The investigator wants to examine changes made to the system's registry by the suspect program. Which of the following tool can help the investigator?

The correct answer is C. Regshot. Regshot is a free, open-source Windows registry comparison utility. It takes a 'snapshot' of the registry before a program runs and another after, then compares the two to produce a detailed report of all additions, deletions, and modifications. This is ideal for malware…

Submitted by obi.ng· Apr 18, 2026Malware Forensics

Question

Options

ATRIPWIRE
BRAM Capturer
CRegshot
DWhat's Running

How the community answered

(27 responses)

A
4% (1)
C
93% (25)
D
4% (1)

Explanation

Regshot is a free, open-source Windows registry comparison utility. It takes a 'snapshot' of the registry before a program runs and another after, then compares the two to produce a detailed report of all additions, deletions, and modifications. This is ideal for malware analysis or forensic investigations. TRIPWIRE is a file integrity monitoring tool that detects changes to files, not the registry specifically. RAM Capturer acquires volatile memory (RAM). What's Running is a process monitoring tool that shows active processes and services.

Topics

#Registry Forensics#Malware Analysis Tools#Digital Forensics Tools#System Change Detection

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice