Windows registry

Terminology

Hive

According to Registry Hives

A hive is a logical group of keys, subkeys, and values in the Windows Registry that has a set of supporting files containing backups of its data.

However in common usage the term hive often does not imply the supporting files.

According to MSDN the origin of the term is bee hives.

File Locations

The Windows Registry is stored in multiple files.

Windows NT 4

In Windows NT 4 (and later) the Registry is stored in the Windows NT Registry File (regf) format.

Basically the following Registry hives are stored in the corresponding files:

• HKEY_USERS: \Documents and Setting\User Profile\NTUSER.DAT
• HKEY_USERS\DEFAULT: C:\Windows\system32\config\default
• HKEY_LOCAL_MACHINE\SAM: C:\Windows\system32\config\SAM
• HKEY_LOCAL_MACHINE\SECURITY: C:\Windows\system32\config\SECURITY
• HKEY_LOCAL_MACHINE\SOFTWARE: C:\Windows\system32\config\software
• HKEY_LOCAL_MACHINE\SYSTEM: C:\Windows\system32\config\system

Windows 9x/ME

In Windows 95, 98, Me the Registry is stored in the Windows 9x Registry File (creg) format.

• \Windows\user.dat
• \Windows\system.dat
• \Windows\profiles\user profile\user.dat

Special cases

The Windows Registry has several special case scenarios, mainly concerning key and value name, that are easy to fail to account for:

• special characters in key and value names
• duplicate key and value names
• the names when stored in extended ASCII (ANSI string) use a codepage that is dependent on the system settings
• unreconciled data

Special characters in key and value names

Both key and values names are case insensitive. The \ character is used as the key separator. Note that the \ character can be used in value names. The / character is used in both key and value names. Some examples of which are:

Key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\NetBT\Parameters\
Value: Size/Small/Medium/Large

Key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\VIDEO\disc\
Value: \Device\Video0

Key:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\xmlprov\Parameters\SchemaGroups\User\http://www.microsoft.com/provisioning/eaptlsuserpropertiesv1\
Value: SchemaFile

Also, null bytes may be present in key values in order to hide data 3.

Codepaged ASCII strings

Value with name "ëigenaardig" created on Windows XP codepage 1252.

value key data:
00000000: 76 6b 0b 00 46 00 00 00  20 98 1a 00 01 00 00 00   vk..F...  .......
00000010: 01 00 69 6e eb 69 67 65  6e 61 61 72 64 69 67 00   ..in.ige naardig.
00000020: 55 4e 49 43                                        UNIC

value key signature                     : vk
value key value name size               : 11
value key data size                     : 0x00000046 (70)
value key data offset                   : 0x001a9820
value key data type                     : 1 (REG_SZ) String
value key flags                         : 0x0001
        Value name is an ASCII string

value key unknown1                      : 0x6e69 (28265)
value key value name                    : ëigenaardig
value key value name hash               : 0xb78835ee
value key padding:
00000000: 00 55 4e 49 43                                     .UNIC

As you can see the name is stored in extended ASCII (ANSI) using codepage 1252.

Unreconciled data

Starting from Windows 8.1 and Windows Server 2012 R2, a new implementation of the hive flusher was introduced in kernel. This implementation attempts to radically reduce the number of disk writes on a mounted hive: in particular, a flush operation on a hive will store modified (dirty) data in a transaction log file, but hive bins in a primary file (also known as a normal or data file) will be intact. A kernel will sync a primary file after one of the following conditions has occurred:

• an hour has elapsed since the latest write to a primary file;
• a power management subsystem reports that all users (local and remote) are inactive;
• the operating system is shutting down (hive is unloading).

In order to correctly handle unreconciled data (e.g. when dealing with an image taken from a live system), one needs to parse transaction log files along with primary files.

Persistence keys

The following lists are loosely based of:

• Silent Runners.vbs
• Forensic Artifacts

Note that in the lists below HKEY_CURRENT_USER is a subset of HKEY_USERS

Command Processor (cmd.exe)

Description	Command Processor Auto Run
Artifact name	WindowsCommandProcessorAutoRun
Key path(s)	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor
	HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Command Processor
	HKEY_USERS\%SID%\Software\Microsoft\Command Processor
	HKEY_USERS\%SID%\Software\Wow6432Node\Microsoft\Command Processor
Value name(s)	AutoRun
Additional information	https://technet.microsoft.com/en-us/library/cc779439(v=ws.10).aspx Command Processor\AutoRun

Debugging

Description	Automatic debugging
Artifact name	WindowsAutomaticDebugging
Key path(s)	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AeDebug
Value name(s)	Debugger
Additional information	Configuring Automatic Debugging

Internet Explorer

Description	Browser Helper Objects
Artifact name	InternetExplorerBrowserHelperObjects
Key path(s)	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects*
	HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects*
Value name(s)	*
Additional information

Local Security Authority (LSA)

Description	Local Security Authority (LSA) Authentication Packages
Artifact name	WindowsLSAAuthenticationPackages
Key path(s)	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\OSConfig
Value name(s)	Authentication Packages
Additional information

