Glossary
ControlSet and CurrentControlSet
The numbered configuration sets in the SYSTEM hive; CurrentControlSet is a runtime link that does not exist in an offline hive file.
The SYSTEM registry hive stores the machine's boot configuration — services, drivers, device enumeration, time zone, computer name — inside numbered subkeys called control sets: ControlSet001, and sometimes ControlSet002 or more. Each is a complete copy of that configuration.
HKLM\SYSTEM\CurrentControlSet is not a real key on disk. It is a link that Windows creates at boot and points to whichever control set is in use. When you load a SYSTEM hive offline in a forensic tool, CurrentControlSet therefore does not exist, and you must work out which numbered set was active yourself.
The answer is in the HKLM\SYSTEM\Select key. Its Current value holds the number of the control set in use (1 means ControlSet001), while LastKnownGood, Default and Failed record the other roles. Always read Select\Current before interpreting paths such as Services, Enum\USBSTOR or Control\Session Manager\AppCompatCache; an older, non-current set may hold stale data that looks like live configuration.
Most tools resolve this automatically, but when a write-up or cheat sheet quotes a CurrentControlSet path, remember to translate it for offline analysis. This applies to Services, ShimCache and USB device history, all of which live under a control set. Comparing sets can also be useful: differences between them sometimes reveal recent configuration changes, and the key's LastWrite time helps date them.
Related artifacts
- BAM / DAM (Background Activity Moderator)BAM and DAM cheat sheet: SYSTEM hive keys per Windows 10 build, per-user SIDs, last execution FILETIME, seven-day retention and investigation tips.
- Bluetooth paired devicesBluetooth devices cheat sheet: BTHPORT paired device keys, MAC addresses and names, LastSeen/LastConnected times, BTHENUM, event logs and fsquirt transfers.
- Kernel Drivers (.sys, Driver Services, BYOVD)Kernel drivers cheat sheet: driver services (Type 1/2), event 7045, DriverStore, setupapi.dev.log, Amcache and CodeIntegrity logs to hunt BYOVD and rootkits.
- ShimCache (AppCompatCache)ShimCache (AppCompatCache) cheat sheet: SYSTEM hive location, entry limits per Windows version, ordering, timestamp meaning and execution caveats.
- USB device historyUSB forensics cheat sheet: USBSTOR and USB keys, serial numbers, first and last connection times, drive letters, volume serials, setupapi.dev.log and event IDs.
- Windows ServicesWindows services cheat sheet: Services key values (ImagePath, Start, Type, ServiceDll), 7045 and 4697 install events, PsExec traces and pitfalls.