Windows Registry Forensics

Extract execution history, user activity, persistence mechanisms, and connected USB artifacts from Windows Registry hives.

Primary Registry Hives & Locations

Registry hives are binary files located on disk:

Hive Name	Storage Location on Disk	Scope
`SYSTEM`	`C:\Windows\System32\config\SYSTEM`	Hardware, services, startup settings.
`SOFTWARE`	`C:\Windows\System32\config\SOFTWARE`	Installed applications, OS settings.
`SAM`	`C:\Windows\System32\config\SAM`	User account security & password hashes.
`NTUSER.DAT`	`C:\Users\<username>\NTUSER.DAT`	User-specific settings & file activity.
`UsrClass.dat`	`C:\Users\<username>\AppData\Local\Microsoft\Windows\UsrClass.dat`	User shell bag & execution artifacts.

Program Execution Artifacts

Forensic investigators analyze registry keys to prove malicious programs were executed:

1. UserAssist Key

Tracks applications executed via Windows GUI (Explorer), run count, and last execution timestamp (values are ROT13 encoded).

Path: NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\

2. ShimCache (Application Compatibility Cache)

Maintained by the OS to track application compatibility. Contains file full path, size, and last modified timestamp.

Path: SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache\

3. Amcache.hve

Stores metadata for executed programs including file path, SHA-1 file hash, compilation timestamp, and publisher details.

Path: C:\Windows\appcompat\Programs\Amcache.hve

User Activity & Recent Files

1. ShellBags

Stores folder browsing preferences (view settings, window size). Proves that a user or attacker navigated through specific folders (even if the folders were later deleted or reside on external drives).

Path: UsrClass.dat\Local Settings\Software\Microsoft\Windows\Shell\Bags

2. RecentDocs / OpenSavePIDs

Tracks recently opened or saved files via standard Windows dialogs.

Path: NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

USB & External Hardware Artifacts

To investigate unauthorized data exfiltration via USB mass storage:

SYSTEM\CurrentControlSet\Enum\USBSTOR Contains Device Make, Model, Serial Number, and Revision level of connected USB drives.
SYSTEM\CurrentControlSet\Enum\USB Contains Vendor ID (VID) and Product ID (PID).
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 Shows drive letters assigned to USB devices and volume serial numbers when mounted by a specific user.

Persistence Mechanisms

Attackers maintain access by modifying auto-start registry locations:

# Run & RunOnce keys
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

# Services
HKLM\SYSTEM\CurrentControlSet\Services

# Winlogon Shell hijacking
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (default: explorer.exe)

Automated Parsing with RegRipper

RegRipper is an open-source CLI tool that parses registry hives into formatted reports:

# Parse NTUSER.DAT for user activity
rip.py -r /path/to/NTUSER.DAT -p all > ntuser_report.txt

# Parse SYSTEM hive for USB and network artifacts
rip.py -r /path/to/SYSTEM -p usbstor > usbstor_report.txt