The Windows Registry is one of the richest sources of digital evidence. You can find lots of extremely useful pieces of information during examination of the Registry hives and keys. Computer configurations, recently visited webpages and opened documents, connected USB devices, and many other artifacts can all be acquired through Windows Registry forensic examination.
The Registry has a tree structure. Each tree consists of keys, and each key may have one or more subkeys and values.
As forensic examiners usually deal with drive images, it's very important to know where these registry files are stored. The first six files are located at C:\Windows\System32\config. These files are:
- COMPONENTS
- DEFAULT
- SAM
- SECURITY
- SOFTWARE
- SYSTEM
There are also two files for each user account:
- NTUSER.DAT, located at C:\Users\%Username%\
- UsrClass.dat, located at C:\Users\%Username...
