Windows Forensics 101: The Registry: Where Windows Keeps Its Diary

Series: Windows Forensics | Author: Tech Corsair | Published: techcorsair.co.uk

Everyone has that friend who writes down everything. Every conversation, every slight, every time someone borrowed a pen and didn't return it. Windows is that friend. Except instead of a passive-aggressive journal stuffed under a mattress, it maintains a sprawling hierarchical database called the Registry -- and it has been meticulously documenting your every move since the moment you installed the operating system.

For forensic analysts, this is brilliant news. For anyone who's ever done something regrettable on a work computer, rather less so.

The Windows Registry is, without exaggeration, one of the single richest sources of forensic evidence on a Windows system. It records what software was installed, when users logged in, what devices were connected, what files were opened, what networks were joined, and approximately forty-seven thousand other things that nobody asked it to track. It's the digital equivalent of CCTV footage -- except it covers everything and it never runs out of tape.

Let's dig in.

What Is the Registry, Actually?

The Registry is a hierarchical database that stores configuration settings for the operating system, hardware, installed software, and individual users. It's organised into five root keys:

But forensic analysts don't interact with these live root keys -- they work with the underlying hive files that back them. These are the actual files on disk that contain the data, and they can be extracted and analysed offline. This is where the real fun begins.

The Hive Files: Where They Live and What They Know

SYSTEM Hive

Location: C:\Windows\System32\config\SYSTEM

The SYSTEM hive is the registry's operations manual. It knows about hardware, services, mounted devices, and the system's boot configuration. Key forensic artefacts include:

• ComputerName: SYSTEM\ControlSet001\Control\ComputerName\ComputerName -- confirms the hostname. Useful when someone claims "that wasn't my machine."
• TimeZoneInformation: SYSTEM\ControlSet001\Control\TimeZoneInformation -- critical for timeline analysis. Getting timestamps wrong because you assumed UTC is a career-limiting move.
• NetworkList: SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{GUID} -- IP configurations for network interfaces.
• MountedDevices: SYSTEM\MountedDevices -- maps drive letters to device signatures. Essential for USB forensics (more on that in WF-105).
• Services: SYSTEM\ControlSet001\Services -- every installed service, including ones planted by threat actors who fancied a bit of persistence.

Key Path: SYSTEM\ControlSet001\Services\<MaliciousService>
Values:   ImagePath = C:\Windows\Temp\totally_legitimate.exe
          Start     = 2 (Auto Start)
          Type      = 16 (Own Process)

If you see a service with Start = 2 pointing to something in C:\Windows\Temp, you may wish to investigate further. Or take the rest of the day off. Dealer's choice.

SAM Hive

Location: C:\Windows\System32\config\SAM

The Security Account Manager is where Windows stores local user account information. It's essentially the building's visitor logbook, except it also tracks the residents.

Key forensic value:

The SAM is locked while Windows is running, which is why forensic practitioners extract it from a forensic image or use Volume Shadow Copies. Trying to copy it from a live system is an exercise in frustration that ranks somewhere between "assembling flat-pack furniture" and "explaining DNS to management."

Account:       SuspiciousAdmin
RID:           1005
Created:       2024-03-15 02:47:33 UTC
Last Login:    2024-03-15 02:48:01 UTC
Login Count:   1

An admin account created at 2:47 AM that was used exactly once? That's not suspicious at all. Nothing to see here.

SOFTWARE Hive

Location: C:\Windows\System32\config\SOFTWARE

The SOFTWARE hive is the registry's filing cabinet for every application that's ever been installed. It's enormous, it's messy, and it contains absolute gold for forensic work.

Key artefacts:

• Installed Programs: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ -- lists installed software with names, versions, install dates, and publishers.
• NetworkList: SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{GUID} -- records every network the system has connected to, with first and last connection timestamps. Yes, it remembers the dodgy hotel Wi-Fi from 2019.
• Run/RunOnce Keys: SOFTWARE\Microsoft\Windows\CurrentVersion\Run -- programs set to execute at startup. A favourite haunt of malware authors everywhere.
• Operating System Info: SOFTWARE\Microsoft\Windows NT\CurrentVersion -- OS version, build number, install date.
• SRUM (System Resource Usage Monitor): Referenced here but stored separately in C:\Windows\System32\sru\SRUDB.dat -- tracks application resource usage over 30-60 days.

Key:   SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{GUID}
Name:  "YOURCOMPANY-GUEST"
First Connected: 2024-01-10 09:15:22
Last Connected:  2024-06-22 17:45:03

SECURITY Hive

Location: C:\Windows\System32\config\SECURITY

The SECURITY hive stores local security policy settings, cached domain credentials, and audit policies. It's the most tightly protected hive -- even administrators can't open it through regedit without some persuasion.

Forensic highlights:

• Cached Domain Logons: Useful for identifying domain accounts that have authenticated on the system.
• Security Policy Settings: Audit configurations, user rights assignments.
• LSA Secrets: Encrypted service account passwords and other sensitive data. Tools like Mimikatz target these specifically, which is why the security community gets collectively twitchy about credential hygiene.

