The Windows Registry remains one of the most information-dense repositories for reconstructing system activity and user behavior. Far more than a configuration database, it serves as a critical historical record of execution, data access, and persistence mechanisms across Windows 10 and 11. While automated forensic tools are essential for extracting and parsing this data, the correct interpretation of the results remains the responsibility of the investigator. This article focuses on the Registry keys that possess distinct forensic significance. We will move beyond the standard enumeration found in legacy guides to establish the specific links between technical artifacts and their value in an investigation, distinguishing between actionable evidence and system noise.