Lab 15.2 - Practice Registry Hive Files
=======================================

These are SYNTHETIC practice hives for the RegRipper lab.
They are NOT real Windows Registry hives.

To obtain a real practice hive for this lab, use one of the following
legitimate sources:

  1. Your own Windows VM:
     Copy C:\Windows\System32\config\SYSTEM
     Copy C:\Windows\System32\config\SOFTWARE
     Copy C:\Users\<user>\NTUSER.DAT
     (from a powered-off VM snapshot, via a live forensic copy, or
      by booting to a Linux live disk and mounting the NTFS volume
      read-only with a write blocker.)

  2. NIST CFReDS / Digital Corpora:
     https://www.cfreds.nist.gov/  (NIST Computer Forensics Reference Data Sets)
     https://digitalcorpora.org/   (academic forensic image corpus)
     Both sites publish disk images with documented contents for practice.

  3. CTF / training images from:
     - Blue Team Labs Online: https://blueteamlabs.online/
     - CyberDefenders: https://cyberdefenders.org/
     Many challenge images include Registry hives with known planted artefacts.

Integrity note: before running RegRipper against any hive, record its
SHA-256 hash:
    sha256sum SYSTEM
    sha256sum NTUSER.DAT

This hash is your acquisition hash for the chain of custody.
