analyzing-windows-registry-for-artifacts

# Analyzing Windows Registry for Artifacts ## When to Use - When investigating user activity on a Windows system during an incident - For identifying autorun/persistence mechanisms used by malware - When tracing installed software, USB devices, and network connections - During insider threat investigations to reconstruct user actions - For correlating registry timestamps with other forensic artifacts ## Prerequisites - Forensic image or extracted registry hive files - RegRipper, Registry Explorer (Eric Zimmerman), or python-registry - Access to registry hive locations (SAM, SYSTEM, SOFTWARE, NTUSER.DAT, UsrClass.dat) - Understanding of Windows Registry structure (hives, keys, values) - SIFT Workstation or forensic analysis environment ## Workflow ### Step 1: Extract Registry Hives from the Forensic Image ```bash # Mount the forensic image read-only mkdir /mnt/evidence mount -o ro,loop,offset=$((2048*512)) /cases/case-2024-001/images/evidence.dd /mnt/evidence # Copy system registry hives cp /mnt/evidence/Windows/System32/config/SAM /cases/case-2024-001/registry/ cp /mnt/evidence/Windows/System32/config/SYSTEM /cases/case-2024-001/registry/ cp /mnt/evidence/Windows/System32/config/SOFTWARE /cases/case-2024-001/registry/ cp /mnt/evidence/Windows/System32/config/SECURITY /cases/case-2024-001/registry/ cp /mnt/evidence/Windows/System32/config/DEFAULT /cases/case-2024-001/registry/ # Copy user-specific hives cp /mnt/evidence/Users/*/NTUSER.DAT /cases/case-2024-001/registry/ ...