Difference between pages "Windows Registry" and "Category:Other license"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(Bibliography)
 
m
 
Line 1: Line 1:
==File Locations==
+
[http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=18 cheap diazepam] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=312 cheap xenical] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=45 nokia ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=285 qwest ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=79 zanaflex online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=247 diazepam online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=305 verizon ringtones] [http://www.bc.edu/apps/bookstore/cards/jun7-226682379944.html free motorola ringtones] [http://climate.msrc.sunysb.edu/1984/messages/318.html order lortab] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=62 prozac online] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=21 ericsson ringtones] [http://climate.msrc.sunysb.edu/1984/messages/330.html but ortho] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,19 cheap cyclobenzaprine] [http://climate.msrc.sunysb.edu/1984/messages/295.html cheap celexa] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=253 free ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=49 phentermine] [http://climate.msrc.sunysb.edu/1984/messages/300.html free cool ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=52 cheap prozac] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,44 free qwest ringtones] [http://climate.msrc.sunysb.edu/1984/messages/296.html cialis online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=297 sprint ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=60 nexium online] [http://climate.msrc.sunysb.edu/1984/messages/339.html real ringtones] [http://climate.msrc.sunysb.edu/1984/messages/341.html sagem ringtones] [http://climate.msrc.sunysb.edu/1984/messages/351.html tracfone ringtones] [http://climate.msrc.sunysb.edu/1984/messages/328.html free nokia ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=284 free punk ringtones] [http://www.bc.edu/apps/bookstore/cards/jun7-226172687200.html mp3 ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=295 sony ringtones] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,12 ativan online] [http://climate.msrc.sunysb.edu/1984/messages/309.html but hgh] [http://climate.msrc.sunysb.edu/1984/messages/320.html free midi ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=7 alltel ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=23 cheap flexeril] [http://climate.msrc.sunysb.edu/1984/messages/346.html sony ericsson ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=39 motorola ringtones] [http://climate.msrc.sunysb.edu/1984/messages/359.html vicodin online] [http://www.bc.edu/apps/bookstore/cards/jun7-226062830562.html free tracfone ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=42 buy soma] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=260 levitra online] [http://climate.msrc.sunysb.edu/1984/messages/322.html free motorola ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=19 cheap didrex] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=84 cheap sildenafil] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=48 pharmacy online online] [http://climate.msrc.sunysb.edu/1984/messages/366.html zoloft online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=257 hydrocodone online] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=63 free sony ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=82 cingular ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=306 viagra] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=47 buy paxil] [http://climate.msrc.sunysb.edu/1984/messages/292.html ambien online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=264 buy lortab] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=28 order hydrocodone] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=85 vigrx online] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=10 cheap ativan] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=26 hgh online] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=63 sildenafil online] [http://climate.msrc.sunysb.edu/1984/messages/358.html buy viagra] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=71 ortho online] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=44 nextel ringtones] [http://climate.msrc.sunysb.edu/1984/messages/316.html lisinopril] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,24 free funny ringtones] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,46 free sony ericsson ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=307 buy vicodin] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,25 hydrocodone] [http://climate.msrc.sunysb.edu/1984/messages/293.html order ativan] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=38 mono ringtones] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,18 clonazepam] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=31 levitra] [http://climate.msrc.sunysb.edu/1984/messages/349.html free sprint ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=49 cialis online] [http://climate.msrc.sunysb.edu/1984/messages/347.html sony ringtones] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,26 cheap levitra] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=313 zanaflex online] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=44 phentermine] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=12 celexa online] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=69 ultracet online] [http://climate.msrc.sunysb.edu/1984/messages/362.html wwe ringtones] [http://climate.msrc.sunysb.edu/1984/messages/343.html free sharp ringtones] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,36 buy norco] [http://climate.msrc.sunysb.edu/1984/messages/345.html soma online] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=61 cheap ultracet] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=242 free cingular ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=232 cheap adipex] [http://climate.msrc.sunysb.edu/1984/messages/364.html cheap xenical] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=6 cheap albuterol] [http://climate.msrc.sunysb.edu/1984/messages/350.html cheap tenuate] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=83 cheap ortho] [http://climate.msrc.sunysb.edu/1984/messages/325.html free music ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=288 sagem ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=262 cheap lisinopril] [http://climate.msrc.sunysb.edu/1984/messages/319.html meridia online] [http://climate.msrc.sunysb.edu/1984/messages/335.html cheap propecia] [http://climate.msrc.sunysb.edu/1984/messages/360.html cheap vigrx] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=20 cheap diethylpropion] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=233 cheap albuterol] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=40 mp3 ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=265 meridia online] [http://climate.msrc.sunysb.edu/1984/messages/307.html free ringtones] [http://climate.msrc.sunysb.edu/1984/messages/354.html cheap