Difference between pages "Main Page" and "Windows 7"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
m (WIKI NEWS)
 
 
Line 1: Line 1:
<div style="margin-top:0.5em; padding:0.5em 0.5em 0.5em 0.5em; background-color:#faf0ff; align:right; border:1px solid #ddccff;">
 
This is the '''Forensics Wiki''', a [http://creativecommons.org/licenses/by-sa/2.5/ Creative Commons]-licensed [http://en.wikipedia.org/wiki/Wiki wiki] devoted to information about [[digital forensics]] (also known as computer forensics). We currently list a total of [[Special:Allpages|{{NUMBEROFARTICLES}}]] pages.
 
 
 
Much of [[computer forensics]] is focused on the [[tools]] and [[techniques]] used by [[investigator]]s, but there are also a number of important [[papers]], [[people]], and [[organizations]] involved. Many of those organizations sponsor [[Upcoming_events|conferences]] throughout the year and around the world. You may also wish to examine the popular [[journals]] and some special [[reports]].
 
</div> 
 
  
  
==WIKI NEWS==
+
== File Structure ==  
2013-MAR-18: We have moved to a new server on hostgator. Account creation is still manual.
+
File systems are covered separately.
  
{| width="100%"
+
== SSD ==
|-
+
Per MS [http://support.microsoft.com/kb/2727880 KB2727880], when Windows 7 is installed on a system with an SSD drive, automatic defragmentation and SuperFetch/prefetching are disabled.
| width="60%" style="vertical-align:top" |
+
<!-- Selected Forensics Research --> 
+
<div style="margin-top:0.5em; border:2px solid #ff0000; padding:0.5em 0.5em 0.5em 0.5em; background-color:#ffff99; align:center; border:1px solid #ddccff;">
+
<h2 style="margin:0; background-color:#ffff33; font-size:120%; font-weight:bold; border:1px solid #afa3bf; text-align:left; color:#000; padding-left:0.4em; padding-top:0.2em; padding-bottom:0.2em;"> Featured Forensic Research </h2>
+
  
<small>Jan 2013</small>
+
Further, [http://technet.microsoft.com/en-us/magazine/ff356869.aspx this TechNet post] states:
<bibtex>
+
<i>Since ReadyBoost will not provide a performance gain when the primary disk is an SSD, Windows 7 disables ReadyBoost when reading from an SSD drive.</i>
@article{young:distinct,
+
title="Distinct Sector hashing for Target Detection",
+
author="Joel Young and Kristina Foster and Simson Garfinkel and Kevin Fairbanks",
+
year=2012,
+
month=Dec,
+
journal="IEEE Computer"
+
}
+
</bibtex>
+
Using an alternative approach to traditional file hashing, digital forensic investigators can hash individually sampled subject drives on sector boundaries and then check these hashes against a prebuilt database, making it possible to process raw media without reference to the underlying file system.
+
  
(See also [[Past Selected Articles]])
+
  
| width="40%" style="vertical-align:top" |
 
  
<div style="margin-top:0.5em; border:2px solid #00ff00; padding:0.5em 0.5em 0.5em 0.5em; background-color:#ffeeff; align:center; border:1px solid #ffccff;">
+
== Jump Lists ==
<h2 style="margin:0; background-color:#ffff33; font-size:120%; font-weight:bold; border:1px solid #afa3bf; text-align:left; color:#000; padding-left:0.4em; padding-top:0.2em; padding-bottom:0.2em;">  Featured Article </h2>
+
[[Jump Lists]] are Task Bar artifacts first introduced on Windows 7 (and also available on Windows 8).
;[[Forensic Linux Live CD issues]]
+
:Forensic Linux Live CD distributions are widely used during computer forensic investigations. Currently, many vendors of such Live CD distributions state that their Linux do not modify the contents of hard drives or employ "write protection." Testing indicates that this may not always be the case. [[Forensic Linux Live CD issues|Read More...]]
+
  
|}
+
== Registry ==
 +
The [[Windows_Registry]] remains a central component of the Windows 7 operating system.
  
