System Forensics, Investigation, and Response, 3rd Edition

The Registry

What is the Registry? It is a repository for all the information on a Windows system. When you install a new program, its configuration settings are stored in the Registry. When you change the desktop background, that is also stored in the Registry.

According to a Microsoft TechNet article by Joan Bard:

With few exceptions, all 32-bit Windows programs store their configuration data, as well as your preferences, in the Registry, while most 16-bit Windows programs and MS-DOS programs don’t—they favor the outdated INI files (text files that 16-bit Windows used to store configuration data) instead. The Registry contains the computer’s hardware configuration, which includes Plug and Play devices with their automatic configurations ...