Delving into the intricate world of digital forensics, this blog post centers on the indispensable role of the Windows Registry. As a vital repository of system data, the Windows Registry proves to be a linchpin in forensic investigations. In this exploration, we unravel the crucial role it plays, shedding light on its significance for digital forensic analysts.
Understanding Windows Registry
Windows Registry is an integral component of Windows operating systems and contains essential data related to system configuration. However, it is not just a storage repository for this information; it also houses various data that carry timestamps related to user activities.
The Registry records the launch time of any application, user access to the Control Panel, and even window positions and dimensions. For a forensic analyst, understanding and effectively utilizing this data is vital for creating timelines of events or analyzing incidents.
There are several other important Registry values that can impact the examination process. Let’s take a closer look at some of them:
File System Tunneling
File System Tunneling is a Registry value that can modify or disable the functioning of file systems.
System Crash Dump, Prefetcher, and System Restore Point Behavior
These values affect the system crash dump creation and system restore point functionalities.
Page Clearing System
This Registry value regulates the process of clearing memory when the system is shut down. It can impact the preservation or deletion of sensitive or historical data.
Event Log Control
This value controls the enabling or disabling of event logs. Event log records are of vital importance for security and monitoring purposes.
Windows Firewall
This Registry value regulates the enabling or disabling of the Windows firewall. The firewall plays a critical role in controlling network traffic and preventing security threats.
Locating Windows Registry on Disk
It is essential for an analyst to know where these files are located on the disk so that they can be extracted and analyzed. The main system Registry hive files (SAM, Security, Software, and System) can be found in the Windows\system32\config directory.
Let’s explore the significance of these locations and what information we can obtain from them:
Time Zone Information
The key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInf\TimeZoneKeyName provides information about the time zone settings on the computer.
Computer Name
The key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName stores the computer’s name.
Last Insertion Time of Connected USB Drives
The key HKLM\SYSTEM\CurrentControlSet\Control\DeviceClasses provides information about the last insertion time of USB drives.
Last Shutdown Time of the System
The key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Windows\ShutDownTime records the last shutdown time of the system.
Detection of Virtual Machines
The key HKLM\SYSTEM\CurrentControlSet\Enum\PCI can help determine if a virtual machine is present.
Installed Programs after Operating System Installation
The key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall contains information about all programs installed after the operating system installation.
File Hierarchy Information from the Network Drive
The path HKEY_USERS[User]\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\8\0… provides a file hierarchy information from the network drive.
Internet Explorer Browsing History
The key HKU\SOFTWARE\Microsoft\Internet Explorer\TypedURLs stores the URLs of websites visited using Internet Explorer.
Email Client Usage
The key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mailto\shell\open\command indicates the application or software used for email communication.
Attached External Storage Devices
The information about attached external storage devices can be found in the “setupapi.dev.og” file within the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\VolumeInfoCache key.
Startup Applications
The key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run provides information about the applications that run at startup.
Location of the Used Web Browser
The path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb contains the location of the used web browser.
Location of User Email Information
The location where user email information is stored is C:\Users[User_AUBdı]\AppData\Local\Microsoft\Outlook.
Windows Registry can be thought of as a directory structure, similar to a root directory. Root keys represent the top level of the Registry and are divided into different categories. Keys correspond to subdirectories within these categories, and within these subdirectories, subkeys are located, representing the lowest level directories. Values, on the other hand, correspond to files and store the data within this structure.
Registry Structure
The Registry structure consists of five root keys:
- HKEY_CURRENT_USER (HKCU): This key contains user-specific customizations and settings on the system where the current user is logged in. It stores user customization preferences such as desktop backgrounds, screen resolutions, and application preferences. Each user is represented by a unique HKEY_CURRENT_USER key.
- HKEY_USERS (HKU): This key contains configuration data for all user profiles. It creates a unique subkey for each user. HKEY_CURRENT_USER is actually derived from this key, and the subkey for the logged-in user can be found here.
- HKEY_LOCAL_MACHINE (HKLM): This key contains system-wide configuration data, including hardware settings, operating system configurations, system services, drivers, and more. It provides shared configuration data for all users.
- HKEY_CLASSES_ROOT (HKCR): This key contains records related to file extensions, file types, and associated applications.
- HKEY_CURRENT_CONFIG (HKCC): This key provides a snapshot of the current hardware and configuration of the system. It includes hardware profiles, device drivers, and other hardware settings.
It is important to note that with more recent versions of Windows, Microsoft has implemented redirection and virtualization with regards to the Registry. This means that certain Registry calls made by 32-bit applications on 64-bit Windows versions are redirected to a different section of the Software hive, resulting in the information appearing in the HKEY_LOCAL_MACHINE\Software\Wow6432Node path instead of the HKEY_LOCAL_MACHINE\Software path. Additionally, Registry virtualization refers to the mechanism where system-wide Registry changes (write operations, key or value creation) are written to a “virtual store” at HKEY_USERS_Classes\VirtualStore\Machine\Software.
Additional Information
- Amcache Hive: Amcache is a component or data store used to store application execution information in Windows operating systems. It is utilized to track which applications were executed and which files were affected or modified.
- Current Control Set: Current Control Set refers to the hive(s) in the Registry that control system startup and contain system configuration data. Typically, there are two different Control Sets in the SYSTEM hive of a computer: ControlSet001, which represents the Control Set the computer started with, and ControlSet002, which represents the Last Known Good Configuration.
- ShimCache: ShimCache is a mechanism used to track the compatibility between the operating system and applications and records all applications launched on a machine. It is the primary purpose of ShimCache to ensure backward compatibility of applications. Also known as Application Compatibility Cache, it is located at SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache in the Registry.
- BAM/DAM: Background Activity Monitor (BAM) and Desktop Activity Moderator (DAM) are part of Microsoft Windows’ Modern Standby system. BAM monitors the activities of background applications, while DAM is responsible for optimizing power consumption on the device. These components can be found in the following Registry locations: SYSTEM\CurrentControlSet\Services\bam\UserSettings{SID} and SYSTEM\CurrentControlSet\Services\dam\UserSettings{SID}.
With a deep understanding of Windows Registry and its importance in digital forensics, forensic analysts can extract crucial information and create a comprehensive timeline of events. By leveraging the data stored in different Registry locations, analysts can uncover valuable insights and evidence. The systematic analysis of Registry data can greatly aid in solving cybercrimes and providing critical information for legal proceedings.
