02 · Registry
Windows Registry Forensics: Hives, Keys and Workflow
Windows registry forensics in practice: hive files, transaction logs, control sets, LastWrite limits, deleted keys, the keys that matter and RECmd workflows.
Area 02
Registry
The registry is the densest source of evidence on a Windows host. This area explains which hive holds what, how to replay transaction logs into dirty hives, what last write times can and cannot prove, and which keys answer the classic questions about the system and its users.
Key sources
- SYSTEM
- NTUSER.DAT
- UsrClass.dat
Guides in this area
Artifact cheat sheets
Location by Windows version, what each artifact proves, its timestamps and the tools to parse it.
- Registry hivesRegistry hives cheat sheet: SYSTEM, SOFTWARE, SAM, SECURITY, NTUSER.DAT, UsrClass.dat, transaction logs, RegBack, LastWrite times and collection.
- SAM hive and user accountsSAM hive cheat sheet: local accounts, RIDs, last logon and password change times, logon counts, group membership, ProfileList, and account-related event IDs.
- UserAssistUserAssist cheat sheet: NTUSER.DAT GUID keys, ROT13 value names, run count, focus time and last run FILETIME for programs a user launched from Explorer.
- RunMRURunMRU cheat sheet: commands typed in the Windows Run dialog (Win+R) in NTUSER.DAT, MRUList order, the LastWrite time and LOLBin or UNC patterns to hunt.
- RecentDocsRecentDocs cheat sheet: NTUSER.DAT key and per-extension subkeys, MRUListEx order, what the LastWrite time means and how to link entries to LNK files.
- TypedPaths and WordWheelQueryTypedPaths and WordWheelQuery cheat sheet: paths typed in the Explorer address bar and Explorer search terms in NTUSER.DAT, order, timestamps and tips.
- Network profiles (NetworkList)NetworkList cheat sheet: network profiles, SSIDs, gateway MAC addresses, first and last connection times (local time), WLAN profile files and WLAN events.
- Installed Programs (Uninstall Keys, MSI, AppX)Installed programs cheat sheet: Uninstall keys, MsiInstaller events 1033/11707, cached MSIs, AppX packages, winget logs and Amcache to date software installs.
- Bluetooth paired devicesBluetooth devices cheat sheet: BTHPORT paired device keys, MAC addresses and names, LastSeen/LastConnected times, BTHENUM, event logs and fsquirt transfers.
- Group Policy artifactsGroup Policy cheat sheet: SYSVOL policies, Registry.pol, GPP passwords, client-side history and event logs, and how attackers abuse GPO for mass deployment.