Analyzing Windows Registry for Artifacts
When to Use
- When investigating user activity on a Windows system during an incident
- For identifying autorun/persistence mechanisms used by malware
- When tracing installed software, USB devices, and network connections
- During insider threat investigations to reconstruct user actions
- For correlating registry timestamps with other forensic artifacts
Prerequisites
- Forensic image or extracted registry hive files
- RegRipper, Registry Explorer (Eric Zimmerman), or python-registry
- Access to registry hive locations (SAM, SYSTEM, SOFTWARE, NTUSER.DAT, UsrClass.dat)
- Understanding of Windows Registry structure (hives, keys, values)
- SIFT Workstation or forensic analysis environment
Workflow
Step 1: Extract Registry Hives from the Forensic Image
bash# Mount the forensic image read-only mkdir /mnt/evidence mount -o ro,loop,offset=$((2048*512)) /cases/case-2024-001/images/evidence.dd /mnt/evidence # Copy system registry hives cp /mnt/evidence/Windows/System32/config/SAM /cases/case-2024-001/registry/ cp /mnt/evidence/Windows/System32/config/SYSTEM /cases/case-2024-001/registry/ cp /mnt/evidence/Windows/System32/config/SOFTWARE /cases/case-2024-001/registry/ cp /mnt/evidence/Windows/System32/config/SECURITY /cases/case-2024-001/registry/ cp /mnt/evidence/Windows/System32/config/DEFAULT /cases/case-2024-001/registry/ # Copy user-specific hives cp /mnt/evidence/Users/*/NTUSER.DAT /cases/case-2024-001/registry/ cp /mnt/evidence/Users/*/AppData/Local/Microsoft/Windows/UsrClass.dat /cases/case-2024-001/registry/ # Copy transaction logs (for dirty hive recovery) cp /mnt/evidence/Windows/System32/config/*.LOG* /cases/case-2024-001/registry/logs/ # Hash all extracted hives sha256sum /cases/case-2024-001/registry/* > /cases/case-2024-001/registry/hive_hashes.txt
Step 2: Analyze with RegRipper for Automated Artifact Extraction
bash# Install RegRipper git clone https://github.com/keydet89/RegRipper3.0.git /opt/regripper # Run RegRipper against NTUSER.DAT (user profile) perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/NTUSER.DAT \ -f ntuser > /cases/case-2024-001/analysis/ntuser_report.txt # Run against SYSTEM hive perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM \ -f system > /cases/case-2024-001/analysis/system_report.txt # Run against SOFTWARE hive perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SOFTWARE \ -f software > /cases/case-2024-001/analysis/software_report.txt # Run against SAM hive (user accounts) perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SAM \ -f sam > /cases/case-2024-001/analysis/sam_report.txt # Run specific plugins perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/NTUSER.DAT \ -p userassist > /cases/case-2024-001/analysis/userassist.txt perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM \ -p usbstor > /cases/case-2024-001/analysis/usbstor.txt
Step 3: Extract Persistence and Autorun Entries
bash# Using python-registry for targeted extraction pip install python-registry python3 << 'PYEOF' from Registry import Registry # Open SOFTWARE hive reg = Registry.Registry("/cases/case-2024-001/registry/SOFTWARE") # Check Run keys (autostart) autorun_paths = [ "Microsoft\\Windows\\CurrentVersion\\Run", "Microsoft\\Windows\\CurrentVersion\\RunOnce", "Microsoft\\Windows\\CurrentVersion\\RunServices", "Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run", "Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run" ] for path in autorun_paths: try: key = reg.open(path) print(f"\n=== {path} (Last Modified: {key.timestamp()}) ===") for value in key.values(): print(f" {value.name()}: {value.value()}") except Registry.RegistryKeyNotFoundException: pass # Check installed services key = reg.open("Microsoft\\Windows NT\\CurrentVersion\\Svchost") print(f"\n=== Svchost Groups ===") for value in key.values(): print(f" {value.name()}: {value.value()}") PYEOF # Check NTUSER.DAT for user-specific autorun python3 << 'PYEOF' from Registry import Registry reg = Registry.Registry("/cases/case-2024-001/registry/NTUSER.DAT") user_autorun = [ "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run" ] for path in user_autorun: try: key = reg.open(path) print(f"\n=== {path} (Last Modified: {key.timestamp()}) ===") for value in key.values(): print(f" {value.name()}: {value.value()}") except Registry.RegistryKeyNotFoundException: pass PYEOF
Step 4: Analyze User Activity Artifacts
