Windows Registry Forensics, 2nd Edition

4

Case Studies

User Hives

Abstract

This chapter discusses a great deal of the data that can be extracted from Registry hives found within a user profile in order to illustrate indicators of patterns of activity. This information can be used by analysts to demonstrate when the user was logged into the system, as well as locate indicators of malware infections, intrusions, and a number of other activities.

Keywords

MuiCache; NTUSER.DAT; RecentDocs; Registry; User; UserAssist; USRCLASS.DAT; WordWheelQuery

Information in this chapter

• NTUSER.DAT

• USRCLASS.DAT

Introduction

When first I sat down to write this book, it occurred to me that this chapter…one about tracking user activity…might be the most useful and interesting ...