Mindmap sheet computer forensics of windows registry, to find evidence.

1. Windows Registry
Hives
HKEY_LOCAL_MACHINESAM(KEY) SAM
HKEY_LOCAL_MACHINESecurity(KEY) SECURITY
HKEY_LOCAL_MACHINESystem(KEY) SYSTEM
HKEY_LOCAL_MACHINESoftware(KEY) SOFTWARE
HKEY_USER(KEY) NTUSER.DAT
Tools
RegRipper
YaruRecover delete
Ubication
%WinDir%System32Config
SAM
SECURITY
SYSTEM
SOFTWARE
DEFAULT
NTUSER.dat
(XP) Documents and Settings<username>NTUSER.dat
(Vista,Win7 y 8) Users<username>NTUSER.dat
USRCLASS.dat(Vista,Win7 y 8) Users<username> NTUSER.dat
Evidence
NTUSER.DAT
XP Search History
SoftwareMicrosoftSearch
AssistantACMru
5001 Search the Internet
5603 All or part of the filename
5604 A word or pase in a file
5647 Computers or people
Recent Docs
SoftwareMicrosoftWindowsCurre
ntVersionExplorerRecentDocs
Office Recent Docs SoftwareMicrosoft
10
Word FileMRU
Excel
PowerPoint
11
12
14
Dialog Boxes
LastVisited
Last path of file Opened
Executable Used
SoftwareMicrosoftWindowsCurre
ntVersionExplorerComDI32
LastVisitedMRU
LastVisitedPid1MRU
OpenAndSave
Save File Dialog Box
Open File Dialog Box
SoftwareMicrosoftWindowsCurre
ntVersionExplorerComDI32
OpenSaveMRU
OpenSavePidMRU
Comands Executed
SoftwareMicrosoftWindowsCurre
ntVersionExplorerRunMRU
SoftwareMicrosoftWindowsCurre
ntVersionExplorerPoliciesRunMR
U
Program Executed
SoftwareMicrosoftWindowsCurre
ntVersionExplorerUserAssist
{GUID}Count
encoged ROT-13
Last run time
Run count
UEME_
RUNPATH
RUNCPL
RUNPIDL
UIQCUT
UISCUT
UITOOLBAR
SOFTWARE OS Version
MicrosoftWindows
NTCurrentVersion
SYSTEM
Computer Name
CurrentControlSetControlComput
erNameComputerName
CurrentControlSet
ControlSet00x
SelectCurrent
Network interfaces
CurrentControlSetServicesTcpip
ParametersInterfaces
Time Zone
CurrentControlSetControlTimeZo
neInformation
Formulas
UTC = Local Time + ActiveTimeBias
Local Time = UTC - ActiveTimeBias
Standard Time = Bias + StandardBias
Daylight Time = Bias + DaylightBias
Time Zone Information
CurrentControlSetControlTimeZo
neInformation
Backup%WinDir%System32ConfigRegBack
Properties
TimeStampsEvery Key has Last Write TimeTime UTC
MRU
Most Recent Used MRUList
MRUList
Key value for Keep track most
recent additions
Knowing the exact order will aid in
determing the order of activity
Last write time of the Key will be
the time the first MRUlist entry
value occurred