bash# Extract UserAssist data (program execution history with ROT13 encoding) python3 << 'PYEOF' from Registry import Registry import codecs, struct, datetime reg = Registry.Registry("/cases/case-2024-001/registry/NTUSER.DAT") ua_path = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist" key = reg.open(ua_path) for guid_key in key.subkeys(): count_key = guid_key.subkey("Count") print(f"\n=== {guid_key.name()} ===") for value in count_key.values(): decoded_name = codecs.decode(value.name(), 'rot_13') data = value.value() if len(data) >= 16: run_count = struct.unpack('<I', data[4:8])[0] focus_count = struct.unpack('<I', data[8:12])[0] timestamp = struct.unpack('<Q', data[60:68])[0] if len(data) >= 68 else 0 if timestamp > 0: ts = datetime.datetime(1601,1,1) + datetime.timedelta(microseconds=timestamp//10) print(f" {decoded_name}: Runs={run_count}, Focus={focus_count}, Last={ts}") else: print(f" {decoded_name}: Runs={run_count}, Focus={focus_count}") PYEOF # Extract Recent Documents (MRU lists) perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/NTUSER.DAT \ -p recentdocs > /cases/case-2024-001/analysis/recentdocs.txt # Extract typed URLs (browser) perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/NTUSER.DAT \ -p typedurls > /cases/case-2024-001/analysis/typedurls.txt # Extract typed paths in Explorer perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/NTUSER.DAT \ -p typedpaths > /cases/case-2024-001/analysis/typedpaths.txt
Step 5: Extract System and Network Information
bash# Computer name and OS version from SYSTEM hive perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM \ -p compname > /cases/case-2024-001/analysis/system_info.txt # Network interfaces and configuration perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM \ -p nic2 >> /cases/case-2024-001/analysis/system_info.txt # Wireless network history perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SOFTWARE \ -p networklist > /cases/case-2024-001/analysis/network_history.txt # Timezone configuration perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM \ -p timezone > /cases/case-2024-001/analysis/timezone.txt # Shutdown time perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM \ -p shutdown > /cases/case-2024-001/analysis/shutdown.txt # Installed software from Uninstall keys perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SOFTWARE \ -p uninstall > /cases/case-2024-001/analysis/installed_software.txt
Key Concepts
| Concept | Description |
|---|---|
| Registry hive | Binary file storing a section of the registry (SAM, SYSTEM, SOFTWARE, NTUSER.DAT) |
| MRU (Most Recently Used) | Lists tracking recently accessed files, commands, and search terms |
| UserAssist | ROT13-encoded registry entries tracking program execution with timestamps |
| ShimCache | Application compatibility cache recording executed programs |
| AmCache | Detailed execution history including SHA-1 hashes of executables |
| BAM/DAM | Background/Desktop Activity Moderator tracking program execution in Win10+ |
| Last Write Time | Timestamp on registry keys indicating when they were last modified |
| Transaction logs | Journal files allowing recovery of registry state after improper shutdown |
Tools & Systems
| Tool | Purpose |
|---|---|
| RegRipper | Automated registry artifact extraction with plugin architecture |
| Registry Explorer | Eric Zimmerman GUI tool for interactive registry analysis |
| python-registry | Python library for programmatic registry hive parsing |
| RECmd | Eric Zimmerman command-line registry analysis tool |
| yarp | Yet Another Registry Parser for Python-based analysis |
| AppCompatCacheParser | Dedicated ShimCache/AppCompatCache parser |
| AmcacheParser | Dedicated AmCache.hve analysis tool |
| ShellBags Explorer | Specialized tool for analyzing ShellBag artifacts |
Common Scenarios
Scenario 1: Malware Persistence Investigation Extract SOFTWARE and NTUSER.DAT hives, check all Run/RunOnce keys for unauthorized entries, examine services for suspicious additions, check scheduled tasks registry keys, correlate autorun timestamps with malware execution timeline.
Scenario 2: User Activity Reconstruction Analyze UserAssist for program execution history, examine RecentDocs for accessed files, check TypedPaths for Explorer navigation, extract ShellBags for folder access patterns, build a timeline of user activity around the incident window.
Scenario 3: Unauthorized Software Detection Parse Uninstall keys for all installed applications, compare against approved software baseline, check BAM/DAM for recently executed programs not in approved list, examine AppCompatCache for execution evidence even after uninstallation.
Scenario 4: USB Data Exfiltration Investigation Extract USBSTOR entries from SYSTEM hive for connected devices, correlate device serial numbers with MountedDevices, check NTUSER.DAT MountPoints2 for user access to removable media, examine SetupAPI logs for first-connection timestamps.
Output Format
Registry Analysis Summary: System: DESKTOP-ABC123 (Windows 10 Pro Build 19041) Timezone: Eastern Standard Time (UTC-5) Last Shutdown: 2024-01-18 23:45:12 UTC Autorun Entries: HKLM Run: 5 entries (1 suspicious: "updater.exe" -> C:\ProgramData\svc\updater.exe) HKCU Run: 3 entries (all legitimate) Services: 142 entries (2 unknown: "WinDefSvc", "SysMonAgent") User Activity (NTUSER.DAT): UserAssist Programs: 234 entries Recent Documents: 89 entries Typed URLs: 45 entries Typed Paths: 12 entries USB Devices Connected: - Kingston DataTraveler (Serial: 0019E06B4521) - First: 2024-01-10, Last: 2024-01-18 - WD My Passport (Serial: 575834314131) - First: 2024-01-15, Last: 2024-01-15 Installed Software: 127 applications Suspicious Findings: 3 items flagged for review
