IHU Cybersecurity Exam Notes

Source: Juni_2026_Exams/Advance_Forensics/notes/02-registry-forensics.md

📖 Registry Forensics Guide

Understanding the Registry

The Windows Registry is a hierarchical database that stores configuration and user activity. In forensics, it's your primary source of truth for answering most exam questions.

🏛️ Registry Structure Basics

Hive Organization

HKLM = HKEY_LOCAL_MACHINE (entire computer)
├── SOFTWARE          [System-wide software config]
├── SYSTEM            [Core OS settings]
├── SAM               [User accounts - PROTECTED]
├── SECURITY          [Security policies - PROTECTED]
└── HARDWARE          [Hardware profile]

HKCU = HKEY_CURRENT_USER (logged-in user)
└── [contents of NTUSER.DAT]

File Locations

Hive File Location Purpose
HKLM\SOFTWARE C:\Windows\System32\config\SOFTWARE System software config
HKLM\SYSTEM C:\Windows\System32\config\SYSTEM OS core settings
HKLM\SAM C:\Windows\System32\config\SAM User accounts (requires admin)
HKCU\... C:\Users\[Username]\NTUSER.DAT User-specific settings

🎯 Critical Registry Paths (MEMORIZE THESE)

1. System Identification Artifacts

Registered Owner

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOwner

What: Name of PC owner Type: String (REG_SZ) Exam use: "Who owns this computer?" Example answer: "John Doe"

Product Name

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName

What: Windows version Type: String Exam use: "What Windows version is installed?" Example: "Windows 10 Pro"

Install Date

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate

What: When Windows was installed Type: DWORD (Unix timestamp) Exam use: "When was Windows installed?" Example: 1577836800 (Dec 31, 2019) What to remember: This is a Unix timestamp, convert with DCode

2. Computer & Network Identification

Computer Name

HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName\ComputerName

What: NetBIOS computer name Type: String Exam use: "What is the computer name?" Example: "WORKSTATION-01" Note: Also check HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Hostname

Domain Name

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Domain

What: Domain this computer is joined to Type: String Exam use: "Is this computer domain-joined?" Example: "company.local"

3. Shutdown & System Events

Shutdown Time

HKLM\SYSTEM\CurrentControlSet\Control\Windows\ShutdownTime

What: Last time system was shut down Type: Binary (8-byte FILETIME) Exam use: "When was the computer shut down?" How to read: Copy the hex value and convert with DCode What to remember: This is a Windows FILETIME format (100-nanosecond intervals since 1601)

Last Known Good

HKLM\SYSTEM\Select\LastKnownGood

What: Points to last successful boot Type: DWORD Exam use: "Was the last boot successful?" Values: (Usually 1 = successful, 2 = recovery mode)

4. User Accounts

User Accounts (SAM Hive)

HKLM\SAM\Domains\Account\Users

What: All user accounts on the computer Type: Subkeys for each user (RIDs) Exam use: "List all non-system users" What to remember: System users = RID < 1000; Normal users = RID >= 1000

User Login Times (SAM)

HKLM\SAM\Domains\Account\Users\[RID]\F

What: Last login time for user Type: Binary (FILETIME) Exam use: "When did this user last log in?" How to find: Look at the F subvalue in user RID

User Account Status

HKLM\SAM\Domains\Account\Users\[RID]\C

What: User properties (enabled, disabled, locked) Type: Binary (encoded) Note: Complex to decode; usually requires specialized tools

5. User Activity (NTUSER.DAT)

Recent Documents

HKU\[SID]\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

What: Files recently opened by user Type: String values Exam use: "What files did the user recently open?" Example:

.txt = document.txt
.doc = report.docx
.pdf = invoice.pdf

What to remember: File extensions are also subkeys containing file paths

UserAssist (Program Execution)

HKU\[SID]\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}

What: Programs executed by user Type: Binary (ROT13 encoded) Exam use: "What programs did the user run?" How to read: Values are encoded; decoders available (free online) Contains: Program path, execution count, last execution time

Run History

HKU\[SID]\Software\Microsoft\Windows\CurrentVersion\Run

What: Programs set to auto-run for this user Type: String values pointing to executables Exam use: "What programs auto-start?" Contains: Registry entries for user-level persistence

6. Persistence Mechanisms (Malware Indicators)

Run Keys (User-Level)

HKU\[SID]\Software\Microsoft\Windows\CurrentVersion\Run
HKU\[SID]\Software\Microsoft\Windows\CurrentVersion\RunOnce

