Reading between the lines, I get the impression the key is deleted from the registry, but not explicitly erased, allowing recovery if the disk space isn’t reuse

Reading between the lines, I get the impression the key is deleted from the registry, but not explicitly erased, allowing recovery if the disk space isn’t reused yet. “Since Zeppelin deletes the registry key store, we will have to extract unallocated cells from the registry to recover the Public Key section. […] We have had 100% success carving the public key from NTUser.dat for live Zeppelin samples in the field”