Title: 5. Understanding the Windows Registry
Course: IN 2005 Digital Forensics > Section: Module 6: Chapter 6 - Working with Windows and DOS Systems

Understanding the Windows Registry

1. Windows Registry is a database that stores hardware and software configuration information, network connections, user preferences and setup information.
2. For investigative purposes, the Registry can contain valuable evidence.
3. To view the Registry, you can use the Regedit (Registry Editor) program for Windows 9x systems and Regedt32 for Windows 2000 and XP.

Exploring the Organization of the Windows Registry

1. Some of the following Registry terminology:
  - Registry
  - Registry Editor
  - HKEY
  - Key
  - Subkey
  - Branch
  - Value
  - Default value
  - Hives
2. See Table 6-6 to view how Registry files are organized in all Windows systems.
3. See Figure 6-12 to view how to use the Windows XP Registry Editor to explore the Registry.
4. See Table 6-7 that describe the Registry HKEYs and their functions.

Examining the Windows Registry

1. See Figures 6-13 and 6-14 that describe how to use ProDiscover Basic to extract System.dat and User.dat from an image file.
2. See Figures 6-15 through 6-17 to view how to use AccessData Registry Viewer to see what information you can find in these files.