// REFERENCE
Registry hive (regf) signature
Signature (hex): 72 65 67 66 (regf)
Medium risk
A Windows Registry hive (SYSTEM, SAM, NTUSER.DAT) starts with 72 65 67 66 (regf). In forensics it's a key source: it holds configuration, malware persistence and password hashes (SAM).
Related tools
Work with this in:
Related
sqlite
SQLite database signature pcap
PCAP capture signature pcapng
PCAPNG capture signature torrent
.torrent signature eml
EML email signature woff2
WOFF2 font signature
SQLite database signature pcap
PCAP capture signature pcapng
PCAPNG capture signature torrent
.torrent signature eml
EML email signature woff2
WOFF2 font signature
Signatures verifiable with CyberEscudo's magic-bytes identifier. Educational content.