Windows Registry Forensics, 2nd Edition

1

Registry Analysis

Abstract

This chapter provides an overview of what Registry analysis should consist of and provides an initial foundation for understanding the binary and logical structure of the Windows Registry.

Keywords

Analysis; Keys; Locard; Registry; Structure; Values

Information in this chapter

• Core Analysis Concepts

• What is the Window Registry?

• Registry Structure

Introduction

The Windows Registry is a core component of the Windows operating systems, and yet when it comes to digital analysis of Windows systems, is perhaps the least understood component of a Windows system. This may be due to how little information seems to have been written on the subject; however, if you spend just a little time looking ...