Description	Local Security Authority (LSA) Notification Packages
Artifact name	WindowsLSANotificationPackages
Key path(s)	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\OSConfig
Value name(s)	Notification Packages
Additional information

Description	Local Security Authority (LSA) Security Packages
Artifact name	WindowsLSASecurityPackages
Key path(s)	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\OSConfig
Value name(s)	Security Packages
Additional information

Run keys

Description	Run keys
Artifact name	WindowsRunKeys
Key path(s)	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run*
	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run*
	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce*
	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup*
	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx*
	HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run*
	HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce*
	HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Setup*
	HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnceEx*
	HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run*
	HKEY_USERS\%SID%\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run*
	HKEY_USERS\%SID%\Software\Microsoft\Windows\CurrentVersion\Run*
	HKEY_USERS\%SID%\Software\Microsoft\Windows\CurrentVersion\RunOnce*
	HKEY_USERS\%SID%\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup*
	HKEY_USERS\%SID%\Software\Microsoft\Windows\CurrentVersion\RunOnceEx*
	HKEY_USERS\%SID%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run*
	HKEY_USERS\%SID%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run*
	HKEY_USERS\%SID%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce*
	HKEY_USERS\%SID%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Setup*
	HKEY_USERS\%SID%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnceEx*
Value name(s)	*
Additional information

Description	Run services keys
Artifact name	WindowsRunServices
Key path(s)	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce*
	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices*
	HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServicesOnce*
	HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices*
Value name(s)	*
Additional information

Session Manager

Description	Session Manager Execute
Artifact name	WindowsSessionManagerBootExecute
	WindowsSessionManagerExecute
	WindowsSessionManagerSetupExecute
Key path(s)	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager
Value name(s)	BootExecute
	Execute
	SetupExecute
Additional information

Description	Windows Session Manager Windows-on-Windows (WOW) command line
Artifact name	WindowsSessionManagerWOWCommandLine
Key path(s)	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\WOW
Value name(s)	cmdline
	wowcmdline
Additional information

Service Control Manager

Description	Service Control Manager extension
Artifact name	WindowsServiceControlManagerExtension
Key path(s)	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control
Value name(s)	ServiceControlManagerExtension
Additional information

Windows shell (explorer.exe)

Description	Shell Icon Overlay Identifiers
Artifact name	WindowsShellIconOverlayIdentifiers
Key path(s)	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers*
	HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers*
	HKEY_USERS\%SID%\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers*
	HKEY_USERS\%SID%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers*
Value name(s)	*
Additional information

Description	Shell Extensions
Artifact name	WindowsShellExtensions
Key path(s)	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
	HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
	HKEY_USERS\%SID%\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
	HKEY_USERS\%SID%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
Value name(s)	*
Additional information

Description	Shell Execute Hooks
Artifact name	WindowsShellExecuteHooks
Key path(s)	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks*
	HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks*
Value name(s)	*
Additional information

Description	Shell Load and Run
Artifact name	WindowsShellLoadAndRun
Key path(s)	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
	HKEY_CURRENT_USER\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows
Value name(s)	Load
	Run
Additional information

Description	Shell Service Object Delay Load
Artifact name	WindowsShellServiceObjects
Key path(s)	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
	HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
Value name(s)	*
Additional information	TrojanClicker:Win32/Zirit.X

Winlogon and Credential Providers

Description	Credential Provider Filters
Artifact name	WindowsCredentialProviderFilters
Key path(s)	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters*
	HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters*
Value name(s)	*
Additional information	Capturing Windows 7 Credential at logon using custom credential provider

Description	Credential Providers
Artifact name	WindowsCredentialProviders
Key path(s)	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers*
	HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers*
Value name(s)	*
Additional information	Capturing Windows 7 Credential at logon using custom credential provider

Description	Pre-Logon Access Provider (PLAP) Providers
Artifact name	WindowsPLAPProviders
Key path(s)	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers*
	HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers*
Value name(s)	*
Additional information

Description	Winlogon Gina DLL
Artifact name	WindowsWinlogonShell
Key path(s)	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
	HKEY_USERS\%SID%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Value name(s)	GinaDLL
Additional information

Description	Winlogon Notify
Artifact name	WindowsWinlogonNotify
Key path(s)	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify*
	HKEY_USERS\%SID%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify*
Value name(s)	DLLName
Additional information

Description	Winlogon Shell
Artifact name	WindowsWinlogonShell
Key path(s)	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
	HKEY_USERS\%SID%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Value name(s)	Shell
Additional information

Description	Winlogon System
Artifact name	WindowsWinlogonSystem
Key path(s)	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
	HKEY_USERS\%SID%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Value name(s)	System
Additional information

Description	Winlogon Taksman
Artifact name	WindowsWinlogonTaksman
Key path(s)	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
	HKEY_USERS\%SID%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Value name(s)	Taksman
Additional information

Description	Winlogon Userinit
Artifact name	WindowsWinlogonUserinit
Key path(s)	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
	HKEY_USERS\%SID%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Value name(s)	Userinit
Additional information

