Registry Artifacts Villanova University Department of Computing - PowerPoint PPT Presentation

Registry Artifacts Villanova University – Department of Computing Sciences – D. Justin Price – Spring 2014

REGISTRY • The registry is a “central hierarchal database” intended to store information that is necessary to configure the system for one or more users, applications, and hardware devices.[1] • Goldmine for digital forensics. • Registry Breakdown • Hives (binary database files) • Keys & Subkeys (analogous to a folders) • Values (analogous to a file) • Type (strings, binary or DWORD) • Data Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014 [1] http://support.microsoft.com/kb/256986

REGISTRY HIVES • SAM – Local user accounts & groups • Security – Security information used by the operating system to include password policies, group memberships, etc. • System – Hardware and service configurations • Software – Application settings • NTUSER.dat – User settings, configuration and environment settings • UsrClass.dat – More widely used in Vista/7/8 – Shellbag Information Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014

REGISTRY HIVES • System Registry Hives � XP/Vista/7/8 C:\Windows\System32\config\SAM � XP/Vista/7/8 C:\Windows\System32\config\SECURITY � XP/Vista/7/8 C:\Windows\System32\config\SYSTEM � XP/Vista/7/8 C:\Windows\System32\config\SOFTWARE � • User Specific Registry Hives � XP C:\Documents and Settings\<USERNAME>\NTUSER.dat � Vista/7/8 C:\Users\<USERNAME>\NTUSER.dat � Vista/7/8 C:\Users\<USERNAME>\AppData\Local\Microsoft\Windows\UsrClass.dat � • Backup System Registry Hives Vista/7/8 C:\Windows\System32\config\RegBack Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014

REGISTRY VALUE TYPES REG_NONE No Value REG_SZ Unicode or ASCII String REG_BINARY Binary Data REG_DWORD 32-bit Number REG_LINK Unicode Symbolic Link REG_QWORD 64-bit Number Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014

VIEWING REGISTRY HIVES • Live System Analysis - regedit.exe Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014

VIEWING REGISTRY HIVES • Offline Analysis - AccessData Registry Viewer • http://marketing.accessdata.com/acton/attachment/4390/u-011c/0/-/-/-/-/ Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014

VIEWING REGISTRY HIVES • Offline Analysis - MiTeC Windows Registry Recovery (WRR) • http://www.mitec.cz/wrr.html Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014

EXTRACTING REGISTRY HIVES Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014

EXTRACTING REGISTRY HIVES Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014

LAST WRITE TIME • Last Write Time is recorded for each key in every hive. • Time is stored in UTC. • Time stamp reflects when a value has been added or updated. Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014

SECURITY ACCOUNTS MANAGER (SAM) • Security Identifier (SID) • Recycle Bin entries, file ownership and other artifacts refer to a SID and not a username. • Microsoft Documented SID Accounts • Administrator = 500 • Guest = 501 • User Account = start at 1000 • Password fields can be misleading • Password Required = password policies applied to user accounts do not apply to this account • We will work with a much better tool to determine if a password was set for this account in the Encryption/ Password lecture! Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014

SAM Hive Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014

SAM Hive Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014

SAM Hive Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014

PROFILE LIST • Details all profiles that have used the system to include local and domain users. • SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014

PROFILE LIST • Details all profiles that have used the system to include local and domain users. • SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014

SYSTEM HIVE • Current Control Set • SYSTEM\Select\Current • Answers the following questions: • Which configuration files should be loaded? • If an error is detected, which configuration files should be tried next? • Which configuration files reported errors? Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014

SYSTEM HIVE • Computer Name: – SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName � � • Time Zone: – SYSTEM\CurrentControlSet\Control\TimeZoneInformation � � � � • Last Access Timestamp: – SYSTEM\CurrentControlSet\Control\FileSystem Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014

SYSTEM HIVE • Network Interfaces: – SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014

SYSTEM HIVE • User Shares Enable: – SYSTEM\CurrentControlSet\Services\lanmanserver\Shares � � � • System Shutdown Timestamps and Counters (XP): – SYSTEM\CurrentControlSet\Control\Windows – SYSTEM\CurrentControlSet\Control\Watchdog\Display Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014

SOFTWARE HIVE • Operating System Version: – SOFTWARE\Microsoft\Windows NT\CurrentVersion Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014

SOFTWARE HIVE • Historical Networks (Vista/7/8): – Managed by a Domain – SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures \Managed – DnsSuffix = Domain – FirstNetwork = SSID – DefaultGatewayMac = Media Access Control (MAC) Address of Gateway – Last Written Time = Last time the computer connected to this network. Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014

SOFTWARE HIVE • Historical Networks (Vista/7/8): – Not Managed by a Domain – SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList \Signatures\Unmanaged Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014

SOFTWARE HIVE • Network Type: – SOFTWARE\Microsoft\WZCSVC\Parameters\Interfaces\{GUID} (XP) – SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList \Profiles (Vista/7/8) » NameType 0x47 = Wireless » NameType 0x06 = Wired » NameType 0x17 = Broadband » Date fields are recorded as 128-bit System date …. use Dcode to convert. Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014

AUTO-START PROGRAMS • Various Registry Locations: – NTUSER.dat\Software\Microsoft\Windows\CurrentVersion\Run – NTUSER.dat\Software\Microsoft\Windows\CurrentVersion\RunOnce – SOFTWARE\Microsoft\Windows\CurrentVersion\Run – SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce – SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run – SYSTEM\CurrentControlSet\Services • (0x02 = start) Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014

NTUSER.DAT HIVE • Windows XP Search History – NTUSER.DAT\Software\Microsoft\Search Assistant\ACMru • Windows 7 Search History – NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer \WordWheelQuery � � � � � � � • Windows 8 Search History – NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer \SearchHistory Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014

NTUSER.DAT HIVE • Internet Explorer Typed URLs – NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer \TypedPaths Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014

NTUSER.DAT HIVE • Recently Accessed Files – NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer \RecentDocs – MRUList shows the order in which the files were accessed. – The most recent file opened will be first. Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014