Title: Forensics Lab: Windows
Course: CAP 2140 Digital Forensics > Section: Working with Windows and DOS Systems

Overview

In this lab we will examine registry files, which we call them hives. We will identify the registry hive containing username and password hashes and add those registry files to the AccessData Registry Viewer for further examination.

Complete ONE of the following labs located at the end of Chapter 6 in the lab manual:

- 6.1 Examining the Windows XP SAM Hive
- 6.2 Examining the Windows XP System Hive
- 6.3 Examining the Windows XP NTUSER.DAT Hive

Be sure to carefully follow the directions for the project and include the full name and description of the project in your submission so that your instructor knows which project you chose.

Submission: To submit your file, choose the link above. Use the "Browse My Computer" button in the Attach File area to attach your document. Be sure to complete your submission by choosing the "Submit" button at the bottom of the screen. Make sure that you follow the due dates in the course calendar.

This lab will be graded using the Lab Assignment Rubric. Please use it as a guide toward successful completion of this lab.