In this course, Course Six, we're going to be discussing the Windows registry.
An overview of this course, we're going to understand the purpose and
structure of the files that make up the Windows registry.
We're going to identify and
extract important data from both the live and the non live registry.
We're going to learn how to interpret and
understand the data that we find in the Windows registry.
We're going to learn to locate the registry files within the computer's
operating system.
We're going to examine the registry files and
locate data significant to the investigation.
In our first module, we're going to talk about the registry overview and history.
Microsoft defines the Windows registry as a hierarchical database
designed to store information that is necessary to configure the system for
one or more users, applications, and hardware devices.
The Windows registry replaced the old configuration and
initialization ini files used in older versions of Windows prior to Windows NT.
The registry, in my opinion, is perhaps one of the most overlooked
treasure trove of forensic artifacts on a Windows system.
It is a great source of both evidence and supporting evidence.
It's useful in validating our findings throughout the investigation.
Some of the artifacts that are contained within the registry are user information,
information specific to each user on the system, system information,
and application specific information.
The registry also acts as a sort of log file as it does track the system
changes and user created changes are also often tracked in the registry.
The type of case that you're investigating will determine
the type of information that you're looking for.
And this is true not only in the registry,
but throughout the entire Windows file system.
So if you're looking at a fraud or harassment or child exploitation case,
each of these cases, you'll be looking for different types of information.
In our next module, we're going to talk about the structure of
the Windows registry and what makes up the Windows registry.