Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Registry Forensics


Published on

Registry, Types of Hives , Tweaks in Windows using Registry

Published in: Technology

Registry Forensics

  1. 1. Registry Forensics Prepared By : SOMESH SAWHNEY MOMENTUM INFOCARE PVT. LTD.
  2. 2. Registry Definition <ul><li>The Microsoft Computer Dictionary defines the registry as: </li></ul><ul><ul><li>A central hierarchical database used in the Microsoft Windows family of Operating Systems to store information necessary to configure the system for one or more users, applications and hardware devices. </li></ul></ul><ul><ul><li>The registry contains information that Windows continually references during operation, such as profiles for each user, the applications installed on the computer and the types of documents that each can create, property sheet settings for folders and application icons, what hardware exists on the system and the ports that are being used. </li></ul></ul>
  3. 3. What is the Registry? <ul><li>Windows Registry is a central database in Windows. The database contains </li></ul><ul><li>most of the &quot;pointers&quot; and &quot;settings&quot; for Windows, programs, hardware and </li></ul><ul><li>users. Pointers tell Windows or programs where to find the resources required </li></ul><ul><li>to perform specific actions. </li></ul><ul><li>Just about any setting that you change -- either in Windows or a program – </li></ul><ul><li>changes the registry. There are some notable exceptions. Firefox, Thunderbird </li></ul><ul><li>and many other &quot;wiser&quot; programs avoid the Registry entirely by saving settings, </li></ul><ul><li>etc. in their own file folders. </li></ul><ul><li>Almost any time you are using your PC there are a swarm of things going on behind the scenes in the Registry, almost like bees around a hive. (In fact, that’s why the major elements of the Registry are called hives.) You can observe these with Regmon . </li></ul>
  4. 4. Why We Need Registry? <ul><li>The System Registry is also where malware &quot;registers&quot; itself to run on the system, or makes other modifications that can have a critical impact on the functioning of your PC. </li></ul><ul><li>Thus, familiarizing yourself with the System Registry is not just a good way to tweak your PC, it's essential if you wish to be able to manually defend it. </li></ul>
  5. 5. Registry: A Wealth of Information <ul><li>Information that can be recovered include: </li></ul><ul><ul><li>System Configuration </li></ul></ul><ul><ul><li>Devices on the System </li></ul></ul><ul><ul><li>User Names </li></ul></ul><ul><ul><li>Personal Settings and Browser Preferences </li></ul></ul><ul><ul><li>Web Browsing Activity </li></ul></ul><ul><ul><li>Programs Executed </li></ul></ul><ul><ul><li>Files Opened </li></ul></ul>
  6. 6. How It Looks Like ? Top tier items are folders known as keys which, when expanded, display various second tier items, also known as keys. Additional third-tier keys may also be contained within second tier keys, etc In other words, just as Windows has folders and subfolders, the registry has keys and subkeys. Within those keys are values. To see the values a particular key contains, you first select (highlight) the key in the left pane, and the value(s) will appear in the right pane.
  7. 7. Registry Organization <ul><li>Root Keys </li></ul><ul><ul><li>HKEY_CLASSES_ROOT (HKCR) </li></ul></ul><ul><ul><ul><li>Contains information in order that the correct program opens when executing a file with Windows Explorer. </li></ul></ul></ul><ul><ul><li>HKEY_CURRENT_USER (HKCU) </li></ul></ul><ul><ul><ul><li>Contains the profile (settings, etc) about the user that is logged in. </li></ul></ul></ul><ul><ul><li>HKEY_LOCAL_MACHINE (HKLM) </li></ul></ul><ul><ul><ul><li>Contains system-wide hardware settings and configuration information. </li></ul></ul></ul><ul><ul><li>HKEY_USERS (HKU) </li></ul></ul><ul><ul><ul><li>Contains the root of all user profiles that exist on the system. </li></ul></ul></ul><ul><ul><ul><li>Contains computer-specific information about the type of hardware installed, software settings, and other information. This information is used for all users who log on to this computer. </li></ul></ul></ul><ul><ul><ul><li>Contains information about all the users who log on to the computer, including both generic and user-specific information. The generic settings are available to all users who log on to the computer. The information is made up of default settings for applications, desktop configurations, and so </li></ul></ul></ul><ul><ul><li>HKEY_CURRENT_CONFIG (HKCC) </li></ul></ul><ul><ul><ul><li>Contains information about the hardware profile used by the computer during start up. </li></ul></ul></ul>
  8. 8. Backing up the Windows registry Microsoft Windows includes a new feature known as system restore . This great new feature enables a user to backup and restore their important system files from an earlier day. By default this feature automatically creates a backup of the system each day. If you wish to create a restore point of your system follow the below steps. Click Start, Programs, Accessories, System Tools, System Restore Select the option to Create a restore point Click next and follow the remainder steps.
  9. 9. Five primary data types in a Registry. Here are the five primary data types in a Registry. REG_SZ (string value) -- numbers and text REG_MULTI_SZ (string array value) -- numbers and text you can edit but not create REG_EXPAND_SZ (expanded string value) -- usually points to the location of files REG_BINARY (binary values) -- binary data REG_DWORD (DWORD values) -- a hexadecimal data type
  10. 10. How to disable USB storage devices from a computers in the network. Go to -: HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesUsbStorStart And set its value to 3-(Enable) , 4 (Disable) It only works if the USB storage driver is already installed. If it has not yet been installed, Windows' plug & play subsystem automatically resets the Start value to 3 (Manual) when it installs USBSTOR after a USB storage device is plugged in for the first time.
  11. 11. Disable Internet Access (All Windows) Open your registry and find the key below. [HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings] Change the value of &quot;ProxyEnable&quot; and set it to &quot;1&quot;. Change the value of &quot;ProxyServer&quot; and set it to an IP address and port that is invalid on your network such as &quot;; (i.e. &quot;IP:Port&quot;). By changing these settings Internet access will be disabled for any applications that rely of the Microsoft proxy server information such as Internet Explorer, Microsoft Office, Opera browser. To stop users from modifying the proxy settings add these restrictions to disable changes to the Internet configuration. Find or create the key below: [HKEY_CURRENT_USERSoftwarePoliciesMicrosoftInternet ExplorerControl Panel] Create two DWORD values named &quot;Connection Settings&quot; and &quot;Connwiz Admin Lock&quot; and set them both to &quot;1&quot;. To remove the restriction, set the proxy settings back to their original values and delete the policy values.
  12. 12. Restrict Applications Users Can Run (All Windows) Open your registry and find the key [HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersion PoliciesExplorer] Create a new DWORD value and name it &quot;RestrictRun&quot; set the value to &quot;1&quot; to enable application restrictions or &quot;0&quot; to allow all applications to run. Then create a new sub-key called [HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersion PoliciesExplorerRestrictRun] and define the applications that are allowed. Creating a new string value for each application, named as consecutive numbers, and setting the value to the filename to be allowed (e.g. &quot;regedit.exe&quot;). Restart Windows for the changes to take effect.