Windows Registry Forensics

1. Registry Analysis

Information in This Chapter

•What Is “Registry Analysis”?

•What Is the Window Registry?

•Registry Structure

This chapter provides an overview of what Registry analysis should consist of and an initial foundation for understanding the binary and logical structure of the Windows Registry.

Keywords

Registry, analysis, Locard, structure, keys, values

Introduction

The Windows Registry is a core component of the Windows operating systems, and it maintains a considerable amount of configuration information about the system. In addition, the Registry maintains historical information about user activity; in order to provide the user with a “better”, more personalized experience, the Registry maintains details about applications ...