 +
== Known keys of forensic interest ==
  
<!-- This begins the two-column section -->
+
'''SAM Registry'''
  
{| width="100%"
+
SAM\\SAM\\Domains\\Account\\Users
|-
+
| width="60%" style="vertical-align:top" |
+
  
<div style="margin-top:0.5em; padding:0.5em 0.5em 0.5em 0.5em; background-color:#eeeeff; align:right; border:1px solid #ddccff;">
+
SAM\\SAM\\Domains\\Account\\UsersSAM\\Domains\\Builtin\\Aliases
  
<h2 style="margin:0; background-color:#ccccff; font-size:120%; font-weight:bold; border:1px solid #afa3bf; text-align:left; color:#000; padding-left:0.4em; padding-top:0.2em; padding-bottom:0.2em;">Topics</h2>
 
  
* '''[[File Analysis]]''':
+
'''Security Registry'''
** '''[[:Category:File Formats|File Formats]]''': [[PDF]], [[DOC]], [[DOCX]], [[JPEG]], [[GIF]], [[BMP]], [[LNK]], [[MP3]], [[AAC]], [[Thumbs.db]], ...
+
** '''[[Forensic file formats]]''': [[AFF]], [[gfzip]], [[sgzip]], ...
+
* '''[[File Systems]]''': [[FAT]], [[NTFS]], [[ext2]]/[[ext3]], [[ufs]], [[ffs]], [[reiserfs]], ...
+
** '''[[File Systems#Cryptographic_File_Systems|Cryptographic File Systems]]''': [[File Vault]], [[EFS]], [[CFS]], [[NCryptfs]], [[TCFS]], [[SFS]], ...
+
* '''[[Hardware]]''':
+
** '''[[Bus]]ses''': [[IDE]], [[SCSI]], [[Firewire]], [[USB]], ...
+
** '''[[Data storage media|Media]]''': [[RAM]], [[Hard Drive]]s, [[Memory Card]]s, [[SmartCard]]s, [[RFID]] Tags...
+
** '''[[Personal Digital Devices]]''': [[PDAs]], [[Cellphones]], [[SmartPhones]], [[Audio Devices]], ...
+
** '''[[Other Devices]]''': [[Printers]], [[Scanners]], ...
+
** '''[[Write Blockers]]''': ...
+
* '''Recovering data''': [[Recovering bad data|bad data]], [[Recovering deleted data|deleted data]], [[Recovering Overwritten Data|overwritten data]], [[Sanitization Standards]]
+
* [[Encryption]]
+
* [[GPS]]
+
* [[Forensic_corpora|Forensic Corpora]]
+
* [[Network forensics]]: [[OS fingerprinting]], [[Hidden channels]], [[Proxy server|Proxy servers]]
+
* [[Steganography]], [[Steganalysis]]
+
* '''[[Metadata]]:''' [[MAC times]], [[ACLs]], [[Email Headers]], [[Exif]], [[ID3]], [[OLE-2]], ...
+
* '''[[Legal issues]]:''' [[Caselaw|Case law]]
+
* '''Further information:''' [[Books]], [[Papers]], [[Reports]], [[Journals]], [[Websites]], [[Blogs]], [[Mailing lists]], [[Organizations]], [[Vendors]], [[Conferences]]
+
</div>
+
  
 +
Security\\Policy\\PolAcDmSPolicy\\PolPrDmS
  
 +
Security\\Policy\\PolAdtEv
  
| width="40%" style="vertical-align:top" |
+
Security\\Policy\\Secrets
 
+
<!-- Tools -->
+
<div style="margin-top:0.5em; padding:0.5em 0.5em 0.5em 0.5em; background-color:#e0ffe0; align:right; border:1px solid #ddccff;">
+
 
+
<h2 style="margin:0; background-color:#ccffcc; font-size:120%; font-weight:bold; border:1px solid #afa3bf; text-align:left; color:#000000; padding-left:0.4em; padding-top:0.2em; padding-bottom:0.2em;">[[Tools]]</h2>
+
 
+
* '''[[:Category:Disk Imaging|Disk Imaging]]''': [[dd]], [[dc3dd]], [[dcfldd]], [[dd_rescue]], [[sdd]], [[aimage]], [[Blackbag]], ...
+
* '''[[Tools:Data Recovery|Data Recovery]]''': ...
+
* '''[[Tools#Disk_Analysis_Tools|Disk Analysis]]''': [[EnCase]], [[SMART]], [[Sleuthkit]], [[foremost]], [[Scalpel]], [[frag_find]]...
+
* '''[[Tools#Forensics_Live_CDs|Live CDs]]''': [[DEFT Linux]], [[Helix]] ([[Helix3 Pro|Pro]]), [[FCCU Gnu/Linux Boot CD]], [[Knoppix STD]], ...
+
* '''[[Tools:Document Metadata Extraction|Metadata Extraction]]''': [[wvWare]], [[jhead]], [[Hachoir | hachoir-metadata]], ...
+
* '''[[Tools:File Analysis|File Analysis]]''': [[file]], [[ldd]], [[ltrace]], [[strace]], [[strings]], ...
+
* '''[[Tools:Network_Forensics|Network Forensics]]''': [[Snort]],  [[Wireshark]], [[Kismet]],  [[NetworkMiner]]...
+
* '''[[:Category:Anti-forensics tools|Anti-Forensics]]''': [[Slacker]], [[Timestomp]], [[wipe]], [[shred]], ...
+
* '''[[Tools#Other_Tools|Other Tools]]''': [[biew]], [[hexdump]], ...
+
</div>
+
 
