Windows registry
Terminology
Hive
According to 1
A hive is a logical group of keys, subkeys, and values in the Windows Registry that has a set of supporting files containing backups of its data.
However in common usage the term hive often does not imply the supporting files.
According to MSDN the origin of the term is bee hives.
File Locations
The Windows Registry is stored in multiple files.
Windows NT 4
In Windows NT 4 (and later) the Registry is stored in the Windows NT Registry File (regf) format.
Basically the following Registry hives are stored in the corresponding files:
- HKEY_USERS: \Documents and Setting\User Profile\NTUSER.DAT
- HKEY_USERS\DEFAULT: C:\Windows\system32\config\default
- HKEY_LOCAL_MACHINE\SAM: C:\Windows\system32\config\SAM
- HKEY_LOCAL_MACHINE\SECURITY: C:\Windows\system32\config\SECURITY
- HKEY_LOCAL_MACHINE\SOFTWARE: C:\Windows\system32\config\software
- HKEY_LOCAL_MACHINE\SYSTEM: C:\Windows\system32\config\system
Windows 9x/ME
In Windows 95, 98, Me the Registry is stored in the Windows 9x Registry File (creg) format.
- \Windows\user.dat
- \Windows\system.dat
- \Windows\profiles\user profile\user.dat
Special cases
The Windows Registry has several special case scenarios, mainly concerning key and value name, that are easy to fail to account for:
- special characters in key and value names
- duplicate key and value names
- the names when stored in extended ASCII (ANSI string) use a codepage that is dependent on the system settings
- unreconciled data
Special characters in key and value names
Both key and values names are case insensitive. The \ character is used as the key separator. Note that the \ character can be used in value names. The / character is used in both key and value names. Some examples of which are:
Key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\NetBT\Parameters\
Value: Size/Small/Medium/Large
Key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\VIDEO\disc\
Value: \Device\Video0
Key:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\xmlprov\Parameters\SchemaGroups\User\http://www.microsoft.com/provisioning/eaptlsuserpropertiesv1\
Value: SchemaFile
Also, null bytes may be present in key values in order to hide data 3.
Codepaged ASCII strings
Value with name "ëigenaardig" created on Windows XP codepage 1252.
value key data:
00000000: 76 6b 0b 00 46 00 00 00 20 98 1a 00 01 00 00 00 vk..F... .......
00000010: 01 00 69 6e eb 69 67 65 6e 61 61 72 64 69 67 00 ..in.ige naardig.
00000020: 55 4e 49 43 UNIC
value key signature : vk
value key value name size : 11
value key data size : 0x00000046 (70)
value key data offset : 0x001a9820
value key data type : 1 (REG_SZ) String
value key flags : 0x0001
Value name is an ASCII string
value key unknown1 : 0x6e69 (28265)
value key value name : ëigenaardig
value key value name hash : 0xb78835ee
value key padding:
00000000: 00 55 4e 49 43 .UNIC
As you can see the name is stored in extended ASCII (ANSI) using codepage 1252.
Unreconciled data
Starting from Windows 8.1 and Windows Server 2012 R2, a new implementation of the hive flusher was introduced in kernel. This implementation attempts to radically reduce the number of disk writes on a mounted hive: in particular, a flush operation on a hive will store modified (dirty) data in a transaction log file, but hive bins in a primary file (also known as a normal or data file) will be intact. A kernel will sync a primary file after one of the following conditions has occurred:
- an hour has elapsed since the latest write to a primary file;
- a power management subsystem reports that all users (local and remote) are inactive;
- the operating system is shutting down (hive is unloading).
In order to correctly handle unreconciled data (e.g. when dealing with an image taken from a live system), one needs to parse transaction log files along with primary files.
