# The Registry

- [NTUSER.DAT](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/the-registry/ntuser.dat.md)
- [UsrClass.dat & ShellBags](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/the-registry/usrclass.dat-and-shellbags.md)
- [USB Forensics](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/the-registry/usb-forensics.md)