.
Why do digital forensic experts need to use Hibernation Recon? And what people say can be seen in the post of Mark Spencer.
