Windows Registry Analysis with Registry Explorer
The registry could be considered a special type of file system used by Microsoft Windows operating systems to store different settings.
The registry stores low-level system settings,application settings, and user preferences and settings to.
Why Examine the Registry?
It could have a great effect on the examination.Below is a partial list of useful artifacts that could be mentioned and found in the registry.
- Maintains system configurations and functionality settings
- Whether the system is to clear the page file on shutdown
- Recyle Bin settings and whether to bypass it or not
- Settings related to enable/disable Windows Firewall
- User preferences and historical activty such as opening files,and recently used stuff
- We can also find programs will automatically start when the Windows starts
Registry Structure
The windows registry is divided into a couple of data structures:
Hives: contain keys(directories) and values
Keys: might contain subkeys and/or values
Subkeys: no difference between key and subkey structure
Values: store data
Registry Explorer
Last year, Windows Internals specialist Pavel Yosifovich released a program called Registry Explorer that aims to modernize the registry editor with a host of new features.
Registry Explorer is published as an open source project on GitHub. You can access the source here.
Before we start with the Registry Explorer, which has an interface like the one above, let’s look at what we need to import into Registry Explorer. We need to export SAM, SECURITY, SOFTWARE, SYSTEM files hives. HKEY_LOCAL_MACHINE.
Now we can start solving the following tasks.
Let’s import our SYSTEM hive by saying File -> Load offline hive
After doing that, you will get something like the following:
Now you need to expand the first row, and then you need to navigate all the way through SYSTEM until you reach the “Select” key, as seen in the snapshot below.
1- What is the name of the computer?
ControlSet001>Control>ComputerName
You can access System Product Information directly under CurrentVersion.
2- What is the time zone used by this system?
SYSTEM\ControlSet001\Control\TimeZoneInfromation
Get Saniye Nur’s stories in your inbox
Join Medium for free to get updates from this writer.
When we go to this directory, the result will be as follows.
This is the most important value to be used to establish time-related to UTC, and it is the one you need to use to determine whether daylight saving is active or not. Check this reference: http://kb.digital-detective.net/display/BF/Identification+of+Time+Zone+Settings+on+Suspect+Computer
3- To whom was this system registered, and what was the system’s root directory?
Microsoft\Windows NT\CurrentVersion
This system was registered to a person named “Hunter” .
4- When was this system last shutdown?
In fact, you can also search for the desired keys in individual directories, but there is an easier way.
If you go to Tools>Find, you can reach the result faster by entering the keyword you are looking for in the search field.
You can find shutdowntime under SYSTEM\ControlSet001\Control\Windows.
Click Data Interpreter to see the data as we want in the Values section and you will see the date and time information here.
It is a Windows FILETIME (64 bit) ==> 2016–06–21 01:34:49 (UTC)
Let’s speed up a little
5- Check the system’s firewall and see if RDP was enabled or not
We should always check the Windows Firewall and Remote Desktop, just in case. The Firewall and Remote Desktop settings are found under:
SYSTEM\ControlSet###\Services\SharedAccess\Parameters\FirewallPolicy
This clearly says that the firewall is enabled(value 1 here represents true which means it is enabled).
6- What was the name of the last user that logged into the system?
***LastLoggedOnUser***
7- What was the GUID of the active network interface, and what is the IP address given to this machine?
To answer this, I need you to navigate to the following location: SYSTEM\ControlSet###\Services\Tcpip\Parameters\Interfaces\{GUID}\
Now, if you check the values found within that key, you can find that the computer was given an IP Address which was 10.0.2.15 from the DHCP Server which had the IP Address 10.0.2.2, as seen in the figure above.
8- List mounted devices in the system.
9- What applications are installed on this machine?SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths
10-What is the software application that was executed the most?
Remember to sort by count to find the result here.
References
https://github.com/zodiacon/TotalRegistry
