Search icon CANCEL
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Conferences
Free Learning
Arrow right icon
Arrow up icon
GO TO TOP
Digital Forensics and Incident Response

You're reading from   Digital Forensics and Incident Response Incident response techniques and procedures to respond to modern cyber threats

Arrow left icon
Product type Paperback
Published in Jan 2020
Publisher
ISBN-13 9781838649005
Length 448 pages
Edition 2nd Edition
Languages
Concepts
Arrow right icon
Author (1):
Arrow left icon
Gerard Johansen Gerard Johansen
Author Profile Icon Gerard Johansen
Gerard Johansen
Arrow right icon
View More author details
Toc

Table of Contents (22) Chapters Close

Preface 1. Section 1: Foundations of Incident Response and Digital Forensics
2. Understanding Incident Response FREE CHAPTER 3. Managing Cyber Incidents 4. Fundamentals of Digital Forensics 5. Section 2: Evidence Acquisition
6. Collecting Network Evidence 7. Acquiring Host-Based Evidence 8. Forensic Imaging 9. Section 3: Analyzing Evidence
10. Analyzing Network Evidence 11. Analyzing System Memory 12. Analyzing System Storage 13. Analyzing Log Files 14. Writing the Incident Report 15. Section 4: Specialist Topics
16. Malware Analysis for Incident Response 17. Leveraging Threat Intelligence 18. Hunting for Threats 19. Assessment 20. Other Books You May Enjoy Appendix

Registry analysis

There is a great deal of activity that occurs under the hood on the Windows operating system. One place that this activity occurs and is documented is in the Windows Registry. The Windows Registry is a database that stores the low-level system settings for the Windows operating system. This includes settings for devices, security, services, and the storage of user account security settings in the Security Accounts Manager (SAM).

The registry is made up of two elements. The first is the key. The key is a container that holds the second element – the values. These values hold specific settings information. The highest-level key is called the root key and the Windows operating system has five root keys, all of which are stored on the disk in the registry hives. These registry hives are located in the %SystemRoot%\system32\config folder on the Windows file...

lock icon The rest of the chapter is locked
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at €18.99/month. Cancel anytime