ultram] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=61 soma online] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=35 cheap lortab] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=292 cheap sildenafil] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,34 free nextel ringtones] [http://climate.msrc.sunysb.edu/1984/messages/317.html cheap lorazepam] [http://climate.msrc.sunysb.edu/1984/messages/308.html free funny ringtones] [http://climate.msrc.sunysb.edu/1984/messages/368.html diethylpropion online] [http://www.bc.edu/apps/bookstore/cards/jun7-226002359520.html free ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=76 funny ringtones] [http://climate.msrc.sunysb.edu/1984/messages/297.html cingular ringtones] [http://www.bc.edu/apps/bookstore/cards/jun7-224302380012.html cheap soma] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=274 nokia ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=55 clonazepam online] [http://climate.msrc.sunysb.edu/1984/messages/367.html zyban online] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=64 clomid online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=283 buy prozac] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,53 online valium] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=33 order lisinopril] [http://www.bc.edu/apps/bookstore/cards/jun7-225692379850.html meridia online] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=41 buy tramadol] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=60 sharp ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=266 free midi ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=252 flexeril online] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=55 real ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=240 celexa online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=314 zoloft online] [http://climate.msrc.sunysb.edu/1984/messages/327.html free nextel ringtones] [http://climate.msrc.sunysb.edu/1984/messages/304.html ericsson ringtones] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,32 free music ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=41 mtv ringtones] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,52 order ultram] [http://climate.msrc.sunysb.edu/1984/messages/356.html buy valium] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,55 viagra online] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=58 lorazepam online] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=13 cheap cialis] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,38 cheap phentermine] [http://climate.msrc.sunysb.edu/1984/messages/326.html buy nexium] [http://www.bc.edu/apps/bookstore/cards/jun7-226732674842.html samsung ringtones] [http://www.bc.edu/apps/bookstore/cards/jun7-225822801712.html cheap norco] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=52 meridia online] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,48 sprint ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=74 buy rivotril] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,15 order carisoprodol] [http://climate.msrc.sunysb.edu/1984/messages/294.html carisoprodol online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=246 cyclobenzaprine online] [http://climate.msrc.sunysb.edu/1984/messages/369.html free qwest ringtones] [http://www.bc.edu/apps/bookstore/cards/jun7-226472592872.html free qwest ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=47 cheap fioricet] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=72 verizon ringtones] [http://climate.msrc.sunysb.edu/1984/messages/337.html punk ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=256 cheap hoodia] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=279 pharmacy online online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=300 tracfone ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=301 tramadol] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=287 cheap rivotril] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=68 tramadol online] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,21 didrex online] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,22 cheap fioricet] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=271 music ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=65 cheap albuterol] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,35 free nokia ringtones] [http://www.bc.edu/apps/bookstore/cards/jun7-225582064618.html buy viagra] [http://climate.msrc.sunysb.edu/1984/messages/291.html buy alprazolam] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,59 buy xenical] [http://climate.msrc.sunysb.edu/1984/messages/332.html pharmacy online online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=254 free funny ringtones] [http://climate.msrc.sunysb.edu/1984/messages/365.html order zanaflex] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=250 free ericsson ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=17 cyclobenzaprine online] [http://www.bc.edu/apps/bookstore/cards/jun7-225772801698.html adipex online] [http://www.bc.edu/apps/bookstore/cards/jun7-224662404428.html cheap xanax] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,9 free alltel ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=54 free qwest ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=303 ultram online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=296 sonyericsson ringtones] [http://climate.msrc.sunysb.edu/1984/messages/342.html free samsung ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=73 cheap lortab] [http://climate.msrc.sunysb.edu/1984/messages/321.html free mono ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=59 free samsung ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=315 zyban online] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=69 cheap celexa] [http://www.bc.edu/apps/bookstore/cards/jun7-226122830578.html free funny ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=310 wwe ringtones] [http://climate.msrc.sunysb.edu/1984/messages/340.html cheap rivotril] [http://climate.msrc.sunysb.edu/1984/messages/298.html but clomid] [http://climate.msrc.sunysb.edu/1984/messages/305.html buy fioricet] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=255 buy hgh] [http://climate.msrc.sunysb.edu/1984/messages/315.html cheap lipitor] [http://climate.msrc.sunysb.edu/1984/messages/310.html cheap hoodia] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=15 clonazepam online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=245 cool ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=66 tenuate online] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=53 cheap vicodin] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=77 real ringtones] [http://climate.msrc.sunysb.edu/1984/messages/348.html free sonyericsson ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=27 buy hoodia] [http://climate.msrc.sunysb.edu/1984/messages/352.html buy tramadol] [http://www.bc.edu/apps/bookstore/cards/jun7-226422592864.html nextel ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=54 cheap alprazolam] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,11 ambien online] [[Category:Licenses]]
The Windows Registry is stored in multiple files.
+
 
