COMPUTER FORENSICS & WINDOWS REGISTRY Aradhana Pandey Saumya Tripathi
STEP 1 <ul><li>In initial forensics analysis , it is important to get more information about the owner and the system. So ...
<ul><li>The HKEY_LOCAL_MACHINESoftware Key contains information about the installed software and windows on the system alt...
FIVE BASIC KEYS OF REGISTRY USED IN FORENSICS
 
 
THE REGISTRY AS A LOG  <ul><li>All Registry  keys contain a value associated with them called the  Last Write  time, which...
<ul><li>Unfortunately, only the Last Write time of a registry key can be obtained, where as a Last Write time for the regi...
SIGNIFICANCE <ul><li>Using the Registry as a log is most helpful in the correlation between the Last Write time of a Regis...
 
 
AUTORUN LOCATION <ul><li>Autorun locations are Registry keys that launch programs or applications during the boot process....
<ul><li>If the user denies their involvement then it.s possible their own system was compromised and used to initiate the ...
<ul><li>HKCUSoftwareMicrosoftWindowsCurrentVersionRun  </li></ul><ul><li>HKLMSoftwareMicrosoftWindowsCurrentVersionRunonce...
 
When you run a Microsoft Office XP program, the file Ctfmon.exe (Ctfmon) runs in the background, even after you quit all O...
 
MRU LISTS  <ul><li>MRU, or .most recently used. lists contain entries made due to specific actions performed by the user. ...
 
 
<ul><li>The location of this key is  HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerRunMRU </li></ul>
<ul><li>The chronological order of applications executed via .Run. can be determined by looking at the  Data column of the...
Last accessed from RUN
USERASSIST  <ul><li>UserAssistkey, HCUSoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist,  contains two or more subk...
<ul><li>Each subkey records values that pertain to specific objects the user has accessed on the system, such as Control P...
 
<ul><li>With the UserAssist key, a forensic examiner can gain a better understanding of what types of files or application...
 
<ul><li>These values however, are encoded using a ROT-13 encryption algorithm, sometimes known as a Caesar cipher. This pa...
<ul><li>With the UserAssist key, a forensic examiner can gain a better understanding of what types of files or application...
WIRELESS NETWORKS  <ul><li>A Forensic examiner can determine if a user connected to specific wireless access point, the ti...
 
 
 
LAN COMPUTERS  <ul><li>The Computer Descriptions key is useful in determining whether or not a user was connected to certa...
 
USB DEVICES  <ul><li>Anytime a device is connected to the Universal Serial Bus (USB), drivers are </li></ul><ul><li>querie...
List of all USB devices which are currently connected to the system
 
 
DEVICE ID
MOUNTED DEVICES  <ul><li>There is a key in the Registry that makes it possible to view each drive associated with the syst...
<ul><li>This information can be useful to a digital forensics examiner as it shows the hardware devices that should be con...
 
INTERNET EXPLORER <ul><li>Internet Explorer is the native web browser in Windows operating systems. It utilizes the Regist...
Owner has visited various sites for different transactions
<ul><li>Registry is the treasure of all Activities..Keep a safe distance… </li></ul>
Upcoming SlideShare
Loading in...5
×

Computer Forensics &amp; Windows Registry

1,750

Published on

Published in: Technology
0 Comments
1 Like
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total Views
1,750
On Slideshare
0
From Embeds
0
Number of Embeds
2
Actions
Shares
0
Downloads
0
Comments
0
Likes
1
Embeds 0
No embeds

