Windows Registry Forensics

Infosec via Coursera

Go to Course: https://www.coursera.org/learn/windows-registry-forensics

Introduction

### Course Review: Windows Registry Forensics In the realm of digital forensics, understanding the Windows Registry is essential for any investigator. The **Windows Registry Forensics** course offered on Coursera is a comprehensive program designed for those aspiring to master the art of analyzing the Windows Registry, uncovering essential pieces of data during digital investigations, and enhancing their forensic skills. #### Course Overview The course covers everything from the foundational aspects of the Windows Registry to advanced techniques for extracting and interpreting forensic data from various registry hives. It touches on critical areas such as user account information, installed programs, access logs, and more—elements that are pivotal for drawing conclusions during a forensic investigation. The syllabus is divided into structured modules, each focusing on different facets of the Registry, enabling learners to build their knowledge progressively. #### Module Highlights 1. **Introduction to the Windows Registry**: - This module sets a solid foundation by explaining the significance of the Windows Registry in forensic contexts. It offers an overview of how registry hives are structured and where they reside, which is crucial for live and non-live analysis of systems. 2. **Preparing to Examine the Windows Registry**: - Focused on the practical setup of a forensic workstation, this module guides learners on the tools that enable effective analysis. Understanding these tools ensures that students can maximize their efficacy in registry investigations. 3. **NTUser.Dat Hive File Analysis**: - A deep dive into the NTUser.Dat hive reveals user-specific artifacts, such as typed URLs and recently accessed files. Mastering this section equips students with valuable techniques for uncovering user activities on Windows devices. 4. **SAM Hive File**: - This module delves into account information stored in the Security Account Manager file, which is critical for user identification and activity tracing. Forensics professionals will find insights on recovering user password hashes and understanding login patterns. 5. **Software Hive File**: - The emphasis here is on applications and software executions. This section enhances comprehension of installed programs, logon events, and USB device activities, crucial for case reconstructions. 6. **System Hive File**: - In this module, students learn to explore system-level artifacts, indicating the device's operational state, shutdown events, and service configurations—all integral for understanding system behaviors. 7. **USRClass.dat Hive File**: - This segment introduces advanced forensic artifacts like Windows ShellBags and MUICache, which track user interactions with files, including deleted and accessed folders. 8. **AmCache Hive File**: - This final module examines application execution data, highlighting the importance of executable file paths and first run dates. These insights can be essential in corroborating evidence in digital investigations. #### Recommended For This course is highly recommended for: - **Digital Forensic Professionals**: Those looking to enhance their skills and expertise in Windows Registry analysis. - **Law Enforcement and Legal Professionals**: Individuals involved in cybercrime investigations can greatly benefit from the insights provided. - **IT Security Analysts**: This course offers the underlying knowledge necessary for preventing and responding to security incidents. - **Students**: Anyone interested in starting a career in digital forensics will find this course a solid entry point. #### Conclusion The **Windows Registry Forensics** course on Coursera stands out as an essential resource in the field of digital forensics. With its comprehensive approach, learners can expect to gain practical skills that can be applied in real-world forensic investigations. Whether you are a beginner or an experienced professional, the knowledge acquired through this course will significantly enhance your analytical capabilities regarding the Windows Registry. If you are eager to delve into the intricacies of forensic investigation and wish to improve your skills in a progressively sophisticated manner, I highly recommend enrolling in this course. Visit Coursera, explore the program further, and take a decisive step towards becoming proficient in Windows Registry Forensics.

Syllabus

Introduction to the Windows Registry

Discover what the Windows Registry is and why it is important in digital forensic investigations. This module will explore the location and structure of the registry hives in a live and non-live environment, as well as the types of forensic evidence found in the Windows Registry. This will include: user account information, system-wide and user-specific settings, file access, program installation and execution, search terms, auto-start locations and devices attached to the system. Please use the links and tools provided in the two reading sections to get the URLs and other downloads you will need for the course.

Preparing to Examine the Windows Registry

Learn how to set up a forensic workstation to properly examine the Windows Registry. This module takes a look at the location of the Registry files within the Windows OS and the many tools freely available to view the file structure and artifacts contained within the Windows Registry. It includes instruction on the installation, proper use and validation of your forensic software, showing how to get the most out of your automated tools while maintaining an understanding of what the tool is doing behind the scenes.

NTUser.Dat Hive File Analysis

This module demonstrates an in-depth analysis of the artifacts contained within the NTUser.Dat hive file. This module will show examiners how to locate programs and applications, mounted volumes and connected devices specific to a user, user search terms and typed URLs. Examiners will also be able to locate and identify opened and saved files, typed URLs, user-specific programs set to run at startup and application installation and execution. Examiners will be able to locate, examine and interpret MRU lists (Most Recently Used), UserAssist, user system settings and recently used files.

SAM Hive File

This module explains forensic artifacts found in the SAM (Security Account Manager) file, which stores and organizes information about each user on a system. This module demonstrates how to identify each user account on a local machine using the relative identifier. Examiners can also learn to interpret username information including the users’ login dates, times and login count. The module will show how to identify the machine that the user account was created on, by interpreting a users’ SIDs (machine/domain identifiers) and recovering user password hashes.

Software Hive File

This module will show examiners how to locate information of forensic value relating to application execution and installation contained within the software hive file. The module will provide an overview of the forensic artifacts found in the software hive file, such as installed programs and applications, operating system type, install date and time, wireless network information, file association, domain logon information, the last logged-on user, programs set to run at startup and tracking USB devices that were attached to the system.

System Hive File

This module will demonstrate evidence of forensic value contained within the system hive file. This module explores the system hive file showing how to determine the current control set, computer name, last shutdown date and time, crash dump settings and location, services set to run at startup, page file settings, prefetch settings, last access file time settings, AppCompat Cache, BAM (background activities monitor) and USB device connections and disconnections with dates and times.

USRClass.dat Hive File

This module identifies and explains forensic artifacts found in the UsrClass.dat hive file. This module will look at the UsrClass.dat hive. The examiner will learn to explain Windows ShellBags, which track user-specific zip files and folder access and settings, including dates and times even on deleted folders and removable media. The examiner will also learn to interpret the sub-key MuiCache, to include installed applications. The Microsoft Photo App, showing recently accessed image files, will also be explored.

AmCache Hive File

This module will examine the AmCache hive file, which stores information relating to the execution of applications. A forensic examination of the AmCache hive file showing the following: application installation, application first run date and time, a file path to the executable file, the source of the application, a SHA-1 hash value of the executable file, plug-and-play connected devices, GUIDs of mounted volumes and system hardware information.