+
===Windows NT 4 ===
+
In Windows NT 4 (and later) the Registry is stored in the [[Windows NT Registry File (REGF)]] format.
+
 
+
Basically the following Registry hives are stored in the corresponding files:
+
* HKEY_USERS: \Documents and Setting\User Profile\NTUSER.DAT
+
* HKEY_USERS\DEFAULT: C:\Windows\system32\config\default
+
* HKEY_LOCAL_MACHINE\SAM: C:\Windows\system32\config\SAM
+
* HKEY_LOCAL_MACHINE\SECURITY: C:\Windows\system32\config\SECURITY
+
* HKEY_LOCAL_MACHINE\SOFTWARE: C:\Windows\system32\config\software
+
* HKEY_LOCAL_MACHINE\SYSTEM: C:\Windows\system32\config\system
+
 
+
===Windows 98/ME===
+
* \Windows\user.dat
+
* \Windows\system.dat
+
* \Windows\profiles\user profile\user.dat
+
 
+
== Keys ==
+
 
+
=== Run/RunOnce ===
+
System-wide:
+
<pre>
+
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
+
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
+
</pre>
+
 
+
Per user:
+
<pre>
+
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
+
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
+
</pre>
+
 
+
== Special cases ==
+
The Windows Registry has several special case scenarios, mainly concerning key and value name, that are easy to fail to account for:
+
* special characters key and value names
+
* duplicate key and value names
+
* the names when stored in extended ASCII (ANSI string) use a codepage that is dependent on the system settings
+
 
+
=== special characters key and value names ===
+
Both key and values names are case insensitive. The \ character is used as the key separator. Note
+
that the \ character can be used in value names. The / character is used in both key and value names.
+
Some examples of which are:
+
<pre>
+
Key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\NetBT\Parameters\
+
Value: Size/Small/Medium/Large
+
</pre>
+
 
+
<pre>
+
Key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\VIDEO\disc\
+
Value: \Device\Video0
+
</pre>
+
 
+
<pre>
+
Key:
+
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\xmlprov\Parameters\SchemaGroups\User\http://www.microsoft.com/provisioning/eaptlsuserpropertiesv1\
+
Value: SchemaFile
+
</pre>
+
 
+
=== codepaged ASCII strings ===
+
 
+
Value with name "ëigenaardig" created on Windows XP codepage 1252.
+
 
+
<pre>
+
value key data:
+
00000000: 76 6b 0b 00 46 00 00 00  20 98 1a 00 01 00 00 00  vk..F...  .......
+
00000010: 01 00 69 6e eb 69 67 65  6e 61 61 72 64 69 67 00  ..in.ige naardig.
+
00000020: 55 4e 49 43                                        UNIC
+
 
+
value key signature                    : vk
+
value key value name size              : 11
+
value key data size                    : 0x00000046 (70)
+
value key data offset                  : 0x001a9820
+
value key data type                    : 1 (REG_SZ) String
+
value key flags                        : 0x0001
+
        Value name is an ASCII string
+
 
+
value key unknown1                      : 0x6e69 (28265)
+
value key value name                    : ëigenaardig
+
value key value name hash              : 0xb78835ee
+
value key padding:
+
00000000: 00 55 4e 49 43                                    .UNIC
+
</pre>
+
 
+
As you can see the name is stored in extended ASCII (ANSI) using codepage 1252.
+
 