+
<div style="margin-top:0.5em; padding:0.5em 0.5em 0.5em 0.5em; background-color:#c0ffff; align:right; border:1px solid #ddccff;">
+
 
+
<h2 style="margin:0; background-color:#99ffff; font-size:120%; font-weight:bold; border:1px solid #afa3bf; text-align:left; color:#000000; padding-left:0.4em; padding-top:0.2em; padding-bottom:0.2em;">[[:Category:Top-Level|Categories]]</h2>
+
 
+
The contents of this wiki are organized into various [[:Category:Top-Level|categories]]:
+
 
+
* [[:Category:Tools|Tools]]
+
* [[:Category:Disk file systems|Disk file systems]]
+
* [[:Category:File Formats|File Formats]]
+
* [[:Category:Howtos|Howtos]]
+
* [[:Category:Licenses|Licenses]]
+
* [[:Category:Operating systems|Operating systems]]
+
* [[:Category:People|People]]
+
* [[:Category:Bibliographies|Bibliographies]]
+
 
+
</div>
+
 
+
 
+
|}
+
 
+
<div style="margin-top:0.5em; padding:0.5em 0.5em 0.5em 0.5em; background-color:#faf0ff; align:right; border:1px solid #ddccff;">
+
'''You can help!'''  We have a list of [[:Category:Articles_that_need_to_be_expanded|articles that need to be expanded]]. If you know anything about any of these topics, please feel free to chip in.
+
</div>
+
+
 
