117 lines
4.8 KiB
Markdown
117 lines
4.8 KiB
Markdown
# Windows Registry
|
|
|
|
## Regedit Keys
|
|
* HKEY_CURRENT_USER (HKCU), inside HKU
|
|
* HKEY_USERS (HKU)
|
|
* HKEY_LOCAL_MACHINE (HKLM)
|
|
* HKEY_CLASSES_ROOT (HKCR), stored in HKLM and HKU
|
|
* `HKEY_CURREN_USER\Software\Classes` for settings of interactive user
|
|
* `HKEY_LOCAL_MACHINE\Software\Classes` to change default settings
|
|
* HKEY_CURRENT_CONFIG
|
|
|
|
## Paths
|
|
* `C:\Windows\System32\Config`
|
|
* Default -> `HKEY_USERS\DEFAULT`
|
|
* SAM -> `HKEY_LOCAL_MACHINE\SAM`
|
|
* SECURITY -> `HKEY_LOCAL_MACHINE\Security`
|
|
* SOFTWARE -> `HKEY_LOCAL_MACHINE\Software`
|
|
* SYSTEM -> `HKEY_LOCAL_MACHINE\System`
|
|
|
|
* `C:\Users\<username>\`
|
|
* NTUSER.DAT -> `HKEY_CURRENT_USER` , hidden file
|
|
* `C:\Users\<username>\AppData\Local\Microsoft\Windows`
|
|
* USRCLASS.DAT -> `HKEY_CURRENT_USER\Sofware\CLASSES`, hidden file
|
|
|
|
* `C:\Windows\AppCompat\Programs\Amcache.hve`
|
|
|
|
### Transaction Logs
|
|
* Saved inside the same directory as the hive which was altered.
|
|
|
|
### Backups
|
|
* Saved every ten days
|
|
* `C:\Windows\System32\Config\RegBack`
|
|
|
|
## Data Acquisition
|
|
* Tools
|
|
* `Autopsy`
|
|
* `FTK Imager`, does not copy `Amcache.hve`
|
|
* `KAPE`, preserves directory tree
|
|
* `Registry Viewer`
|
|
* `Zimmerman's Registry Explorer`, uses transaction logs as well
|
|
* ` AppCompatCache Parser`
|
|
* `RegRipper`, cli and gui
|
|
|
|
## System Information
|
|
* OS Version -> `SOFTWARE\Microsoft\Windows NT\CurrentVersion`
|
|
* Computer Name -> `SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName`
|
|
* Time Zone `SYSTEM\CurrentControlSet\Control\TimeZoneInformation`
|
|
* Network Interfaces -> `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces`
|
|
* Past connected networks -> `SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Unmanaged` and `SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Managed`
|
|
* Services -> `SYSTEM\CurrentControlSet\Services`
|
|
* Service will start at boot with `start` key value `0x02`
|
|
* Users, SAM -> `SAM\Domains\Account\Users`
|
|
|
|
|
|
### Control Sets
|
|
* `ControlSet001` -> last boot
|
|
* `ControlSet002` -> last known good
|
|
* `HKLM\SYSTEM\CurrentControlSet` -> live
|
|
|
|
* Can be found under:
|
|
* `SYSTEM\Select\Current` shows the used control set
|
|
* `SYSTEM\Select\LastKnownGood`
|
|
|
|
## Autostart Programs
|
|
* `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run`
|
|
* `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\RunOnce`
|
|
* `SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce`
|
|
* `SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run`
|
|
* `SOFTWARE\Microsoft\Windows\CurrentVersion\Run`
|
|
|
|
## Recent Files
|
|
* `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs`, e.g. xml, pdf, jpg
|
|
* Office files -> `NTUSER.DAT\Software\Microsoft\Office\VERSION`, `NTUSER.DAT\Software\Microsoft\Office\15.0\Word`
|
|
* Office 365 -> `NTUSER.DAT\Software\Microsoft\Office\VERSION\UserMRU\LiveID_####\FileMRU`
|
|
|
|
## ShellBags
|
|
* `USRCLASS.DAT\Local Settings\Software\Microsoft\Windows\Shell\Bags`
|
|
* `USRCLASS.DAT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU`
|
|
* `NTUSER.DAT\Software\Microsoft\Windows\Shell\BagMRU`
|
|
* `NTUSER.DAT\Software\Microsoft\Windows\Shell\Bags`
|
|
|
|
## Last Open/Saved/Visited Dialog MRUs
|
|
* `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePIDlMRU`
|
|
* `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU`
|
|
|
|
## Explorer Address/Search Bars
|
|
* `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths`
|
|
* `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery`
|
|
|
|
## User Assist
|
|
* GUI applications launched by the user
|
|
* `NTUSER.DAT\Software\Microsoft\Windows\Currentversion\Explorer\UserAssist\{GUID}\Count`
|
|
|
|
## Shim Cache
|
|
* Application Compatibility, AppCompatCache
|
|
* `SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache`
|
|
* Use `AppCompatCacheParser.exe --csv <path to save output> -f <path to SYSTEM hive for data parsing> -c <control set to parse>`
|
|
|
|
### AmCache
|
|
* `C:\Windows\appcompat\Programs\Amcache.hve`
|
|
* Last executed app -> `Amcache.hve\Root\File\{Volume GUID}\`
|
|
* Saves SHA1 of the last executed app
|
|
|
|
## Background Activity Monitor/Desktop Activity Moderator BAM/DAM
|
|
* Saves full path of executed apps
|
|
* `SYSTEM\CurrentControlSet\Services\bam\UserSettings\{SID}`
|
|
* `SYSTEM\CurrentControlSet\Services\dam\UserSettings\{SID}`
|
|
|
|
## Devices
|
|
* Identification
|
|
* USB -> `SYSTEM\CurrentControlSet\Enum\USBTOR`, `SYSTEM\CurrentControlSet\Enum\USB`
|
|
* Device name -> `SOFTWARE\Microsoft\Windows Portable Devices\Devices`
|
|
* First time connected -> `SYSTEM\CurrentControlSet\Enum\USBSTOR\Ven_Prod_Version\USBSerial#\Properties\{83da6326-97a6-4088-9453-a19231573b29}\0064`
|
|
* Last time connected -> `SYSTEM\CurrentControlSet\Enum\USBSTOR\Ven_Prod_Version\USBSerial#\Properties\{83da6326-97a6-4088-9453-a19231573b29}\0066`
|
|
* Last removal time -> `SYSTEM\CurrentControlSet\Enum\USBSTOR\Ven_Prod_Version\USBSerial#\Properties\{83da6326-97a6-4088-9453-a19231573b29}\0067`
|
|
|