Windows Forensic Analysis DVD Toolkit, 2nd Edition

Introduction

To most administrators and forensic analysts, the Registry probably looks like the entrance to a dark, forbidding cave on the landscape of the Windows operating system. Others might see the Registry as a dark door at the end of a long hallway, with the words “Abandon hope, all ye who enter here” scrawled on it. The truth is that the Registry is a veritable gold mine of information for both the administrator and the forensic investigator. In many cases, software used by attackers will create a footprint within the Registry, leaving the investigator clues about the incident. Knowing where to look within the Registry, and how to interpret what you find, will go a long way toward giving you valuable insight into activity that occurred ...