O'Reilly logo

Mastering Windows Network Forensics and Investigation, 2nd Edition by Scott Pearson, Ryan Johnson, Steve Bunting, Steven Anson

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Finding Information in the Software Key

The information found in the Software key (HKLM\SOFTWARE) is located in a file named software, as shown in Figure 9-1. This file is found in the path %SystemRoot%\system32\config and should not be confused with the Software key found in the HKEY_CURRENT_USER key, abbreviated HKCU. The HKLM\SOFTWARE key contains software settings for the local machine, while HKCU\Software contains software settings that are user specific. Although both are important, our current focus is on the local machine software settings.

Figure 9-1: Location of the software hive file in the path %SystemRoot%\system32\config

c09f001.tif

Installed ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required