Hi.
In this video you will learn how to analyze Windows registry manually.
Digital Forensics Part two.
Learning Computer Operating System and Version Information.
This information is located at this key Hkeylocalmachine Software, Microsoft Windows Currentversion.
From this registry record, we can deduce that the operating system is Windows 10 Home and Single language.
The current build number is 22621.
Learning the time zone of the computer.
This information is located at this key.
Local Machine system Control Set 001.
Control Time Zone Information.
From this record, we can deduce the time zone of local communities.
Turkey.
Standard Time.
Learn installed software.
We can find this information at.
Local machine Software Microsoft Windows Currentversion Uninstall.
These registry keys can be used to identify potentially malicious software and recover deleted or uninstalled
software by analyzing the key.
A forensic analyst can determine the names, versions, installation dates, file paths and uninstall
strings of each program.
This key is a valuable resource for investigating Windows Systems and can provide insights into software
changes made over time.
Learn about printer drivers installed in the computer.
This information can be found in local machine software Microsoft Windows, NT Currentversion Print
printers.
You can find the values for printer drivers in this registry.
Learning the network SSIDs that the local computer connected.
This information is located at.
Local machine software Microsoft Windows NT Currentversion Network List Profiles.
You can find the list of SSIDs.
In other words, service set identifier that you recently connected.
This key is important because it can provide insight into the network connections that a system has
made, including wireless networks, VPN connections and LAN connections.
Learning USBs connected to computer.
This key is located at.
Local Machine System Control set 001 Enum USB Store.
Is a forensic analyzer.
This key is an important registry that can provide valuable information about USB storage devices that
have been connected to a Windows system.
The key contains information about the device's vendor model, serial number and other identifying information.
This information can be useful for investigating data theft, malware infections and other security
breaches.
Learn to computer name learning.
The computer name we examined prevents the name confusion in the log records.
It means that you can qualify the evidence you collect about the computer with the name of the computer.
This information can be found at a local machine system.
Currentcontrolset Control.
Computer Name.
Learning Mru lists Mru.
The most recently used list contains entries made due to certain actions performed by the user.
This registry maintains a list of items in case the user returns to the files in the future.
This information is located at.
Current User Software.
Microsoft Windows Currentversion Explorer Run Mildew.
This is a registry key in Windows that stores a list of recently run programs using the run application.
This information can be useful in forensic investigations to determine the user's activity on the system.
Learning.
Recent talks shows the most recent documents used or opened on the system.
Exemption for all files in this registry is dot K.
This information is located at eight K current user software.
Microsoft Windows Currentversion Explorer.
Recent Tax.
This sub key stores a list of recently accessed documents which can be useful in forensic investigations
to determine a user's activity on the system.
Finding out Internet Explorer URLs visited.
This information is located at current user software Microsoft Internet Explorer.
Typed URLs.
This is a registry key in the Windows operating system that contains the list of URLs that the user
has typed into the address bar of the Internet Explorer web browser.
Notice that I'm saying the Internet Explorer, not a modern browser like Edge or Chrome.
So if Internet Explorer isn't installed in a computer, this registry location can not be found.
Learning the devices plugged into the computer.
If our hardware is mounted to a computer like CD-ROM, DVD, hard drive, flash memory, it will be
recorded in the registry.
This information can be found at local machine system mounted devices.
This is a registry key in the Windows operating system that contains information about storage devices
that are currently mounted or have been previously mounted on the system.
The values in this subkey contain information such as the device's unique identifier, its Mount Point
and the drive letter that has been assigned to it.
Warning.
Before we move on, I would like to warn you about there is a possibility that some of these registries
may not be available on your system because of differences between versions and boot numbers in various
Windows systems.
This video is over in the next video, we will get through some of these registries with regedit.