Hi.
In this course you will learn about Windows Registry.
I must say with regret that this presentation contains long texts.
I will do my best to prevent you from getting bored.
Let's start.
Registry Forensics Part one.
Although many end users are unaware of it, the Windows operating system consists of a multitude of
components beyond its desktop windows and applications.
Some of these components are essential for the proper functioning of the operating system, while others
are necessary for newly installed software and hardware to operate.
One key aspect of the Microsoft Windows operating system is that all settings, software, hardware
and user related values must be stored within the system.
This crucial information is kept in a database known as the Windows Registry, which acts as a centralized
repository for all configurations.
The registry holds data for both enabled and disabled operating system features, as well as for many
applications that utilize it.
Microsoft Windows has integrated the Windows Registry into its operating system since Windows 3.11,
making it a crucial component.
The Windows Registry stores not only the configuration and settings of the operating system, but also
the preferences for running services and installed applications, providing users with the ability to
customize their system.
Within the registry.
All values pertaining to settings, software, hardware and users are stored in Microsoft Windows systems.
Any time a computer setting is modified, a program is installed or an installed program is uninstalled.
The registry is updated to reflect the changes.
This ensures that user modifications to their systems are installed, software are retained when the
computer is restarted after shutting down.
The Windows Registry stores a vast amount of entries and manually reviewing.
Each of them can be time consuming.
Therefore, for forensic analysis, an analyst needs to know where to look for potential evidence.
Even if you remove hardware, software and driver components from our computer, they can still leave
behind data traces.
The registry contains valuable information, making it a significant source of information for digital
forensics investigations.
Some of the valuable information that can be found in the registry are user names, running programs
plugged in USB devices, devices defined in the system, computer names recently used software personal
settings, browser preferences system Configuration Information Network.
Share Information.
Accessing registry records.
The most basic tool for editing, viewing and searching the registry is regedit.exe.
It can be accessed via.
One.
Type Regedit in the search box.
Then open it.
The second way is go to start type run, enter.
Then in the search box type track edit and okay.
When you run regedit, you will encounter a page like this.
These are called root keys and there are five of them.
Register structure.
Registry is a hierarchical structure consisting of keys and values.
Keys are located on the left side and the values are located on the right side, often displayed as
0 or 1.
The registry structure is classified in a directory like manner consisting of root keys, keys, sub
keys and values.
There are five root keys in the registry.
Classes Root.
Current user.
Local machine users and current config.
Knowing which information is kept under which keys gives us great advantages when conducting an investigation
in the field of forensic informatics.
We will now examine what information is found on the root keys.
Classes.
Root contains information related to software settings, shortcuts and all other user interfaces.
If the section is deleted, windows will still work, but none of the files will open.
Moreover, this section contains information about file types or any object linking and embedding and
file associations.
HK.
Current user HK.
Current user is registered here in the Windows registry that contains configuration information for
the currently logged in user.
This includes preferences, settings and other data related to the user's desktop applications and other
software.
It is important to note that changes made to the HKCU give only apply to the current user and do not
affect other users on the same machine.
Local machine.
Local machine contains computer specific configuration information, including hardware dependent settings
that may vary from one computer to another.
This section hosts system software and settings, which are applied to all users who log in.
It also contains configuration and settings that the system uses during startup.
There are five keys within LM that are important for system configuration and management.
Our first key is system.
System contains system configurations such as computer name system, time zone and network interfaces.
Software contains settings and configurations for installed applications and operating system services
on the system.
Security contains the security policies in the system.
SAM Stores security account manager and user group Security information.
It contains the username, the user's unique ID and the hash of the user's password.
Hardware contains information about hardware devices connected to the system.
This information is stored during system boot.
In other words, bios.
Users.
HK Users is a registry key in windows that contains subkeys for each user profile.
Each Subkey holds settings specific to the user identified by a unique security identifier.
When a user logs in their settings are loaded from their subkey under users and saved back to the registry
when they log out.
While primarily used by Windows, advanced users and system administrators may modify user settings
or troubleshoot issues using this key.
Current config.
Current config is a Windows registry heap containing hardware configuration data.
It is actually a subset of local machine root key and dynamically generated at boot time based on the
current hardware profile.
The registry key is a symbolic link to the appropriate hardware profile.
Subkey in the eve and changes made to Hkcc will be reflected in the corresponding subkey.
Although it's not directly accessed or modified by users.
Some applications and drivers may modify values in hkcc during installation or configuration.