Difference between pages "RegXML" and "Windows 8"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(Describe what RegXML does)
 
(Prefetch)
 
Line 1: Line 1:
RegXML is an XML syntax analogous to [[Digital Forensics XML]]. It represents the contents of a Windows Registry hive file, presenting key and value cells of the hive as file and directories of a file system.
+
Initially Windows 8 had a workstation and server edition. The server edition became Windows Server 2012.
  
==Disambiguation==
+
== New Features ==
 +
The following new features were introduced in Windows 8:
 +
* [[Windows Shadow Volumes | File History]]
 +
* [[Windows Storage Spaces | Storage Spaces]]
 +
* [[Search Charm History]]
  
Please note that RegXML is *also* the name of a Windows command-line utility that exports sections of the Windows Registry as XML-formatted files.  That program was released on Softpedia.  It is a completely separate effort from RegXML otherwise mentioned in this article.
+
== File System ==
 +
The file system used by Windows 8 is primarily [[NTFS]].
  
==Sample XML==
+
The [[Resilient File System (ReFS)]] was initially available in the Windows 8 server edition but became part of Windows 2012 server edition.
  
This RegXML is a sample of the System hive from the [http://digitalcorpora.org/corpora/scenarios/m57-patents-scenario M57-Patents scenario], image Charlie 2009-11-16.  Its structure is of the first version of RegXML, a deep-hierarchy structure created by extending the [http://libguestfs.org/hivexml.1.html Hivexml] utility.
+
== Jump Lists ==
 +
[[Jump Lists]] are Task Bar artifacts that were first introduced on Windows 7 and are also available on Windows 8.
  
<pre>
+
== Prefetch ==
<?xml version="1.0" encoding="UTF-8"?>
+
The prefetch hash function is similar to [[Windows 2008]].
<hive>
+
  <mtime>2009-11-17T00:33:57Z</mtime>
+
  <node name="$$$PROTO.HIV" root="1">
+
    <mtime>2009-11-13T04:47:33Z</mtime>
+
    <byte_runs>
+
      <byte_run file_offset="4128" len="92"/>
+
    </byte_runs>
+
    <node name="ControlSet002">
+
      <mtime>2009-11-09T01:26:39Z</mtime>
+
      <byte_runs>
+
        <byte_run file_offset="1480856" len="93"/>
+
      </byte_runs>
+
      <node name="Control">
+
        <mtime>2009-11-13T04:48:01Z</mtime>
+
        <byte_runs>
+
          <byte_run file_offset="1481240" len="87"/>
+
        </byte_runs>
+
        <value type="string" key="WaitToKillServiceTimeout" value="20000">
+
          <byte_runs>
+
            <byte_run file_offset="1481328" len="48"/>
+
            <byte_run file_offset="13448" len="16"/>
+
          </byte_runs>
+
        </value>
+
        <value type="string" key="SystemStartOptions" value="NOEXECUTE=OPTIN  FASTDETECT">
+
          <byte_runs>
+
            <byte_run file_offset="1481464" len="42"/>
+
            <byte_run file_offset="3006752" len="60"/>
+
          </byte_runs>
+
        </value>
+
        <value type="string" key="SystemBootDevice" value="multi(0)disk(0)rdisk(0)partition(1)">
+
          <byte_runs>
+
            <byte_run file_offset="3006856" len="40"/>
+
            <byte_run file_offset="3206056" len="76"/>
+
          </byte_runs>
+
        </value>
+
        <node name="Windows">
+
          <mtime>2009-11-13T03:08:00Z</mtime>
+
          <byte_runs>
+
            <byte_run file_offset="2355232" len="87"/>
+
          </byte_runs>
+
          <value type="expand" key="SystemDirectory" value="%SystemRoot%\system32">
+
            <byte_runs>
+
              <byte_run file_offset="2355368" len="39"/>
+
              <byte_run file_offset="3111128" len="48"/>
+
            </byte_runs>
+
          </value>
+
          <value type="binary" encoding="base64" key="ShutdownTime" value="RDGhgQ5kygE=">
+
            <byte_runs>
+
              <byte_run file_offset="3203784" len="36"/>
+
              <byte_run file_offset="1481592" len="12"/>
+
            </byte_runs>
+
          </value>
+
        </node>
+
        <node name="WOW">
+
          <mtime>2009-11-09T01:22:59Z</mtime>
+
          <byte_runs>
+
            <byte_run file_offset="2359096" len="83"/>
+
          </byte_runs>
+
          <value type="expand" key="cmdline" value="%SystemRoot%\system32\ntvdm.exe">
+
            <byte_runs>
+
              <byte_run file_offset="2358720" len="31"/>
+
              <byte_run file_offset="2359184" len="68"/>
+
            </byte_runs>
+
          </value>
+
          <value type="string" key="KnownDLLs" value="comm.drv commdlg.dll ctl3dv2.dll ddeml.dll
+
keyboard.drv lanman.drv mmsystem.dll mouse.drv netapi.dll olecli.dll olesvr.dll pmspl.dll shell.dll
+
sound.drv system.drv toolhelp.dll vga.drv wfwnet.drv win87em.dll winoldap.mod winsock.dll
+
winspool.exe wowdeb.exe timer.drv rasapi16.dll compobj.dll storage.dll ole2.dll ole2disp.dll
+
ole2nls.dll typelib.dll msvideo.dll avifile.dll msacm.dll mciavi.drv mciseq.drv mciwave.drv
+
progman.exe avicap.dll mapi.dll">
+
            <byte_runs>
+
              <byte_run file_offset="2359256" len="33"/>
+
              <byte_run file_offset="2361648" len="904"/>
+
            </byte_runs>
+
          </value>
+
        </node>
+
      </node>
+
    </node>
+
  </node>
+
</hive>
+
</pre>
+
  