What: Programs that launch when user logs in Exam use: "How does malware persist?" Example entry:

"Svchost" = "C:\Windows\System32\svchost.exe"  [SUSPICIOUS - wrong location]
"MalwareMonitor" = "C:\Temp\malware.exe"

Run Keys (System-Level)

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

What: Programs that launch for all users Exam use: "Is there system-wide malware persistence?" Note: These run even if user doesn't login

Services (Persistence)

HKLM\SYSTEM\CurrentControlSet\Services\[ServiceName]

What: Windows services (can auto-start) Type: Complex key structure Exam use: "What services are suspicious?" Look for: ImagePath pointing to unusual locations

Boot Execute

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute

What: Programs run during boot Exam use: "What runs before Windows loads?" Dangerous: Very hard to remove; definite malware indicator

7. Software & Installation

Installed Programs (User)

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

What: User's special folders (Documents, Downloads, etc.) Exam use: "Where are the user's important files?"

Installed Programs (System)

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

What: All installed software Contains: Display name, version, install date, uninstall string Exam use: "What software is installed? When was it installed?"

File Associations

HKLM\SOFTWARE\Classes\[FileExtension]

What: What program opens each file type Exam use: "Was .exe associated with suspicious program?" Example: .txt → notepad.exe (normal) vs .txt → malware.exe (suspicious)

8. Network & DNS

Network Adapters

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\[GUID]

What: IP configuration for each adapter Contains: IP address, DHCP settings, DNS servers Exam use: "What IP was this computer assigned?"

DNS Search Order

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

What: DNS servers used Contains: Nameserver settings Exam use: "Was DNS redirected to suspicious server?"

🔍 How to Use Registry Explorer

Opening Hives

Before loading

Work with hives exported from the forensic image, not the original evidence. Keep the hive and its transaction logs together:

Registry\
├── SOFTWARE
├── SOFTWARE.LOG1
├── SOFTWARE.LOG2
├── SYSTEM
├── SYSTEM.LOG1
├── SYSTEM.LOG2
├── SAM
├── SAM.LOG1
├── SAM.LOG2
├── NTUSER-John.DAT
├── ntuser.dat.LOG1
└── ntuser.dat.LOG2

Transaction logs can contain updates that were not yet written into the main hive. Registry Explorer may offer to replay them. Record whether recovery was performed because it changes the analyzed working copy.

Load a hive in Registry Explorer

  1. Launch Registry Explorer.
  2. Select File → Load hive or Open hive depending on the installed

version.

  1. Select the exported hive, such as D:\Evidence\Registry\SOFTWARE.
  2. If transaction logs are detected, allow recovery for the analysis copy.
  3. Wait for parsing to finish and check the messages/status area for errors.
  4. Record the hive filename, source path in the image, tool version, and

whether logs were replayed.

  1. Expand the root and navigate to the required key.

Do not expect the loaded root to display exactly like live Regedit. If the SOFTWARE file is loaded directly, start at:

Microsoft\Windows NT\CurrentVersion

not:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion

The latter is the logical live-registry path used when reporting the finding.

Load per-user hives

Load each user's artifacts separately and label them with the username:

C:\Users\[username]\NTUSER.DAT
C:\Users\[username]\AppData\Local\Microsoft\Windows\UsrClass.dat

NTUSER.DAT contains artifacts such as UserAssist, RecentDocs, and user Run keys. UsrClass.dat contains additional Explorer artifacts such as ShellBags. Do not mix findings between users.

Resolve CurrentControlSet in an offline SYSTEM hive

CurrentControlSet is an alias created by a running Windows system. An offline SYSTEM hive normally contains ControlSet001, ControlSet002, and similar keys.

  1. Open SYSTEM\Select.
  2. Read the Current value.
  3. Convert it to a three-digit control-set number.
  4. If Current = 1, use ControlSet001.
  5. Report the logical path and the physical offline path.

Example:

Logical path:
HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName

Offline path when Select\Current = 1:
SYSTEM\ControlSet001\Control\ComputerName\ComputerName

Some parsers create a convenience CurrentControlSet node. Verify which control set it represents before relying on it.

Validate the loaded hive

Before answering questions:

SOFTWARE.

