Understanding Windows Registry
The Windows Registry is the very heart of the Windows operating system and will be the source of many artifacts we will discuss later in the chapter. First, I will provide a high-level view of the registry. Then, suppose you want to dig deeper into the nuts and bolts of the registry. In that case, I highly recommend Harlan Carvey’s book Windows Registry Forensics – Advanced Digital Forensic Analysis of the Windows Registry. Harlan Carvey is also the developer of the tool RegRipper, which is a tool we will use in this chapter.
What is the registry? Microsoft defines the registry as a central hierarchical database. This database is used to store configuration information about users, hardware devices, and applications.
But what does that mean for the forensic investigator? Windows continually references the information in the registry during operations. Information in the registry will contain profiles for each user, installed applications...