Persistence keys
The following lists are loosely based of:
Note that in the lists below HKEY_CURRENT_USER is a subset of HKEY_USERS
Command Processor (cmd.exe)
Description |
Command Processor Auto Run |
WindowsCommandProcessorAutoRun |
|
Key path(s) |
|
Value name(s) |
AutoRun |
Additional information |
[https://technet.microsoft.com/en-us/library/cc779439(v=ws.10).aspx Command Processor\AutoRun] |
Debugging
Description |
Automatic debugging |
WindowsAutomaticDebugging |
|
Key path(s) |
|
Value name(s) |
Debugger |
Additional information |
https://learn.microsoft.com/en-us/windows/win32/debug/configuring-automatic-debuggingConfiguring Automatic Debugging] |
Internet Explorer
Description |
Browser Helper Objects |
InternetExplorerBrowserHelperObjects |
|
Key path(s) |
|
Value name(s) |
* |
Additional information |
Local Security Authority (LSA)
Description |
Local Security Authority (LSA) Authentication Packages |
WindowsLSAAuthenticationPackages |
|
Key path(s) |
|
Value name(s) |
Authentication Packages |
Additional information |
Description |
Local Security Authority (LSA) Notification Packages |
WindowsLSANotificationPackages |
|
Key path(s) |
|
Value name(s) |
Notification Packages |
Additional information |
Description |
Local Security Authority (LSA) Security Packages |
WindowsLSASecurityPackages |
|
Key path(s) |
|
Value name(s) |
Security Packages |
Additional information |
Run keys
Description |
Run keys |
WindowsRunKeys |
|
Key path(s) |
|
Value name(s) |
* |
Additional information |
Description |
Run services keys |
WindowsRunServices |
|
Key path(s) |
|
Value name(s) |
* |
Additional information |
Session Manager
Description |
Session Manager Execute |
|
|
Key path(s) |
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager |
Value name(s) |
|
Additional information |
Description |
Windows Session Manager Windows-on-Windows (WOW) command line |
WindowsSessionManagerWOWCommandLine |
|
Key path(s) |
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\WOW |
Value name(s) |
|
Additional information |
Service Control Manager
| Description | Service Control Manager extension |
| Artifact name | WindowsServiceControlManagerExtension |
| Key path(s) | HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control |
| Value name(s) | ServiceControlManagerExtension |
| Additional information |
Windows shell (explorer.exe)
Description |
Shell Icon Overlay Identifiers |
WindowsShellIconOverlayIdentifiers |
|
Key path(s) |
|
Value name(s) |
* |
Additional information |
Description |
Shell Extensions |
WindowsShellExtensions |
|
Key path(s) |
|
Value name(s) |
* |
Additional information |
Description |
Shell Execute Hooks |
WindowsShellExecuteHooks |
|
Key path(s) |
|
Value name(s) |
* |
Additional information |
Description |
Shell Load and Run |
WindowsShellLoadAndRun |
|
Key path(s) |
|
Value name(s) |
|
Additional information |
Description |
Shell Service Object Delay Load |
WindowsShellServiceObjects |
|
Key path(s) |
|
Value name(s) |
* |
Additional information |
Winlogon and Credential Providers
Description |
Credential Provider Filters |
WindowsCredentialProviderFilters |
|
Key path(s) |
|
Value name(s) |
* |
Additional information |
Capturing Windows 7 Credential at logon using custom credential provider |
Description |
Credential Providers |
WindowsCredentialProviders |
|
Key path(s) |
|
Value name(s) |
* |
Additional information |
Capturing Windows 7 Credential at logon using custom credential provider |
Description |
Pre-Logon Access Provider (PLAP) Providers |
WindowsPLAPProviders |
|
Key path(s) |
|
Value name(s) |
* |
Additional information |
Description |
Winlogon Gina DLL |
WindowsWinlogonShell |
|
Key path(s) |
|
Value name(s) |
GinaDLL |
Additional information |
Description |
Winlogon Notify |
WindowsWinlogonNotify |
|
Key path(s) |
|
Value name(s) |
DLLName |
Additional information |
Description |
Winlogon Shell |
WindowsWinlogonShell |
|
Key path(s) |
|
Value name(s) |
Shell |
Additional information |
Description |
Winlogon System |
WindowsWinlogonSystem |
|
Key path(s) |
|
Value name(s) |
System |
Additional information |
Description |
Winlogon Taksman |
WindowsWinlogonTaksman |
|
Key path(s) |
|
Value name(s) |
Taksman |
Additional information |
Description |
Winlogon Userinit |
WindowsWinlogonUserinit |
|
Key path(s) |
|
Value name(s) |
Userinit |
Additional information |
Description |
Winlogon VMApplet |
WindowsWinlogonVMApplet |
|
Key path(s) |
|
Value name(s) |
VMApplet |
Additional information |
Policy
Description |
Windows System Policy replacement shell |
WindowsSystemPolicyShell |
|
Key path(s) |
|
Value name(s) |
Shell |
Additional information |
Unsorted
Description |
Active Setup - Installed Components |
WindowsStubPaths |
|
Key path(s) |
|
Value name(s) |
StubPath |
Additional information |
Description |
Application Initial (AppInit) DLLs persistence |
WindowsAppInitDLLs |
|
Key path(s) |
|
Value name(s) |
AppInit_DLLs |
Additional information |
Description |
Security Providers |
WindowsSecurityProviders |
|
Key path(s) |
|
Value name(s) |
* |
Additional information |
Description |
Alternate shell |
WindowsAlternateShell |
|
Key path(s) |
|
Value name(s) |
AlternateShell |
Additional information |
Description |
Boot verification program |
WindowsBootVerificationProgram |
|
Key path(s) |
|
Value name(s) |
ImagePath |
Additional information |
Bibliography
- Using ShellBag Information to Reconstruct User Activities, by Yuandong Zhu*, Pavel Gladyshev, Joshua James, DFRWS 2009
- Recovering Deleted Data From the Windows Registry, by Timothy Morgan, DFRWS 2008
- Forensic Analysis of the Windows Registry in Memory and slides, by Brendan Dolan-Gavitt, DFRWS 2008
- The Windows Registry as a forensic resource, Digital Investigation, Volume 2, Issue 3, September 2005, Pages 201--205.
