Windows Registry Forensics

Preface

I am not an expert. I have never claimed to be an expert at anything (at least not seriously done so), least of all an expert in forensic analysis. I am not an expert in Windows Registry analysis. I am simply, by profession, a responder and analyst with some work and research experience in this area. I have also performed a number of analysis engagements, in which information found as part of Registry analysis has played a rather significant role. In one such engagement, Registry analysis allowed me to provide a compelling argument to demonstrate that files known to contain credit card data had been neither found nor accessed by an intruder, thereby reducing the subsequent costs (with respect to notification and fines) to the customer. ...