No notes for slide

Computer Forensics &amp; Windows Registry

  1. 1. COMPUTER FORENSICS & WINDOWS REGISTRY Aradhana Pandey Saumya Tripathi
  2. 2. STEP 1 <ul><li>In initial forensics analysis , it is important to get more information about the owner and the system. So , we should confirm the registered owner and the path of the directory in which windows was installed before forensics analysis. </li></ul>
  3. 3. <ul><li>The HKEY_LOCAL_MACHINESoftware Key contains information about the installed software and windows on the system although the HKEY_LOCAL_MACHINESystem key contains information about windows. </li></ul>
  4. 4. FIVE BASIC KEYS OF REGISTRY USED IN FORENSICS
  5. 7. THE REGISTRY AS A LOG <ul><li>All Registry keys contain a value associated with them called the Last Write time, which is very similar to the last modification time of a file. This value is stored as a FILETIME structure and indicates when the Registry Key was last modified. The Last Write time is updated when a registry key has been created, modified, accessed, or deleted. </li></ul>
  6. 8. <ul><li>Unfortunately, only the Last Write time of a registry key can be obtained, where as a Last Write time for the registry value cannot. </li></ul><ul><li>Knowing the Last Write time of a key can allow a forensic analyst to infer the approximate date or time an event occurred. And although one may know the last time a Registry key was modified, it still remains difficult to determine what value was actually changed. </li></ul>
  7. 9. SIGNIFICANCE <ul><li>Using the Registry as a log is most helpful in the correlation between the Last Write time of a Registry key and other sources of information, such as MAC (modified, accessed, or created) times found within the file system. </li></ul>
  8. 12. AUTORUN LOCATION <ul><li>Autorun locations are Registry keys that launch programs or applications during the boot process. It is generally a good practice to look here depending on the case of examination. For instance, if a computer is suspected to have been involved in a system intrusion case, autorun locations should be looked at. </li></ul>
  9. 13. <ul><li>If the user denies their involvement then it.s possible their own system was compromised and used to initiate the attack. In a case such as this, the autorun locations could prove that the system had a trojan backdoor installed leaving it vulnerable for an attacker to use at their discretion. </li></ul>
  10. 14. <ul><li>HKCUSoftwareMicrosoftWindowsCurrentVersionRun </li></ul><ul><li>HKLMSoftwareMicrosoftWindowsCurrentVersionRunonce </li></ul><ul><li>HKLMSoftwareMicrosoftWindowsCurrentVersionpoliciesExplorerRun </li></ul><ul><li>HKLMSoftwareMicrosoftWindowsCurrentVersionRun </li></ul><ul><li>HKCUSoftwareMicrosoftWindowsNTCurrentVersionWindowsRun </li></ul><ul><li>HKCUSoftwareMicrosoftWindowsCurrentVersionRunOnce </li></ul><ul><li>(ProfilePath)Start MenuProgramsStartup </li></ul>
  11. 16. When you run a Microsoft Office XP program, the file Ctfmon.exe (Ctfmon) runs in the background, even after you quit all Office programs. Ctfmon.exe monitors the active windows and provides text input service support for speech recognition, handwriting recognition, keyboard, translation, and other alternative user input technologies.
  12. 18. MRU LISTS <ul><li>MRU, or .most recently used. lists contain entries made due to specific actions performed by the user. There are numerous MRU lists located throughout various Registry keys. The Registry maintains these lists of items incase the user returns to them in the future. It is basically similar to how the history and cookies act to a web browser. </li></ul>
  13. 21. <ul><li>The location of this key is HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerRunMRU </li></ul>
  14. 22. <ul><li>The chronological order of applications executed via .Run. can be determined by looking at the Data column of the MRUList. value. </li></ul>
  15. 23. Last accessed from RUN
  16. 24. USERASSIST <ul><li>UserAssistkey, HCUSoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist, contains two or more subkeys which have long hexadecimal names that appear as globally unique identifiers (GUIDs). </li></ul>
  17. 25. <ul><li>Each subkey records values that pertain to specific objects the user has accessed on the system, such as Control Panelapplets, shortcut files, programs, etc. </li></ul>
  18. 27. <ul><li>With the UserAssist key, a forensic examiner can gain a better understanding of what types of files or applications have been accessed on a particular system. Even though these entries are not definitive, for they cannot be associated with a specific date and time, it may still indicate a specific action by the user. </li></ul>
  19. 29. <ul><li>These values however, are encoded using a ROT-13 encryption algorithm, sometimes known as a Caesar cipher. This particular encryption technique is quite easy to decipher, as each character is substituted with the character 13 spaces away from it in the ASCII table. </li></ul>
  20. 30. <ul><li>With the UserAssist key, a forensic examiner can gain a better understanding of what types of files or applications have been accessed on a particular system. Even though these entries are not definitive, for they cannot be associated with a specific date and time, it may still indicate a specific action by the user. </li></ul>
  21. 31. WIRELESS NETWORKS <ul><li>A Forensic examiner can determine if a user connected to specific wireless access point, the timeframe, and their IP address they were assigned by the DHCP server. HKLMSYSTEMControlSet001ServicesTcpipParametersInterfaces, </li></ul>
  22. 35. LAN COMPUTERS <ul><li>The Computer Descriptions key is useful in determining whether or not a user was connected to certain computers or belonged to a specific LAN. </li></ul><ul><li>HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerComputerDescriptions. </li></ul>
  23. 37. USB DEVICES <ul><li>Anytime a device is connected to the Universal Serial Bus (USB), drivers are </li></ul><ul><li>queried and the device.s information is stored into the Registry. The </li></ul><ul><li>first important key is HKLMSYSTEMControlSet00xEnumUSBSTOR. This key </li></ul><ul><li>stores the contents of the product and device ID values of any USB device that has ever </li></ul><ul><li>been connected to the system. </li></ul>
  24. 38. List of all USB devices which are currently connected to the system
  25. 41. DEVICE ID
  26. 42. MOUNTED DEVICES <ul><li>There is a key in the Registry that makes it possible to view each drive associated with the system. The key is HKLMSYSTEMMountedDevices and it stores a database of mounted volumes that is used by the NTFS file system. </li></ul>
  27. 43. <ul><li>This information can be useful to a digital forensics examiner as it shows the hardware devices that should be connected to the system. Therefore, if a device is shown in the list of Mounted Devices and that device isn’t physically in the system, it may indicate that the user removed the drive in attempt to conceal the evidence. In this case, the examiner would know they have additional evidence that needs to be seized. </li></ul>
  28. 45. INTERNET EXPLORER <ul><li>Internet Explorer is the native web browser in Windows operating systems. It utilizes the Registry extensively in storage of data, like many applications discussed thus far.Internet Explorer stores its data in the HKCUSoftwareMicrosoftInternet Explorer key. There are three subkeys within the Internet Explorer key that are most important to the forensic examiner. </li></ul>
  29. 46. Owner has visited various sites for different transactions
  30. 47. <ul><li>Registry is the treasure of all Activities..Keep a safe distance… </li></ul>
  1. A particular slide catching your eye?

    Clipping is a handy way to collect important slides you want to go back to later.

×