The purpose of this article is to provide you with a depth understanding of the Windows Registry and Wealth of information it holds.Today most administrators and forensic analysts, the registry probably looks like the entrance to a dark.
Besides Configuration information, the Windows Registry holds information regarding recently accessed files and considerable information about user activities.
The truth is that the Registry is a veritable gold mine of information for both the administrator and forensics investigator.
What is the Registry?
If you remember back to DOS and early versions of Windows(3.1,3.11 and so on ), configuration information (drivers, settings) for the system was largely managed by several files-specifically, autoexec.bat, config.sys, win.ini (on windows)and system.ini.
Various settings within these files determined what programs were loaded and how the system looked and responded to user input, Later versions of windows replaced these files with the Registry, a central hierarchical database that maintains configuration settings for the application, hardware devices, and users.
How Windows Registry Structure Looks!
When the administrator or Forensics expects opens Regedit.exe, he sees a tree-like structure with five root folders, or “hives”.
- HKEY_CLASSES_ROOT hive contains configuration information relating to which application is used to open various files on the system.
- HKEY_CURRENT_USER hive is the active, loaded user profile for the currently logged-on-user.
- HKEY_LOCAL_MACHINE hive contains a vast configuration information for the system, including hardware settings and software settings.
- HKEY_USERS hive contains all the actively loaded user profile for that system.
- HKEY_CURRENT_CONFIG hive contains the hardware profile the system uses at startup.
MRU, throughout or”most recently used” list contains entries made due to specific actions performed by the user.There are numerous MRU LIS throughout various Registry keys.
The Registry maintains these lists of items in case the user returns to them in the future.It is similar to how the history and cookies act to a web browser.
The location of this key is