RegistryForensics-SantaClaraUniversity.ppt

Registry Forensics COEN 152 / 252 Registry: A Wealth of Information Information that can be recovered include: System Configuration Devices on the System User Names Personal Settings and Browser Preferences Web Browsing Activity Files Opened Programs Executed Passwords Registry History Before the Windows Registry: (DOS, Windows 3.x) INI files SYSTEM.INI – This file controlled all the hardware on the computer system. WIN.INI – This file controlled all the desktop and applications on the computer system. Individual applications also utilized their own INI files that are linked to the WIN.INI. Registry History: INI File Problems Proliferation of INI files. Other problems Size limitations Slow access No standards Fragmented Lack of network support Registry History The Windows 3.x OS also contained a file called REG.DAT. The REG.DAT was utilized to store information about Object Link Embedding (OLE) objects. Registry History The Windows 9x/NT 3.5 Operating System is composed of the following files: System.dat – Utilized for system settings. (Win 9x/NT) User.dat – One profile for each use with unique settings specific to the user. (Win 9x/NT) Classes.dat – Utilized for program associations, context menus and file types. (Win Me only) To provide redundancy, a back-up of the registry was made after each boot of the computer system. These files are identified as: System.dao (Win 95) User.dao (Win 95) Rbxxx.cab (Windows 98/Me) Registry History If there are numerous users on a computer system, the following issues arise: The User.dat file for each individual will be different as to the content. If all users on the computer system utilize the same profile, the information will all be mingled in the User.dat and will be difficult if not impossible to segregate the data. On Windows 9.x systems, the User.dat file for the default user is utilized to create the User.dat files for all new profiles. Registry Definition The Microsoft Computer Dictionary defines the registry as: A