FTK Windows Server 2008 SYSTEM Filter

I recently found it necessary to quickly grab a large amount of SYSTEM registry files to determine the current control set and time zone information. FTK displays this information upon clicking the SYSTEM registry file. However, when you have a bunch of disk images loaded, it is a pain to navigate to all of them. Below is my filter to grab the SYSTEM file from /Windows/System32/config/. This should work on other OS versions too, but I have not tested yet. It has been working for me on Windows Server 2008 R2 64bit.

Print Friendly, PDF & Email