> For the complete documentation index, see [llms.txt](https://karim-ashraf.gitbook.io/karim_ashraf_space/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://karim-ashraf.gitbook.io/karim_ashraf_space/writeups/lets-defend/incident-responder-path/registry-forensics/acquiring-registry-hives.md).

# Acquiring Registry Hives

## **Acquiring Registry Hives Using FTK Imager**

FTK Imager is a powerful tool for forensic acquisition, enabling investigators to extract critical files, including **Windows Registry hives**, from live systems. This lesson covered how to securely acquire these files for further analysis, even when they are system-protected.

***

## **Why Use FTK Imager for Registry Acquisition?**

* **Bypasses System Restrictions**:\
  Windows protects registry hives, preventing direct copying from the file system. FTK Imager overcomes these restrictions.
* **Preserves Data Integrity**:\
  Ensures an exact bit-for-bit copy of files, verified through hashing.
* **Critical for Incident Response**:\
  Enables rapid acquisition of key forensic artifacts during live investigations.

***

## **Steps for Acquiring Registry Hives**

### **1. Launch FTK Imager as Administrator**

* Administrative privileges are required to access protected system files.

### **2. Add Evidence Item**

* Navigate to **File > Add Evidence Item**.
* Select **Logical Drive** to access live system files.

### **3. Locate Registry Hives**

The following registry hives should be acquired for comprehensive forensic analysis:

| Hive             | Path                                                         | Purpose                                  |
| ---------------- | ------------------------------------------------------------ | ---------------------------------------- |
| **SAM**          | `C:\Windows\System32\Config\SAM`                             | Local user accounts and password hashes. |
| **SECURITY**     | `C:\Windows\System32\Config\SECURITY`                        | Security policies and access control.    |
| **SOFTWARE**     | `C:\Windows\System32\Config\SOFTWARE`                        | Installed software and configurations.   |
| **SYSTEM**       | `C:\Windows\System32\Config\SYSTEM`                          | System configurations and services.      |
| **NTUSER.DAT**   | `%USERPROFILE%\NTUSER.DAT`                                   | User-specific preferences and settings.  |
| **UsrClass.dat** | `%USERPROFILE%\AppData\Local\Microsoft\Windows\UsrClass.dat` | Application-specific user settings.      |

**Include Transaction Logs**:

* Files with extensions `.LOG`, `.LOG1`, and `.LOG2` for each hive contain uncommitted changes.

***

### **4. Create a Custom Content Image**

* **Select the Relevant Files**:\
  Add the hives and their logs to the custom image.
* **Generate Image**:
  * Define a destination folder.
  * Provide a descriptive image name.
  * FTK Imager calculates and displays hash values (MD5, SHA1) to verify the integrity of the image.

***

### **5. Mount the Custom Image**

* Go to **File > Image Mounting** and select the created `.ad1` image.
* **Explore the Image**:\
  The mounted image appears as a virtual drive, allowing easy access to the acquired files in a familiar folder structure.

***

### **Key Advantages**

* **Integrity Verification**:\
  Ensures the acquired data hasn’t been tampered with, essential for legal admissibility.
* **Non-Intrusive Process**:\
  Live acquisition doesn’t alter the original system data.

***

#### **Next Steps**

After acquisition, the following steps will be covered:

* **Analyzing Registry Hives** using tools like **Regedit** and forensic-specific software like **Registry Explorer** and **RegRipper**.
* **Identifying Key Artifacts** such as user activity, malware persistence, and system configurations.

This method allows analysts to collect crucial forensic data efficiently and securely, forming the foundation for detailed analysis.