the author discussed the structure of Windows registry data and the behavior of Windows in deleting the registry records. In continue a technique is developed for identifying the deleted Windows registry records and recovery of deleted keys, values and other attributes of records.