Difference between revisions of "Windows Registry"

From ForensicsWiki
Jump to: navigation, search
m (adding Forensic Registry EDitor (fred))
(Open Source)
(2 intermediate revisions by one other user not shown)
Line 28: Line 28:
 
* [http://code.google.com/p/registrydecoder/ Registry Decoder] offline analysis component, by Andrew Case
 
* [http://code.google.com/p/registrydecoder/ Registry Decoder] offline analysis component, by Andrew Case
 
* [http://code.google.com/p/registrydecoder/ RegDecoderLive] live hive acquisition component, by Andrew Case
 
* [http://code.google.com/p/registrydecoder/ RegDecoderLive] live hive acquisition component, by Andrew Case
 +
* libregfi
 +
* [[libregf]] and tools
  
 
===Freeware===
 
===Freeware===
Line 33: Line 35:
  
 
* [http://www.tzworks.net/prototype_page.php?proto_id=14 Windows ShellBag Parser] Free tool that can be run on Windows, Linux or Mac OS-X.
 
* [http://www.tzworks.net/prototype_page.php?proto_id=14 Windows ShellBag Parser] Free tool that can be run on Windows, Linux or Mac OS-X.
 +
 +
* [http://tzworks.net/prototype_page.php?proto_id=19 ''cafae''] - Computer Account Forensic Artifact Extractor.  Free tool that can be run on Windows, Linux or Mac OS-X to parse ntuser.dat hives.
  
 
===Commercial===
 
===Commercial===

Revision as of 01:27, 8 June 2012

File Locations

The Windows Registry is stored in multiple files.

Windows NT 4

In Windows NT 4 (and later) the Registry is stored in the Windows NT Registry File (REGF) format.

Basically the following Registry hives are stored in the corresponding files:

  • HKEY_USERS: \Documents and Setting\User Profile\NTUSER.DAT
  • HKEY_USERS/DEFAULT: \Windows\system32\config\default
  • HKEY_LOCAL_MACHINE/SAM: \Windows\system32\config\SAM
  • HKEY_LOCAL_MACHINE/SECURITY: \Windows\system32\config\SECURITY
  • HKEY_LOCAL_MACHINE/SOFTWARE: \Windows\system32\config\software
  • HKEY_LOCAL_MACHINE/SYSTEM: \Windows\system32\config\system

Windows 98/ME

  • \Windows\user.dat
  • \Windows\system.dat
  • \Windows\profiles\user profile\user.dat

Tools

Open Source

Freeware

  • cafae - Computer Account Forensic Artifact Extractor. Free tool that can be run on Windows, Linux or Mac OS-X to parse ntuser.dat hives.

Commercial

Bibliography

See Also