Windows Registry Overview:
The Windows registry is a crucial database storing system, software, hardware, and user configuration data.
Root Keys:
It comprises four main root keys:
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER (HKCU)
HKEY_LOCAL_MACHINE (HKLM)
HKEY_USERS.
Offline Access:
Registry files are typically located in
%WINDIR%\system32\config, with hives like DEFAULT, SAM, SECURITY, SOFTWARE, and SYSTEM.
Hives and Contents:
Each hive contains specific information:
SYSTEM Hive: HKLM Hardware and service configurations. It will also list the majority of the raw device names for volumes and drives on the system including USB keys
SOFTWARE Hive: Application settings and configurations.
NTUSER.DAT Hive: User-specific configuration and environment settings as well as which includes a slew of identifiable data pertaining to user activity.
SAM Hive: Local user accounts and groups.
SECURITY Hive: Security information like password policies and group membership.
AMCACHE.HVE : Introduced in Windows 8, it tracks application compatibility and execution evidence, aiding in running older executables.
Backup hives:
RegIdleBackup task runs every 10 days on Vista, Win7, Win8, Win10, Server 2008, Server 2012, and Server 2016.
It copies SAM, DEFAULT, SYSTEM, SOFTWARE, and SECURITY hives to %WinDir%\System32\Config\RegBack directory.
This backup might contain residue that was cleared from the current hives.
The task does not backup the local NTUSER.dat hives of users.
Note :- Windows automatically creates backup copies of its registry hives periodically and stores them in the %SystemRoot%\System32\config\RegBack directory. However, this folder might be empty or not contain the most recent backups depending on system settings.
User registry Hives
The Windows registry holds a wealth of user-specific information, offering insights into various aspects of user activity on the system. It serves as a repository for recent actions performed by users, including accessed files, searched items, typed URLs, executed commands, and saved documents.
One of the primary components of the registry is the
NTUSER.dat hive :
which contains keys specific to each user profile Located under HKEY_CURRENT_USER, the NTUSER.dat hive offers a comprehensive view of user-centric actions within the system.
UsrClass.dat. hive :
This hive, typically located at C:\Users<username>\AppData\Local\Microsoft\Windows\UsrClass.dat,
holds crucial information related to program execution and folder manipulation. It plays a vital role in the virtualized registry root for User Account Control (UAC), facilitating seamless user interactions with the system. Despite its virtualized nature, UsrClass.dat offers valuable clues about user activities, helping forensic analysts reconstruct user behavior patterns.
Tip:- One notable aspect of UsrClass.dat is its association with ShellBags, a registry key that tracks the opening and closing of files and folders by programs. By examining ShellBags entries, investigators can uncover evidence of file and folder interactions, shedding light on user activities and application usage patterns.
With registry explorer things became easy to analyze (By Eric Zimmerman)
Registry key last write time using registry explorer
1. The registry tracks the last write time for every key on the system.
2. This timestamp, stored within the registry itself, indicates the last update of any key value and is typically displayed in Coordinated Universal Time (UTC).
3. The last write time is crucial for forensic investigations as it provides the timing of specific activities or events within the registry.
4. By correlating the last write time with other system data, such as user login times or file copy events, investigators can build a comprehensive timeline of user actions.
5. It's important to note that the last write time is updated whenever a value is added or updated within a key, and different keys may be updated at different points depending on the program's behavior.
6. Ensuring a clear understanding of whether timestamps are recorded in UTC or the local time zone is essential for accurate interpretation of forensic data. Failure to account for time zone discrepancies could lead to misinterpretation of critical evidence, potentially compromising the integrity of the investigation
Will Continue in next blog.............................
Akash Patel
Commentaires