Description	Winlogon VMApplet
Artifact name	WindowsWinlogonVMApplet
Key path(s)	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
	HKEY_USERS\%SID%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Value name(s)	VMApplet
Additional information

Policy

Description	Windows System Policy replacement shell
Artifact name	WindowsSystemPolicyShell
Key path(s)	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
	HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\System
Value name(s)	Shell
Additional information

Unsorted

Description	Active Setup - Installed Components
Artifact name	WindowsStubPaths
Key path(s)	HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components
	HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components
	HKEY_USERS\%SID%\Software\Microsoft\Active Setup\Installed Components
	HKEY_USERS\%SID%\Software\Wow6432Node\Microsoft\Active Setup\Installed Components
Value name(s)	StubPath
Additional information

Description	Application Initial (AppInit) DLLs persistence
Artifact name	WindowsAppInitDLLs
Key path(s)	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows
	HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows
	HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Windows
	HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows
Value name(s)	AppInit_DLLs
Additional information

Description	Security Providers
Artifact name	WindowsSecurityProviders
Key path(s)	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders*
Value name(s)	*
Additional information

Description	Alternate shell
Artifact name	WindowsAlternateShell
Key path(s)	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot
Value name(s)	AlternateShell
Additional information

Description	Boot verification program
Artifact name	WindowsBootVerificationProgram
Key path(s)	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\BootVerificationProgram
Value name(s)	ImagePath
Additional information

Bibliography

• Using ShellBag Information to Reconstruct User Activities, by Yuandong Zhu*, Pavel Gladyshev, Joshua James, DFRWS 2009
• Recovering Deleted Data From the Windows Registry, by Timothy Morgan, DFRWS 2008
• Forensic Analysis of the Windows Registry in Memory and slides, by Brendan Dolan-Gavitt, DFRWS 2008
• The Windows Registry as a forensic resource, Digital Investigation, Volume 2, Issue 3, September 2005, Pages 201--205.
• Windows registry file format specification, by Maxim Suhanov, 2015-2016

Undated

• A Windows Registry Quick Reference: For the Everyday Examiner, by Derrick Farmer, Burlington, VT.
• Forensic Analysis of the Windows Registry, by Lih Wern Wong , School of Computer and Information Science, Edith Cowan University

Also see

• Boot Configuration Data

External Links

• Wikipedia: Windows Registry
• Windows Incident Response Articles on Registry
• Windows Registry Information
• Push the Red Button
• Exporting registry hives from a live system, by Maxim Suhanov, October 3, 2020

Windows 32-bit on Windows 64-bit (WoW64)

• Registry Keys Affected by WOW64, by Microsoft
• Registry Redirector, by Microsoft
• Registry Keys Affected by WOW64, by Microsoft
• 32-bit and 64-bit Application Data in the Registry, by Microsoft

Cached Credentials

• Cached Credentials, by Juggernaut

Persistence keys

• Understand and Control Startup Apps with the System Configuration Utility, by Microsoft Technet
• Silent Runners, by Andrew Aronoff
• Beyond good ol' Run key, Hexacorn blog, July 23, 2012
• Plugins: soft_run user_run, by Corey Harrell, April 17, 2013
• Auto-Start Extensibility Points (ASEPs), by the RegRipper project, April 29, 2013
• Volatility autoruns plugin, by the Volatility project, April 14, 2015

User Assist

• UserAssist, by Didier Stevens
• UserAssist V2.3.0, by Didier Stevens, July 17, 2007
• More on (the) UserAssist keys, by Harlan Carvey, Monday, September 03, 2007
• Windows 7 Beta: ROT13 Replaced With Vigenère? Great Joke!, by Didier Stevens, January 18, 2009
• Prefetch and User Assist, by DC174, May 27, 2010
• UserAssist Forensics (timelines, interpretation, testing, & more), by Dan (@4n6k), May 14, 2013
• Daily Blog #45: Understanding the artifacts: User Assist, by David Cowen, August 7, 2013

Tools

Open Source

• Forensic Registry EDitor (fred) - "Forensic Registry EDitor (fred) is a cross-platform M\$ registry hive editor" by Daniel Gillen
• regviewer - a tool for looking at the registry.
• RegRipper - "the fastest, easiest, and best tool for registry analysis in forensics examinations."
• Parse::Win32Registry Perl module.
• python-registry Python module.
• libregf - Library and tools to access the Windows NT Registry File (REGF) format
• Registryasxml - Tool to import/export registry sections as XML
• kregedit - a KDE utility for viewing and editing registry files.
• Registry Full featured, offline Registry hive parser written in C#. Supports deleted item recovery, full searching, and more by @EricZimmerman

Discontinued

• ntreg a file system driver for linux, which understands the NT registry file format.
• Registry Decoder live hive acquisition and offline analysis component, by Andrew Case

Freeware

• Registry Explorer Registry Explorer and RECmd allow unrivaled access to Registry hives and contain bookmarks for common registry keys by @EricZimmerman

Commercial

• Windows Registry Recovery
• Registry Tool