diff --git a/doc/registry_keys/Registry_Forensics.pdf b/doc/registry_keys/Registry_Forensics.pdf
new file mode 100644
index 0000000..a617130
Binary files /dev/null and b/doc/registry_keys/Registry_Forensics.pdf differ