+
 
+
  
__NOTOC__
+
'''NTUSER Registry'''
 +
NTUSER\\Control Panel\\Desktop
 +
NTUSER\\Control Panel\\don\
 +
NTUSER\\Environment
 +
NTUSER\\Network
 +
NTUSER\\Printers\\Settings\\Wizard\\ConnectMRU
 +
NTUSER\\Software
 +
NTUSER\\Software\\Adobe\\Acrobat Reader\\Software\\Adobe\\Acrobat Reader\\
 +
NTUSER\\Software\\Ahead
 +
NTUSER\\Software\\America Online\\AOL Instant Messenger (TM)\\CurrentVersion\\Users
 +
NTUSER\\Software\\Ares
 +
NTUSER\\Software\\bindshell.net\\Odysseus
 +
NTUSER\\Software\\Blizzard Entertainment\\Warcraft III\\String
 +
NTUSER\\Software\\Cain\\Settings
 +
NTUSER\\Software\\DECAFme
 +
NTUSER\\Software\\Google\\Google Toolbar\\4.0\\whitelist
 +
NTUSER\\Software\\Google\\NavClient\\1.1\\History
 +
NTUSER\\Software\\JavaSoft\\Java Update\\Policy\\JavaFX
 +
NTUSER\\Software\\JavaSoft\\Prefs\\haven
 +
NTUSER\\Software\\Microsoft
 +
NTUSER\\Software\\Microsoft\\Command Processor
 +
NTUSER\\Software\\Microsoft\\Dependency Walker\\Recent File List
 +
NTUSER\\Software\\Microsoft\\IntelliPoint\\AppSpecific
 +
NTUSER\\Software\\Microsoft\\Internet Explorer\\Main
 +
NTUSER\\Software\\Microsoft\\Internet Explorer\\MainSoftware\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AutoCompleteSoftware\\Microsoft\\Internet Account Manager\\Accounts
 +
NTUSER\\Software\\Microsoft\\Internet Explorer\\Settings
 +
NTUSER\\Software\\Microsoft\\Internet Explorer\\TypedURLs
 +
NTUSER\\Software\\Microsoft\\Internet Explorer\\TypedURLsTime
 +
NTUSER\\Software\\Microsoft\\MediaPlayer\\Player\\RecentFileList
 +
NTUSER\\Software\\Microsoft\\Microsoft Management Console\\Recent File List
 +
NTUSER\\Software\\Microsoft\\Multimedia\\OtherSoftware\\Microsoft\\CTF\\LangBarAddIn
 +
NTUSER\\Software\\Microsoft\\Office\\14.0Software\\Microsoft\\Office\\14.0
 +
NTUSER\\Software\\Microsoft\\Office\\Software\\Microsoft\\Office\\
 +
NTUSER\\Software\\Microsoft\\OfficeSoftware\\Microsoft\\Office\\
 +
NTUSER\\Software\\Microsoft\\PIMSRV
 +
NTUSER\\Software\\Microsoft\\Search Assistant\\ACMru
 +
NTUSER\\Software\\Microsoft\\Snapshot Viewer\\Recent File List
 +
NTUSER\\Software\\Microsoft\\Terminal Server Client\\DefaultSoftware\\Microsoft\\Terminal Server Client\\Servers
 +
NTUSER\\Software\\Microsoft\\Terminal Server Client\\Servers
 +
NTUSER\\Software\\Microsoft\\User Location Service\\Client
 +
NTUSER\\Software\\Microsoft\\Windows Live Contacts\\Database
 +
NTUSER\\Software\\Microsoft\\Windows Live Mail
 +
NTUSER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Compatibility Assistant\\Persisted
 +
NTUSER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Layers
 +
NTUSER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\PrinterPorts
 +
NTUSER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows
 +
NTUSER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles
 +
NTUSER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\0a0d020000000000c000000000000046
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\App Management\\ARPCache
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Applets
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\BitBucket
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComDlg32
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComputerDescriptions
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanel
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Map Network Drive MRU
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MenuOrder
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\PublishingWizard\\AddNetworkPlace\\AddNetPlace\\LocationMRU
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StreamMRU
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\TypedPaths
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Wallpaper\\MRU
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WordWheelQuery
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Settings\\{8AD9C840-044E-11D1-B3E9-00805F499D93}
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\FileHistory
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet SettingsSoftware\\Microsoft\\Internet Explorer\\Main\\WindowsSearch
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\UFH\\SHC
 +
NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\UnreadMail
 +
NTUSER\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop
 +
NTUSER\\Software\\Nico Mak Computing\\WinZip
 +
NTUSER\\Software\\ORL\\VNCHooks\\Application_Prefs
 +
NTUSER\\Software\\ORL\\VNCviewer\\MRUSoftware\\RealVNC\\VNCViewer4\\MRU
 +
NTUSER\\Software\\Piriform\\CCleaner
 +
NTUSER\\Software\\Privoxy
 +
NTUSER\\Software\\RealNetworks\\RealPlayer\\6.0\\Preferences
 +
NTUSER\\Software\\RealVNC\\VNCViewer4\\MRU
 +
NTUSER\\Software\\SimonTatham\\PuTTY\\SshHostKeys
 +
NTUSER\\Software\\Skype
 +
NTUSER\\Software\\SmartLine Vision\\aports
 +
NTUSER\\Software\\SysInternals
 +
NTUSER\\Software\\Sysinternals\\RootkitRevealer
 +
NTUSER\\Software\\VMware
 +
NTUSER\\Software\\WinRAR\\ArcHistory

Revision as of 14:18, 12 September 2013


File Structure

File systems are covered separately.

SSD

Per MS KB2727880, when Windows 7 is installed on a system with an SSD drive, automatic defragmentation and SuperFetch/prefetching are disabled.

Further, this TechNet post states: Since ReadyBoost will not provide a performance gain when the primary disk is an SSD, Windows 7 disables ReadyBoost when reading from an SSD drive.



Jump Lists

Jump Lists are Task Bar artifacts first introduced on Windows 7 (and also available on Windows 8).

Registry

The Windows_Registry remains a central component of the Windows 7 operating system.

