Windows Registry and its Forensic significance - Part 2
Akshay Tiwari
CISSP | EDR | SIEM | SOC | CSIRT | IR | INVESTIGATIONS | 12+ years in cyber security space
Welcome to the second installment of our three-part series on Windows Registry and its forensics Significance. In the first part, we delved into the registry hive which were helpful in investigation related to web traffic from an endpoint, if you have not checked that i have included the link here . Now, in Part 2, we will explore 10 crucial Windows Registry artifacts that provide insights into user activity, file interactions, and DLL usage, shedding light on cybercrime-related activities.
User Account Information (SAM Hive):
Description: The SAM hive contains user account data, including usernames, password hashes, and security identifiers (SIDs).
Registry Key: HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\
Recent Documents:
Description: This artifact records recently accessed files, providing evidence of user activity.
Registry Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\
USB Device History:
Description: Tracks the history of connected USB devices, including their serial numbers and timestamps.
Registry Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR\
Run Commands History:
Description: Records executed commands, which can be crucial in tracking malicious activities.
Registry Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\
Network Configuration:
Description: Contains network-related information, including IP addresses, DNS settings, and network profiles.
Registry Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\
Application Execution History:
Description: Logs information about executed applications, including their paths and timestamps.
领英推荐
Registry Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\
File Associations:
Description: Shows which applications are associated with specific file types, helping identify default programs.
Registry Key: HKEY_CLASSES_ROOT\
Recent Print Jobs:
Description: Provides a record of recently printed documents, useful in investigations involving document forgery.
Registry Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers\
Prefetch Data:
Description: Contains information about recently launched applications, helping reconstruct user activity timelines.
Registry Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters\
DLL Loading:
Description: Logs the loading of dynamic link libraries (DLLs) by applications, aiding in malware analysis.
Registry Key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Windows\
Key Takeaways
The Windows Registry is a goldmine of digital forensic artifacts that can reveal valuable insights into user behavior, file interactions, and DLL activities. These 10 registry artifacts provide a starting point for digital forensic investigators, helping them uncover critical evidence in cybercrime cases. Properly analyzing and documenting these artifacts can play a crucial role in building a strong case and ensuring justice in the digital world.
What is Next!
In the upcoming third and final article of the series, I will continue our exploration of Windows Registry artifacts. Additionally , will introduce you to some powerful tools and techniques that forensic analysts leverage to conduct in-depth Windows Registry analysis. Stay tuned for Part 3, where we will further enhance your understanding of digital forensics