Source: Juni_2026_Exams/Advance_Forensics/checklists/registry-artifacts-cheatsheet.md

📌 Registry Artifacts Cheatsheet

MEMORIZE THESE — Print and keep at your desk during exam

Tier 1: MUST MEMORIZE

System Identification

Path:     SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOwner
Type:     String
Question: "Who owns this computer?"
Answer:   [Name]\n
**Install Date**
Path:     SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate
Type:     Unix Timestamp (convert with DCode)
Question: "When was Windows installed?"
Answer:   [Date] [Time] UTC\n
**Product Name**
Path:     SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName
Type:     String
Question: "What Windows version?"
Answer:   [e.g., Windows 10 Pro]\n
**Computer Name**
Path:     SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName\ComputerName
Type:     String
Question: "What is computer name?"
Answer:   [Hostname]

System Events

**Shutdown Time**
Path:     SYSTEM\CurrentControlSet\Control\Windows\ShutdownTime
Type:     Binary (Windows FILETIME in hex)
Question: "When was it shut down?"
Answer:   [Date] [Time] UTC (convert with DCode)\n
**Last Known Good**
Path:     SYSTEM\Select\LastKnownGood
Type:     DWORD (1=good, 2=recovery)
Question: "Was boot successful?"
Answer:   [Yes/No]\n
**Install Date (Alternative)**
Path:     SYSTEM\CurrentControlSet\Services\EventLog\System\(timestamp)
Type:     Mixed
Note:     Use SOFTWARE hive if possible

User Accounts

**User Accounts List**
Path:     SAM\Domains\Account\Users
Type:     Subkeys (RID = Registry ID)
RID <1000: System accounts (admin, guest, computer)
RID ≥1000: User accounts (real users)
Question: "List non-system users"
Answer:   [Username1, Username2, ...]\n
**Last Login**
Path:     SAM\Domains\Account\Users\[RID]\F
Type:     Binary (FILETIME)
Question: "When did user X last login?"
Answer:   [Date] [Time] UTC (convert)

User Activity

**Recent Documents**
Path:     NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
Type:     Multiple string values
Question: "What files were recently opened?"
Answer:   [List of filenames]\n
**UserAssist (Program Execution)**
Path:     NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}
Type:     Binary (ROT13 encoded)
Question: "What programs were executed?"
Answer:   [List of programs] (need decoder)\n
**File Name History**
Path:     NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
Type:     String values
Question: "Recent Run commands?"
Answer:   [Cmd list]

Persistence (AUTO-START)

**User Run Key**
Path:     NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run
Type:     String values (name=path)
Question: "What auto-starts for this user?"
Answer:   [Program name] → [Path to executable]\n
**User RunOnce**
Path:     NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\RunOnce
Type:     String values
Question: "What runs once?"
Answer:   [Program name] → [Path]\n
**System Run Key**
Path:     SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Type:     String values
Question: "System-wide auto-start?"
Answer:   [Program name] → [Path]\n
**System RunOnce**
Path:     SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Type:     String values
Question: "System auto-start once?"
Answer:   [Program name] → [Path]\n
**Boot Execute**
Path:     SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute
Type:     String
Question: "What runs during boot?"
Answer:   [Programs] (VERY SUSPICIOUS if any value)\n
**Services**
Path:     SYSTEM\CurrentControlSet\Services\[ServiceName]\ImagePath
Type:     String (path to executable)
Question: "Suspicious services?"
Check:    Does path look normal? Is it in Program Files?
Answer:   [Service] → [Path]

Tier 2: GOOD TO KNOW

Software & Installation

**Installed Programs**
Path:     SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Type:     Subkeys per program
Contains: DisplayName, Version, InstallDate\n
**File Associations**
Path:     SOFTWARE\Classes\[.extension]
Type:     String (points to program)
Question: "What opens .exe files?"
Answer:   [Program]\n
**Network Adapters**
Path:     SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{GUID}
Type:     Mixed (IP, DNS, etc.)
Question: "What IP was assigned?"
Answer:   [IP Address]

Advanced

**AppInit DLLs (Injection)**
Path:     SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs
Type:     String
Note:     Any value = SUSPICIOUS\n
**Browser Plugins**
Path:     SOFTWARE\Microsoft\Internet Explorer\Extensions
Type:     Mixed
Question: "Malicious browser plugins?"
Answer:   [Plugin names]\n
**Scheduled Tasks**
Path:     SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache
Type:     Complex
Question: "Scheduled persistence?"
Answer:   [Task names]\n
**Prefetch**
Path:     C:\Windows\Prefetch\*.pf (not in registry, but related)
Note:     Shows programs executed
Answer:   [Program list]

Quick Reference by Question Type

"Who owns the computer?"

→ SOFTWARE\RegisteredOwner

"When was it installed/shut down?"

→ SOFTWARE\InstallDate (creation)
→ SYSTEM\ShutdownTime (shutdown)
→ Use DCode to convert

"Computer name?"

→ SYSTEM\ComputerName (full path above)

"Recent files?"

→ NTUSER.DAT\RecentDocs

"Programs run?"

→ NTUSER.DAT\UserAssist (need to decode ROT13)

"Auto-start programs?"

→ NTUSER.DAT\Run (user-level)
→ SOFTWARE\Run (system-level)
→ SYSTEM\Services (check ImagePath)

"Deleted files?"

→ Not in registry!
→ Use MFT Explorer instead

"Persistence mechanism?"

→ Run keys (NTUSER.DAT + SOFTWARE)
→ Services (SYSTEM)
→ Boot Execute (SYSTEM)
→ Startup folders (file system)

Hive Quick Reference

Common Path Shortcuts

Instead of memorizing full paths, remember:

Owner?
→ SOFTWARE + "RegisteredOwner" search\n
Date?
→ "InstallDate" or "ShutdownTime" search\n
Recent?
→ NTUSER.DAT + search "RecentDocs"\n
Run?
→ Search for "Run" or "RunOnce"\n
Shutdown?
→ SYSTEM + "ShutdownTime"

Anomaly Red Flags

Check these in EVERY answer:

❌ Created > Modified = SUSPICIOUS (impossible)
❌ Future date = SUSPICIOUS (clock wrong or spoofed)
❌ Very old date (1980) = SUSPICIOUS (timestamp spoofed)
❌ Run key → Temp folder = SUSPICIOUS (malware)
❌ Run key → Random name = SUSPICIOUS
❌ Missing executable = SUSPICIOUS (deleted malware?)

Timestamp Format Reference

InstallDate = Unix timestamp → Use DCode
ShutdownTime = Hex FILETIME → Use DCode
UserAssist = ROT13 encoded + timestamp → Decode + DCode
RecentDocs = Registry string → Already readable

Print This Card!

Cut along dotted line and tape to your monitor during exam:

╔════════════════════════════════╗
║   REGISTRY QUICK REFERENCE      ║
╠════════════════════════════════╣
║ Owner?      → SOFTWARE\Owner   ║
║ Install?    → SOFTWARE\Install║
║ Computer?   → SYSTEM\Computer║
║ Shutdown?   → SYSTEM\Shutdown║
║ Recent?     → NTUSER.DAT\Rec║
║ Programs?   → NTUSER.DAT\UA║
║ Auto-start? → SOFTWARE/USER\Run║
╚════════════════════════════════╝

Last Updated: June 15, 2026