The Windows registry is an essential source of evidence when performing a wide range of examinations. In a recent talk (ZeroNights, 2017), Maxim Suhanov described various problems with popular tools used to parse offline registry hives and to recover deleted data.
You can find the slides here.