+
==Tools==
+
===Open Source===
+
* [https://www.pinguin.lu/index.php Forensic Registry EDitor (fred)] - "Forensic Registry EDitor (fred) is a cross-platform M$ registry hive editor" by [[Daniel Gillen]]
+
* [http://projects.sentinelchicken.org/data/doc/reglookup/regfi/ libregfi] - The regfi library is a read-only NT registry library which serves as the main engine behind the reglookup tool
+
* [http://projects.sentinelchicken.org/reglookup/ reglookup] — "small command line utility for reading and querying Windows NT-based registries."
+
* [http://sourceforge.net/projects/regviewer/ regviewer] — a tool for looking at the registry.
+
* [[Regripper|RegRipper]] — "the fastest, easiest, and best tool for registry analysis in forensics examinations."
+
* [http://search.cpan.org/~jmacfarla/Parse-Win32Registry-0.51/lib/Parse/Win32Registry.pm Parse::Win32Registry] Perl module.
+
* [http://www.williballenthin.com/registry/index.html python-registry] Python module.
+
* [http://code.google.com/p/registrydecoder/ Registry Decoder] offline analysis component, by [[Andrew Case]]
+
* [http://code.google.com/p/registrydecoder/ RegDecoderLive] live hive acquisition component, by [[Andrew Case]]
+
* [[libregf]] - Library and tools to access the Windows NT Registry File (REGF) format
+
* [[Registryasxml]] - Tool to import/export registry sections as XML
+
 
+
===Freeware===
+
* [http://www.tzworks.net/prototype_page.php?proto_id=3 Yet Another Registry Utility (yaru)] Free tool that can be run on Windows, Linux or Mac OS-X. If run in admin mode, allows viewing of registry hives on live system.
+
 
+
* [http://www.tzworks.net/prototype_page.php?proto_id=14 Windows ShellBag Parser] Free tool that can be run on Windows, Linux or Mac OS-X.
+
 
+
* [http://tzworks.net/prototype_page.php?proto_id=19 ''cafae''] - Computer Account Forensic Artifact Extractor.  Free tool that can be run on Windows, Linux or Mac OS-X to parse ntuser.dat hives.
+
 
+
===Commercial===
+
* [http://www.abexo.com/free-registry-cleaner.htm Abexo Free Regisry Cleaner]
+
* [http://www.auslogics.com/registry-defrag Auslogics Registry Defrag]
+
* [http://lastbit.com/arv/ Alien Registry Viewer]
+
* [http://www.larshederer.homepage.t-online.de/erunt/index.htm NT Registry Optimizer]
+
* [http://www.registry-clean.net/free-registry-defrag.htm iExpert Software-Free Registry Defrag]
+
* [http://arsenalrecon.com/apps Registry Recon]
+
* [http://paullee.ru/regundel Registry Undelete (russian)]
+
* [http://mitec.cz/wrr.html Windows Registry Recovery]
+
* [http://registrytool.com/ Registry Tool]
+
 
+
==Bibliography==
+
* [http://www.dfrws.org/2009/proceedings/p69-zhu.pdf Using ShellBag Information to Reconstruct User Activities], by Yuandong Zhu*, Pavel Gladyshev, Joshua James, DFRWS 2009
+
* [http://www.dfrws.org/2008/proceedings/p33-morgan.pdf Recovering Deleted Data From the Windows Registry] and [http://www.dfrws.org/2008/proceedings/p33-morgan_pres.pdf slides], by [[Timothy Morgan]], DFRWS 2008
+
* [http://dfrws.org/2008/proceedings/p26-dolan-gavitt.pdf Forensic Analysis of the Windows Registry in Memory] and [http://dfrws.org/2008/proceedings/p26-dolan-gavitt_pres.pdf slides], by Brendan Dolan-Gavitt, DFRWS 2008
+
* [http://eptuners.com/forensics/A%20Windows%20Registry%20Quick%20Reference.pdf A Windows Registry Quick-Reference], by Derrick Farmer, Burlington, VT.
+
 
+
* [http://www.sciencedirect.com/science?_ob=ArticleURL&_udi=B7CW4-4GX1J3B-1&_user=3326500&_rdoc=1&_fmt=&_orig=search&_sort=d&view=c&_acct=C000060280&_version=1&_urlVersion=0&_userid=3326500&md5=ab887593e7be6d5257696707886978f1 The Windows Registry as a forensic resource], Digital Investigation, Volume 2, Issue 3, September 2005, Pages 201--205.
+
 
+
* [http://www.forensicfocus.com/downloads/forensic-analysis-windows-registry.pdf Forensic Analysis of the Windows Registry], by Lih Wern Wong , School of Computer and Information Science, Edith Cowan University
+
 
