In the Open
In the Open

Windows Registry

Regedit Keys

  • HKEY_CURRENT_USER (HKCU), inside HKU
  • HKEY_USERS (HKU)
  • HKEY_LOCAL_MACHINE (HKLM)
  • HKEY_CLASSES_ROOT (HKCR), stored in HKLM and HKU
    • HKEY_CURREN_USER\Software\Classes for settings of interactive user
    • HKEY_LOCAL_MACHINE\Software\Classes to change default settings
  • HKEY_CURRENT_CONFIG

Paths

  • C:\Windows\System32\Config

    • Default -> HKEY_USERS\DEFAULT
    • SAM -> HKEY_LOCAL_MACHINE\SAM
    • SECURITY -> HKEY_LOCAL_MACHINE\Security
    • SOFTWARE -> HKEY_LOCAL_MACHINE\Software
    • SYSTEM -> HKEY_LOCAL_MACHINE\System

  • C:\Users\<username>\

    • NTUSER.DAT -> HKEY_CURRENT_USER , hidden file

  • C:\Users\<username>\AppData\Local\Microsoft\Windows

    • USRCLASS.DAT -> HKEY_CURRENT_USER\Sofware\CLASSES, hidden file

  • C:\Windows\AppCompat\Programs\Amcache.hve

Transaction Logs

  • Transaction <name of registry hive>.LOG of the registry hive
  • Saved inside the same directory which is C:\Windows\System32\Config, as the hive which was altered.

Backups

  • Saved every ten days
  • Look out for recently deleted or modified keys
  • C:\Windows\System32\Config\RegBack

Data Acquisition

  • Tools
    • Autopsy
    • FTK Imager, does not copy Amcache.hve
    • KAPE, preserves directory tree
    • Registry Viewer
    • Zimmerman's Registry Explorer, uses transaction logs as well
      • AppCompatCache Parser
    • RegRipper, cli and gui

System Information

  • OS Version -> SOFTWARE\Microsoft\Windows NT\CurrentVersion
  • Computer Name -> SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
  • Time Zone SYSTEM\CurrentControlSet\Control\TimeZoneInformation
  • Network Interfaces -> SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces
  • Past connected networks -> SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Unmanaged and SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Managed
  • Services -> SYSTEM\CurrentControlSet\Services
    • Service will start at boot with start key value 0x02
  • Users, SAM -> SAM\Domains\Account\Users

Control Sets

  • ControlSet001 -> last boot
  • ControlSet002 -> last known good

  • HKLM\SYSTEM\CurrentControlSet -> live

  • Can be found under:

    • SYSTEM\Select\Current shows the used control set
    • SYSTEM\Select\LastKnownGood

Autostart Programs

  • NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run
  • NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\RunOnce
  • SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
  • SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
  • SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Recent Files

  • NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs, e.g. xml, pdf, jpg
  • Office files -> NTUSER.DAT\Software\Microsoft\Office\VERSION, NTUSER.DAT\Software\Microsoft\Office\15.0\Word
  • Office 365 -> NTUSER.DAT\Software\Microsoft\Office\VERSION\UserMRU\LiveID_####\FileMRU

ShellBags

  • USRCLASS.DAT\Local Settings\Software\Microsoft\Windows\Shell\Bags
  • USRCLASS.DAT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
  • NTUSER.DAT\Software\Microsoft\Windows\Shell\BagMRU
  • NTUSER.DAT\Software\Microsoft\Windows\Shell\Bags

Last Open/Saved/Visited Dialog MRUs

  • NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePIDlMRU
  • NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU

Explorer Address/Search Bars

  • NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths
  • NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery

User Assist

  • GUI applications launched by the user
  • NTUSER.DAT\Software\Microsoft\Windows\Currentversion\Explorer\UserAssist\{GUID}\Count

Shim Cache

  • Application Compatibility, AppCompatCache
  • SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache
  • Use AppCompatCacheParser.exe --csv <path to save output> -f <path to SYSTEM hive for data parsing> -c <control set to parse>

AmCache

  • Information about recently run applications on the system
  • C:\Windows\appcompat\Programs\Amcache.hve
  • Last executed app -> Amcache.hve\Root\File\{Volume GUID}\
  • Saves SHA1 of the last executed app

Background Activity Monitor/Desktop Activity Moderator BAM/DAM

  • Saves full path of executed apps
  • SYSTEM\CurrentControlSet\Services\bam\UserSettings\{SID}
  • SYSTEM\CurrentControlSet\Services\dam\UserSettings\{SID}

Devices

  • Identification
    • USB -> SYSTEM\CurrentControlSet\Enum\USBTOR, SYSTEM\CurrentControlSet\Enum\USB
  • Device name -> SOFTWARE\Microsoft\Windows Portable Devices\Devices
  • First time connected -> SYSTEM\CurrentControlSet\Enum\USBSTOR\Ven_Prod_Version\USBSerial#\Properties\{83da6326-97a6-4088-9453-a19231573b29}\0064
  • Last time connected -> SYSTEM\CurrentControlSet\Enum\USBSTOR\Ven_Prod_Version\USBSerial#\Properties\{83da6326-97a6-4088-9453-a19231573b29}\0066
  • Last removal time -> SYSTEM\CurrentControlSet\Enum\USBSTOR\Ven_Prod_Version\USBSerial#\Properties\{83da6326-97a6-4088-9453-a19231573b29}\0067