Question

List three pieces of information that can be recovered from the registry and the significance or value of that information to a forensic analyst? 12pt Paragraph B I VART? I

Answer 1

Hi,

Please find the answer below:
-----------------------------------------

Windows Registry contains important information regarding the Windows 10 operating system. It is like a tree-like structure database that stores information about:

• Installed Software/ programs on the computer.
• User profiles & User settings of the users on the machine.
• User Activity.

The registry has five root hives. Each hive contains keys. Each key in the tree can store data value or other keys.

1. HKEY_CLASSES_ROOT
2. HKEY_CURRENT_USER
3. HKEY_LOCAL_MACHINE
4. HKEY_USERS
5. HKEY_CURRENT_CONFIG

Name Type Data Registry Editor File Edit View Favorites Help Computer Computer HKEY_CLASSES_ROOT HKEY_CURRENT_USER HKEY_LOCAL_MACHINE HKEY_USERS HKEY_CURRENT_CONFIG

How to launch the Windows Registry.

Open Windows prompt or Search prompt

We can launch the registry editor by typing regedit in the search prompt.

Forensic experts can either export the dump or use third-party applications to investigate the registry information. When the registry data is analyzed carefully, forensic experts can get vital information about the machine state, user activity, programs installed on the machine; for example any malicious programs installed, etc. Using Windows the forensic expert can get crucial and various different information about the machine at the time of the crime.

For example to know the wallpaper of the machine:

Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers

USB used to connect to the computer:

Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\USBSTOR

-----------------------------------------

Let me know if you need more help with this.
Hope this helps.