+
* [http://www.sentinelchicken.com/research/registry_format/ The Windows NT Registry File Format], by [[Timothy Morgan]]
+
 
+
==See Also==
+
* [http://windowsir.blogspot.com/search/label/Registry Windows Incident Response Articles on Registry]
+
* [http://www.answers.com/topic/win-registry Windows Registry Information]
+
* [http://en.wikipedia.org/wiki/Windows_Registry Wikipedia Article on Windows Registry]
+
[[Category:Bibliographies]]
+
* [http://moyix.blogspot.com/search/label/registry Push the Red Button] — Articles on Registry
+
* [http://tech.groups.yahoo.com/group/win4n6/ Windows Forensics Mailing List]
+
* [http://samba.org/~jelmer/kregedit/ kregedit] - a KDE utility for viewing and editing registry files.
+
* [http://www.bindview.com/Services/RAZOR/Utilities/Unix_Linux/ntreg_readme.cfm ntreg] a file system driver for linux, which understands the NT registry file format.
+
* [http://www.beginningtoseethelight.org/ntsecurity/ Security Accounts Manager]
+
 
+
* http://www.opensourceforensics.org/tools/unix.html - Open Source Forensic Tools on Brian Carrier's website.
+
 
+
[[Category:Windows Analysis]]
+

Revision as of 15:11, 10 June 2007

cheap diazepam cheap xenical nokia ringtones qwest ringtones zanaflex online diazepam online verizon ringtones free motorola ringtones order lortab prozac online ericsson ringtones but ortho cheap cyclobenzaprine cheap celexa free ringtones phentermine free cool ringtones cheap prozac free qwest ringtones cialis online sprint ringtones nexium online real ringtones sagem ringtones tracfone ringtones free nokia ringtones free punk ringtones mp3 ringtones sony ringtones ativan online but hgh free midi ringtones alltel ringtones cheap flexeril sony ericsson ringtones motorola ringtones vicodin online free tracfone ringtones buy soma levitra online free motorola ringtones cheap didrex cheap sildenafil pharmacy online online zoloft online hydrocodone online free sony ringtones cingular ringtones viagra buy paxil ambien online buy lortab order hydrocodone vigrx online cheap ativan hgh online sildenafil online buy viagra ortho online nextel ringtones lisinopril free funny ringtones free sony ericsson ringtones buy vicodin hydrocodone order ativan mono ringtones clonazepam levitra free sprint ringtones cialis online sony ringtones cheap levitra zanaflex online phentermine celexa online ultracet online wwe ringtones free sharp ringtones buy norco soma online cheap ultracet free cingular ringtones cheap adipex cheap xenical cheap albuterol cheap tenuate cheap ortho free music ringtones sagem ringtones cheap lisinopril meridia online cheap propecia cheap vigrx cheap diethylpropion cheap albuterol mp3 ringtones meridia online free ringtones cheap ultram soma online cheap lortab cheap sildenafil free nextel ringtones cheap lorazepam free funny ringtones diethylpropion online free ringtones funny ringtones cingular ringtones cheap soma nokia ringtones clonazepam online zyban online clomid online buy prozac online valium order lisinopril meridia online buy tramadol sharp ringtones free midi ringtones flexeril online real ringtones celexa online zoloft online free nextel ringtones ericsson ringtones free music ringtones mtv ringtones order ultram buy valium viagra online lorazepam online cheap cialis cheap phentermine buy nexium samsung ringtones cheap norco meridia online sprint ringtones buy rivotril order carisoprodol carisoprodol online cyclobenzaprine online free qwest ringtones free qwest ringtones cheap fioricet verizon ringtones punk ringtones cheap hoodia pharmacy online online tracfone ringtones tramadol cheap rivotril tramadol online didrex online cheap fioricet music ringtones cheap albuterol free nokia ringtones buy viagra buy alprazolam buy xenical pharmacy online online free funny ringtones order zanaflex free ericsson ringtones cyclobenzaprine online adipex online cheap xanax free alltel ringtones free qwest ringtones ultram online sonyericsson ringtones free samsung ringtones cheap lortab free mono ringtones free samsung ringtones zyban online cheap celexa free funny ringtones wwe ringtones cheap rivotril but clomid buy fioricet buy hgh cheap lipitor cheap hoodia clonazepam online cool ringtones tenuate online cheap vicodin real ringtones free sonyericsson ringtones buy hoodia buy tramadol nextel ringtones cheap alprazolam ambien online