- Windows registry file format specification, by Maxim Suhanov, 2015-2016
Undated
- A Windows Registry Quick Reference: For the Everyday Examiner, by Derrick Farmer, Burlington, VT.
- Forensic Analysis of the Windows Registry, by Lih Wern Wong , School of Computer and Information Science, Edith Cowan University
Also see
External Links
- Wikipedia: Windows Registry
- Windows Incident Response Articles on Registry
- Windows Registry Information
- Push the Red Button
- Exporting registry hives from a live system, by Maxim Suhanov, October 3, 2020
Windows 32-bit on Windows 64-bit (WoW64)
- Registry Keys Affected by WOW64, by Microsoft
- Registry Redirector, by Microsoft
- Registry Keys Affected by WOW64, by Microsoft
- 32-bit and 64-bit Application Data in the Registry, by Microsoft
Cached Credentials
- Cached Credentials, by Juggernaut
Mounted Devices
- Registry Analysis (Windows Forensic Analysis) Part 6, September 2011
Persistence keys
- Understand and Control Startup Apps with the System Configuration Utility, by Microsoft Technet
- Silent Runners, by Andrew Aronoff
- Beyond good ol’ Run key, Hexacorn blog, July 23, 2012
- Plugins: soft_run user_run, by Corey Harrell, April 17, 2013
- Auto-Start Extensibility Points (ASEPs), by the RegRipper project, April 29, 2013
- Volatility autoruns plugin, by the Volatility project, April 14, 2015
User Assist
- UserAssist, by Didier Stevens
- UserAssist V2.3.0, by Didier Stevens, July 17, 2007
- More on (the) UserAssist keys, by Harlan Carvey, Monday, September 03, 2007
- Windows 7 Beta: ROT13 Replaced With Vigenère? Great Joke!, by Didier Stevens, January 18, 2009
- Prefetch and User Assist, by DC174, May 27, 2010
- UserAssist Forensics (timelines, interpretation, testing, & more), by Dan (@4n6k), May 14, 2013
- Daily Blog #45: Understanding the artifacts: User Assist, by David Cowen, August 7, 2013
Tools
Open Source
- Forensic Registry EDitor (fred) - "Forensic Registry EDitor (fred) is a cross-platform M\$ registry hive editor" by Daniel Gillen
- regviewer — a tool for looking at the registry.
- RegRipper — "the fastest, easiest, and best tool for registry analysis in forensics examinations."
- Parse::Win32Registry Perl module.
- python-registry Python module.
- libregf - Library and tools to access the Windows NT Registry File (REGF) format
- Registryasxml - Tool to import/export registry sections as XML
- kregedit - a KDE utility for viewing and editing registry files.
- Registry Full featured, offline Registry hive parser written in C#. Supports deleted item recovery, full searching, and more by @EricZimmerman
Discontinued
- ntreg a file system driver for linux, which understands the NT registry file format.
- Registry Decoder live hive acquisition and offline analysis component, by Andrew Case
Freeware
- Registry Explorer Registry Explorer and RECmd allow unrivaled access to Registry hives and contain bookmarks for common registry keys by @EricZimmerman