1. Registry Structure What is it? What does it contain?

2. Objectives Logical and physical structure of the Registry Format of Registry files Examination of the Registry Forensically important keys Analyzing Registry information

3. The Registry Hierarchal database Maintains configuration settings –Applications –Hardware –Devices –Users

4. Registry Access regedit.exe – A “GUI” interface to the Registry Native to XP and Vista NT and 2000 has regedit.exe but with limited capabilities

5. Physical Structure Binary files Stored in RAM and hard drive Limited data types

6. Logical Structure Highest Level My Computer Contains Five Root Hives Each Hive consists of Hives and Keys Each key has a set of triples Subkey list Last access time

7. Key Structure

9. Registry Data Types Series of nested arrays designed to store a list of resources A list of resources used by a physical HW device A list of HW resources used by a device driver

10. Hives - Physical A Hive is a logical file from multiple files on disk and RAM The Registry is the collection of these hives Each hive contains a registry tree Each hive has a key that serves as the root or starting point of the tree The integration of all these hives into the root hives consists of the registry

11. Five Root Hives

12. Root Hives HKEY_USERS Contains all the actively loaded user profiles for the system HKEY_CURRENT_USER Is the active, loaded user profile currently logged on HKEY_LOCAL_MACHINE Contains configuration information for the system bot HW and SW

13. Root Hives (cont’d) HKEY_CURRENT_CONFIG Contains the hardware profile the system uses at startup HKEY_CLASSES_ROOT Contains configuration information for which apps open which files

14. Registry-to-File Correspondence Hive Registry PathHive File Path HKEY_LOCAL_MACHINE\SYSTEM\Windows\System32\Config\System HKEY_LOCAL_MACHINE\SAM\Windows\System32\Config\Sam HKEY_LOCAL_MACHINE\SECURITY\Windows\System32\Config\Security HKEY_LOCAL_MACHINE\SOFTWARE\Windows\System32\Config\Software HKEY_LOCAL_MACHINE\HARDWAREVolatile hive HKEY_LOCAL_MACHINE\SYSTEM\CloneVolatile hive (Win 2K only) HKEY_USERS\ \Documents and settings\ \Ntuser.dat HKEY_USERS\ _Classes\Documents and Settings\ \Local Settings\Application Data\Microsoft\Windows\Usrclass.dat HKEY_USERS\.DEFAULT\Windows\System32\Config\Default

15. Hive File Locations

17. Restore Points

18. HKEY_USERS User Profiles

19. HKEY_CURRENT_USER Logged on user profile

20. Current User One of those listed in HKEY_USERS

21. HKEY_LOCAL_MACHINE HW and SW Configs

23. HKEY_CURRENT_CONFIG Startup Profile

24. HKEY_CLASSES_ROOT Application to File Mapping This hive is subclassed to HKCU\Software\Classes HKLM \Software\Classes

25. Registry Cell Types Key cell Key info, offsets to subkeys and LastWrite time Value cell Holds a value/name and its data Subkey list cell Series of subkey offsets Value list cell Series of offsets to value cells

26. Registry Structure Keys Subkeys Values Type Data

27. Raw Registry File Key Cell Value Cell