==See Also==
+
The [[Windows Prefetch File Format]] was changed on Windows 8.1 to version 26.
  
* A. Nelson, “RegXML: XML conversion of the Windows Registry for forensic processing and distribution,” in Advances in Digital Forensics VIII, ser. IFIP Advances in Information and Communication Technology, K.-P. Chow and S. Shenoi, Eds. Springer, 2012.
+
== Registry ==
* [https://github.com/ajnelson/regxml_extractor RegXML Extractor] (on github)
+
The [[Windows_Registry|Windows Registry]] remains a core component of the Windows operating system.
 +
 
 +
== See Also ==
 +
* [[Windows]]
 +
* [[Windows Vista]]
 +
* [[Windows 7]]
 +
 
 +
== External Links ==
 +
* [http://en.wikipedia.org/wiki/Features_new_to_Windows_8 Features new to Windows 8], Wikipedia
 +
* [http://computerforensics.champlain.edu/blog/windows-8-forensics Windows 8 Forensics - part 1]
 +
* [http://computerforensics.champlain.edu/blog/windows-8-forensics-part-2 Windows 8 Forensics - part 2]
 +
* [http://computerforensics.champlain.edu/blog/windows-8-forensics-part-3 Windows 8 Forensics - part 3]
 +
* [http://propellerheadforensics.files.wordpress.com/2012/05/thomson_windows-8-forensic-guide2.pdf Windows 8 Forensic Guide], by [[Amanda Thomson|Amanda C. F. Thomson]], 2012
 +
* [http://forensicfocus.com/Forums/viewtopic/t=9604/ Forensic Focus: Windows 8 Forensics - A First Look], [http://www.youtube.com/watch?v=uhCooEz9FQs&feature=youtu.be Presentation], [http://www.forensicfocus.com/downloads/windows-8-forensics-josh-brunty.pdf Slides], by [[Josh Brunty]], August 2012
 +
* [http://dfstream.blogspot.ch/2013/03/windows-8-tracking-opened-photos.html Windows 8: Tracking Opened Photos], by [[Jason Hale]], March 8, 2013
 +
* [http://dfstream.blogspot.com/2013/09/windows-8-and-81-search-charm-history.html indows 8 and 8.1: Search Charm History], by [[Jason Hale]], September 9, 2013
 +
 
 +
[[Category:Operating systems]]

Revision as of 12:16, 20 October 2013

Initially Windows 8 had a workstation and server edition. The server edition became Windows Server 2012.

New Features

The following new features were introduced in Windows 8:

File System

The file system used by Windows 8 is primarily NTFS.

The Resilient File System (ReFS) was initially available in the Windows 8 server edition but became part of Windows 2012 server edition.

Jump Lists

Jump Lists are Task Bar artifacts that were first introduced on Windows 7 and are also available on Windows 8.

Prefetch

The prefetch hash function is similar to Windows 2008.

The Windows Prefetch File Format was changed on Windows 8.1 to version 26.

Registry

The Windows Registry remains a core component of the Windows operating system.

See Also

External Links