Known keys of forensic interest

SAM Registry

SAM\\SAM\\Domains\\Account\\Users

SAM\\SAM\\Domains\\Account\\UsersSAM\\Domains\\Builtin\\Aliases


Security Registry

Security\\Policy\\PolAcDmSPolicy\\PolPrDmS

Security\\Policy\\PolAdtEv

Security\\Policy\\Secrets

NTUSER Registry NTUSER\\Control Panel\\Desktop NTUSER\\Control Panel\\don\ NTUSER\\Environment NTUSER\\Network NTUSER\\Printers\\Settings\\Wizard\\ConnectMRU NTUSER\\Software NTUSER\\Software\\Adobe\\Acrobat Reader\\Software\\Adobe\\Acrobat Reader\\ NTUSER\\Software\\Ahead NTUSER\\Software\\America Online\\AOL Instant Messenger (TM)\\CurrentVersion\\Users NTUSER\\Software\\Ares NTUSER\\Software\\bindshell.net\\Odysseus NTUSER\\Software\\Blizzard Entertainment\\Warcraft III\\String NTUSER\\Software\\Cain\\Settings NTUSER\\Software\\DECAFme NTUSER\\Software\\Google\\Google Toolbar\\4.0\\whitelist NTUSER\\Software\\Google\\NavClient\\1.1\\History NTUSER\\Software\\JavaSoft\\Java Update\\Policy\\JavaFX NTUSER\\Software\\JavaSoft\\Prefs\\haven NTUSER\\Software\\Microsoft NTUSER\\Software\\Microsoft\\Command Processor NTUSER\\Software\\Microsoft\\Dependency Walker\\Recent File List NTUSER\\Software\\Microsoft\\IntelliPoint\\AppSpecific NTUSER\\Software\\Microsoft\\Internet Explorer\\Main NTUSER\\Software\\Microsoft\\Internet Explorer\\MainSoftware\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AutoCompleteSoftware\\Microsoft\\Internet Account Manager\\Accounts NTUSER\\Software\\Microsoft\\Internet Explorer\\Settings NTUSER\\Software\\Microsoft\\Internet Explorer\\TypedURLs NTUSER\\Software\\Microsoft\\Internet Explorer\\TypedURLsTime NTUSER\\Software\\Microsoft\\MediaPlayer\\Player\\RecentFileList NTUSER\\Software\\Microsoft\\Microsoft Management Console\\Recent File List NTUSER\\Software\\Microsoft\\Multimedia\\OtherSoftware\\Microsoft\\CTF\\LangBarAddIn NTUSER\\Software\\Microsoft\\Office\\14.0Software\\Microsoft\\Office\\14.0 NTUSER\\Software\\Microsoft\\Office\\Software\\Microsoft\\Office\\ NTUSER\\Software\\Microsoft\\OfficeSoftware\\Microsoft\\Office\\ NTUSER\\Software\\Microsoft\\PIMSRV NTUSER\\Software\\Microsoft\\Search Assistant\\ACMru NTUSER\\Software\\Microsoft\\Snapshot Viewer\\Recent File List NTUSER\\Software\\Microsoft\\Terminal Server Client\\DefaultSoftware\\Microsoft\\Terminal Server Client\\Servers NTUSER\\Software\\Microsoft\\Terminal Server Client\\Servers NTUSER\\Software\\Microsoft\\User Location Service\\Client NTUSER\\Software\\Microsoft\\Windows Live Contacts\\Database NTUSER\\Software\\Microsoft\\Windows Live Mail NTUSER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Compatibility Assistant\\Persisted NTUSER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Layers NTUSER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\PrinterPorts NTUSER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows NTUSER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles NTUSER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\0a0d020000000000c000000000000046 NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\App Management\\ARPCache NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Applets NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\BitBucket NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComDlg32 NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComputerDescriptions NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanel NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Map Network Drive MRU NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MenuOrder NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2 NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\PublishingWizard\\AddNetworkPlace\\AddNetPlace\\LocationMRU NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StreamMRU NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\TypedPaths NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Wallpaper\\MRU NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WordWheelQuery NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Settings\\{8AD9C840-044E-11D1-B3E9-00805F499D93} NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\FileHistory NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet SettingsSoftware\\Microsoft\\Internet Explorer\\Main\\WindowsSearch NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\UFH\\SHC NTUSER\\Software\\Microsoft\\Windows\\CurrentVersion\\UnreadMail NTUSER\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop NTUSER\\Software\\Nico Mak Computing\\WinZip NTUSER\\Software\\ORL\\VNCHooks\\Application_Prefs NTUSER\\Software\\ORL\\VNCviewer\\MRUSoftware\\RealVNC\\VNCViewer4\\MRU NTUSER\\Software\\Piriform\\CCleaner NTUSER\\Software\\Privoxy NTUSER\\Software\\RealNetworks\\RealPlayer\\6.0\\Preferences NTUSER\\Software\\RealVNC\\VNCViewer4\\MRU NTUSER\\Software\\SimonTatham\\PuTTY\\SshHostKeys NTUSER\\Software\\Skype NTUSER\\Software\\SmartLine Vision\\aports NTUSER\\Software\\SysInternals NTUSER\\Software\\Sysinternals\\RootkitRevealer NTUSER\\Software\\VMware NTUSER\\Software\\WinRAR\\ArcHistory