# ZEKASTRA case pack VP-01 - SYNTHETIC registry excerpt (parser output, not a hive file)
# Workstation PAY-WS03.kestrel.example - triage collection 2026-03-16
# All times below are UTC as written by the parser.

## Hive: SYSTEM (C:\Windows\System32\config\SYSTEM) - ControlSet001

[ControlSet001\Control\TimeZoneInformation]
  Bias                          REG_DWORD  0xFFFFFF4C (-180)
  ActiveTimeBias                REG_DWORD  0xFFFFFF4C (-180)
  StandardName                  REG_SZ     @tzres.dll,-1392
  TimeZoneKeyName               REG_SZ     Turkey Standard Time
  DynamicDaylightTimeDisabled   REG_DWORD  0x00000000

[ControlSet001\Enum\USBSTOR\Disk&Ven_Kingston&Prod_DataTraveler_3.0&Rev_PMAP\60A44C3FAE3BF2A1B9C0&0]
  FriendlyName                  REG_SZ     Kingston DataTraveler 3.0 USB Device
  Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064  First install   2025-11-03 13:05:11
  Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065  Install date    2025-11-03 13:05:11
  Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0066  Last arrival    2026-03-14 06:58:44
  Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0067  Last removal    2026-03-14 07:31:02

[ControlSet001\Enum\USBSTOR\Disk&Ven_SanDisk&Prod_Cruzer_Blade&Rev_1.00\4C530001120318109375&0]
  FriendlyName                  REG_SZ     SanDisk Cruzer Blade USB Device
  Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064  First install   2026-01-19 08:30:55
  Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065  Install date    2026-01-19 08:30:55
  Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0066  Last arrival    2026-03-13 08:15:02
  Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0067  Last removal    2026-03-13 08:22:47

[MountedDevices]
  \DosDevices\C:                                          DMIO:ID: (fixed disk, volume serial 8E2F-11D0)
  \DosDevices\E:                                          _??_USBSTOR#Disk&Ven_Kingston&Prod_DataTraveler_3.0&Rev_PMAP#60A44C3FAE3BF2A1B9C0&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
  \??\Volume{6c1f0d2e-3b7a-11f0-9a41-806e6f6e6963}        _??_USBSTOR#Disk&Ven_Kingston&Prod_DataTraveler_3.0&Rev_PMAP#60A44C3FAE3BF2A1B9C0&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
  \??\Volume{0b8e4a51-f5c2-11f0-9a44-806e6f6e6963}        _??_USBSTOR#Disk&Ven_SanDisk&Prod_Cruzer_Blade&Rev_1.00#4C530001120318109375&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
  # Note: \DosDevices\E: holds only the last device that received the letter E:.

## Hive: SOFTWARE (C:\Windows\System32\config\SOFTWARE)

[Microsoft\Windows Portable Devices\Devices\SWD#WPDBUSENUM#_??_USBSTOR#DISK&VEN_KINGSTON&PROD_DATATRAVELER_3.0&REV_PMAP#60A44C3FAE3BF2A1B9C0&0#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}]
  FriendlyName                  REG_SZ     KINGSTON

[Microsoft\Windows Portable Devices\Devices\SWD#WPDBUSENUM#_??_USBSTOR#DISK&VEN_SANDISK&PROD_CRUZER_BLADE&REV_1.00#4C530001120318109375&0#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}]
  FriendlyName                  REG_SZ     SANDISK

## Hive: NTUSER.DAT (C:\Users\d.aydin\NTUSER.DAT)

[Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6c1f0d2e-3b7a-11f0-9a41-806e6f6e6963}]
  Key last write                2026-03-14 06:58:46

[Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0b8e4a51-f5c2-11f0-9a44-806e6f6e6963}]
  Key last write                2026-03-13 08:15:04

## Hive: NTUSER.DAT (C:\Users\t.kaya\NTUSER.DAT)
# No MountPoints2 entries for either USB volume.