Harlan Carvey

Carvey wrote RegRipper, a plugin-driven Perl tool that parses registry hives and pulls out which USB devices were connected, which programs ran and which files were opened recently. It became one of the most widely used free tools in digital forensics, precisely because it could be extended for every new artefact Microsoft happened to add.

His books Windows Forensic Analysis (from 2007, through several editions) and Windows Registry Forensics became course reading, and his blog "Windows Incident Response" has spent nearly two decades arguing for timeline analysis and against trusting any single tool. He has worked in incident response at consultancies and service firms rather than in academia, and it shows: the writing is about what actually turns up in real cases.