注册表
The RegMon utility from Sysinternals provided forensics on Windows Registry usage.