Windows registry forensics
You extract registry hives from an image and use RegRipper and registry viewers to examine user activity, installed software, network history and persistence keys.
Level 301 · 16 lessons · 15 practice labs
Lessons
Registry structure
- Hive files: SYSTEM, SOFTWARE, SAM, SECURITY, NTUSER.DAT
- Extracting hives from an image and their transaction logs (LOG1, LOG2)
- A key’s last write time and what it tells you
- Producing reports with RegRipper plugins
- Short task: find the computer name, time zone and last shutdown time
System and user information
- SAM: local accounts, last logon and password change
- Installed and removed software
- Networks joined and wireless profiles
- RecentDocs, MRU lists and typed paths
- Short task: list the five documents the user opened last
Persistence and abuse
- Persistence with Run and RunOnce keys
- Suspicious entries in service keys
- IFEO and COM hijacking traces
- Reviewing all autostart locations in one list
- Comparing two registry snapshots
- Capstone: uncover the attacker’s persistence methods from the registry
Practice labs
- Extract the hive files from an image: Extract SYSTEM, SOFTWARE, SAM and one user's NTUSER.DAT from an image and hash them.
- Computer name, time zone, last shutdown: Find the computer name, time zone and last shutdown time from the SYSTEM hive.
- A current hive with transaction logs: Apply the LOG1 and LOG2 files to bring the hive up to date and show the change waiting in the log.
- Produce a report with RegRipper: Run RegRipper on the SOFTWARE hive and read the operating system version from the report.
- Installed and removed software: List installed software and find what was installed and removed in the incident week.
- Connected networks and wireless profiles: Order the networks the computer joined with first and last connection times from the network profiles.
- List the local accounts from SAM: List the local accounts with last logon and password change times.
- The last five documents opened: Order the last five documents the user opened from RecentDocs and the MRU lists.
- Typed paths and run history: From typed paths and the run box history extract the shares and commands the user went to by hand.
- Audit the Run and RunOnce keys: List the autostart entries in the system and user hives and mark the unrecognised one.
- The suspicious entry in the service keys: Find the service added later by its image path and the key's last write time.
- Find the IFEO and COM traces: Detect the persistence set through a debugger value and a user-level COM registration in prepared hives.
- Interpret a key's last write time: Read the last write time of three keys and write what it does and does not prove.
- Compare two snapshots: Compare the hives from before and after the incident and list the added keys.
- Produce the persistence methods in one list: Scan every autostart point in Ilgıntepe Tekstil's prepared image and report the persistence methods with times.
About this course
You extract registry hives from an image and use RegRipper and registry viewers to examine user activity, installed software, network history and persistence keys.
What you will learn
- Registry structure
- System and user information
- Persistence and abuse
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.