This hive is less commonly examined than SYSTEM or SOFTWARE, but in domain compromise investigations, it's essential reading.

NTUSER.DAT

Location: C:\Users\\NTUSER.DAT

If the system hives are the building's security logs, NTUSER.DAT is the personal diary of each individual user. Every user profile has one, and it records a staggering amount of per-user activity.

Key forensic artefacts:

The UserAssist key deserves special mention. It records every program launched via the GUI, how many times, and when -- but it encodes the paths in ROT13. As obfuscation goes, this is roughly equivalent to writing your password on a sticky note and then flipping it upside down. Tools handle the decoding automatically, so it's really just a minor historical curiosity at this point.

UsrClass.dat

Location: C:\Users\\AppData\Local\Microsoft\Windows\UsrClass.dat

The often-overlooked younger sibling of NTUSER.DAT. UsrClass.dat stores shellbag data -- records of every folder a user has browsed in Explorer, including folders on removable media and network shares that may no longer exist.

Shellbags are forensically significant because:

• They prove a user navigated to specific folders
• They persist even after folders are deleted
• They record timestamps of first and last interaction
• They capture folder views on external/removable media

Shellbag Entry:
Path:         E:\Confidential_Project\Financial_Reports\
First Explored: 2024-02-14 11:22:15
Last Explored:  2024-02-14 11:24:33

That entry persists in the registry even if the USB drive is long gone and the folder has been deleted. Windows remembers. Windows always remembers.

Tools of the Trade

The forensic community has produced excellent tools for registry analysis. Here are the essentials:

Eric Zimmerman's Tools (EZ Tools)

The gold standard for Windows forensic parsing. Key registry tools:

# Parse a registry hive with RECmd using a batch file
RECmd.exe -f C:\Evidence\SYSTEM --bn BatchExamples\RECmd_Batch_MC.reb --csv C:\Output\

RegRipper

Harlan Carvey's RegRipper has been a staple of forensic registry analysis for years. It uses plugins to extract specific artefacts from hive files:

# Run RegRipper against an NTUSER.DAT file
rip.exe -r C:\Evidence\NTUSER.DAT -a > ntuser_output.txt

# Run a specific plugin
rip.exe -r C:\Evidence\SYSTEM -p compname

Honourable Mentions

• Registry Viewer (AccessData): Commercial viewer bundled with FTK
• yarp: Yet Another Registry Parser -- Python library for programmatic access
• python-registry: Another Python option for scripted analysis

Practical Workflow: Analysing Registry Hives

A solid registry forensic workflow looks something like this:

1. Collect the hives -- Extract from forensic image or live system (using tools like KAPE or FTK Imager). Don't forget the transaction logs (.LOG1, .LOG2) -- they contain data not yet flushed to the main hive file.
1. Process with RECmd in batch mode -- Run all hives through RECmd with a comprehensive batch file to extract known artefacts into CSV.
1. Review with Registry Explorer -- Open hives in the GUI for targeted investigation. Use bookmarks to jump to forensically relevant keys.
1. Cross-reference with timeline -- Registry timestamps are last-modified times on keys. Correlate with other artefact timestamps for a complete picture.
1. Document findings -- Because if you didn't document it, it didn't happen. Just like the registry itself would want.

# KAPE target for registry hive collection
kape.exe --tsource C: --tdest C:\Evidence\Registry --target RegistryHives

---

Quick Reference: Forensic Gold in the Registry

What You Want to Know	Where to Look
Computer name	SYSTEM: ControlSet001\Control\ComputerName
Time zone	SYSTEM: ControlSet001\Control\TimeZoneInformation
USB device history	SYSTEM: ControlSet001\Enum\USBSTOR
User accounts	SAM: SAM\Domains\Account\Users
Installed software	SOFTWARE: Microsoft\Windows\CurrentVersion\Uninstall
Network connections	SOFTWARE: Microsoft\Windows NT\CurrentVersion\NetworkList
Startup programs	SOFTWARE + NTUSER: ...\CurrentVersion\Run
Recently opened files	NTUSER: ...\Explorer\RecentDocs
Programs executed (GUI)	NTUSER: ...\Explorer\UserAssist
Folders browsed	UsrClass.dat: Shellbags
Typed commands	NTUSER: ...\Explorer\RunMRU

---

What's Next in the Series

This is part of the Windows Forensics series on techcorsair.co.uk:

• WF-101: The Registry -- You are here. The diary that never forgets.
• WF-102: Execution Artifacts -- Prefetch, Shimcache, Amcache, and all the ways Windows proves someone ran that dodgy executable.
• WF-104: Event Logs -- The world's most boring novel that could save your job.
• WF-105: USB Devices & Persistence -- Who plugged what where, and why won't this malware leave?

The registry is your starting point, but it's just one piece of the forensic puzzle. Next up: execution artefacts -- because knowing what was on a system is useful, but proving it actually ran is where investigations get interesting.

---

Tech Corsair -- Because someone has to read the registry so you don't have to.