Regedit and Registry Explorer
Registry Analysis Tools Overview
Analyzing the Windows Registry is a fundamental part of forensic investigations. This lesson covers two key tools: Regedit for live system analysis and Registry Explorer for comprehensive live and offline hive analysis.
1. Regedit (Registry Editor)
Purpose:
Regedit is a built-in tool for viewing and editing the Windows Registry. It provides direct access to live registry keys and values, enabling users to explore system and application configurations in real time.
How to Access:
Search: Type
Regeditin the taskbar search and open the application.
Key Features:
Hierarchical Navigation: Allows users to navigate through the registry tree structure, exploring keys and subkeys.
View Key Values: Displays associated data values in a simple interface.
Efficient Search: Quickly locate specific keys or values using predefined paths.
Example:
Exploring User Settings: Navigate to
HKEY_CURRENT_USERto view user-specific configurations.Subkeys like Software store application settings.
Key values reveal system preferences such as default printers or desktop backgrounds.
2. Registry Explorer by Eric Zimmerman
Purpose:
Registry Explorer enhances forensic analysis by supporting both live and offline hive analysis. It provides advanced features for parsing and examining registry data in depth.
Advantages Over Regedit:
Offline Hive Analysis: Analyze registry hives from external sources or disk images.
Transaction Log Parsing: Includes historical data by replaying changes logged in transaction files.
User-Friendly Interface: Categorized views make navigating and analyzing data more efficient.
Analyzing Live Hives
Steps:
Open Live System Hives:
From the File menu, select Open Hive.
Choose live hives like SAM, SYSTEM, or NTUSER.DAT.
View Deleted or Modified Records:
Enable Associated Deleted Records to see previously deleted or modified entries.
Example:
SAM Hive Analysis:
Explore user accounts and associated security identifiers (SIDs).
Detect changes in user permissions or deleted accounts.
Analyzing Offline Hives
Steps:
Unload Live Hives: From the File menu, select Unload Hive to close any live hives.
Load Offline Hives:
Use Load Hive to open registry files from a mounted FTK image.
Select accompanying transaction logs when prompted to replay changes.
Example:
SECURITY Hive Analysis:
View and analyze access control policies.
Replay transaction logs to uncover changes in security settings over time.
Why This Matters
Regedit: Ideal for live system analysis, enabling quick insights into current configurations and system status.
Registry Explorer: Essential for forensic investigations, offering the ability to recover deleted data, view historical changes, and analyze offline hives.
These tools complement each other, providing a comprehensive approach to registry analysis in live environments and forensic investigations.
Last updated