Searching

1. Press Ctrl+F (or Edit → Search)
2. Type search term (e.g., "RegisteredOwner")
3. Read results
4. Navigate to matching keys

Reading Values

Left pane: Key hierarchy
Right pane: Values

Example:
Left: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
Right: RegisteredOwner = "John Doe"
       ProductName = "Windows 10 Pro"
       InstallDate = 1577836800

⏱️ Timestamp Interpretation

Types of Timestamps in Registry

Type Format Example Tool
Unix Epoch Decimal seconds since 1970 1577836800 DCode → Unix
Windows FILETIME Hex (100-ns since 1601) 01D12345ABCDEF DCode → FILETIME
String Human-readable 2020-01-01 12:00:00 Direct read

Converting with DCode

Example: InstallDate value is 1577836800

1. Copy value: 1577836800
2. Open DCode
3. Select "Unix timestamp"
4. Paste value
5. Result: 2020-01-01 12:00:00 UTC
6. Adjust for timezone (CET = UTC + 1 hour = 13:00 local)

📋 Registry Forensics Checklist

Question: "Who owns this computer?"

Question: "When was Windows installed?"

Question: "What is the computer name?"

Question: "When was it shut down?"

Question: "What programs did the user run?"

Question: "What was recently opened?"

Question: "What auto-starts?"

💡 Common Exam Patterns

Pattern 1: System Ownership

"Who is the registered owner and when was Windows installed?"

Tools: Registry Explorer → SOFTWARE hive Paths: RegisteredOwner + InstallDate Answer Format: "Owner: [name], Installed: [date] UTC"

Pattern 2: Computer Identification

"What is the computer name and domain?"

Tools: Registry Explorer → SYSTEM hive Paths: ComputerName + Domain Answer Format: "Computer: [name], Domain: [domain or none]"

Pattern 3: Shutdown Forensics

"When was the computer shut down?"

Tools: Registry Explorer → SYSTEM + DCode Paths: ShutdownTime (convert hex) Answer Format: "[Date] [Time] UTC (or local time)"

Pattern 4: User Activity

"What programs did the user run?"

Tools: Registry Explorer → NTUSER.DAT Paths: UserAssist Answer Format: List decoded program names and execution count

Pattern 5: Persistence Detection

"Is there evidence of malware persistence?"

Tools: Registry Explorer → SOFTWARE + NTUSER.DAT Paths: Run keys, Services, Boot Execute Answer Format: "Found [program name] at [suspicious path]"

⚠️ Common Mistakes

❌ Mistake 1: Confusing hive locations

❌ Mistake 2: Not converting timestamps

❌ Mistake 3: Using RegEdit for forensic analysis

❌ Mistake 4: Missing case sensitivity

❌ Mistake 5: Confusing UserAssist encoding

🎓 What to Memorize

Tier 1 (MUST MEMORIZE)

RegisteredOwner → SOFTWARE\Microsoft\Windows NT\CurrentVersion
InstallDate → SOFTWARE\Microsoft\Windows NT\CurrentVersion
ComputerName → SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
ShutdownTime → SYSTEM\CurrentControlSet\Control\Windows\ShutdownTime
RecentDocs → NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
UserAssist → NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
Run keys → SOFTWARE\Microsoft\Windows\CurrentVersion\Run (system)
Run keys → NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run (user)

Tier 2 (GOOD TO KNOW)

SAM → User accounts
Services → Persistence mechanisms
UninstallList → Installed software

📝 Practice Exercises

Exercise 1: Extract System Info

  1. Open SOFTWARE hive
  2. Find: RegisteredOwner, ProductName, InstallDate
  3. Convert InstallDate with DCode
  4. Write down all three pieces of info

Exercise 2: Check for Persistence

  1. Open SYSTEM hive
  2. Resolve the active control set through SYSTEM\Select\Current
  3. Review ControlSet00x\Services for auto-start services and suspicious

ImagePath values

  1. Open SOFTWARE and check Microsoft\Windows\CurrentVersion\Run and

RunOnce

  1. Open each NTUSER.DAT and check the equivalent user Run/RunOnce keys
  2. Correlate suspicious paths with the filesystem before concluding

persistence

Exercise 3: User Activity Analysis

  1. Open NTUSER.DAT
  2. Navigate to RecentDocs
  3. List all recently opened files
  4. Check UserAssist for program execution

Exercise 4: Timeline Reconstruction

  1. Get InstallDate from SOFTWARE
  2. Get ShutdownTime from SYSTEM
  3. Get Last Login from SAM
  4. Convert all to readable format
  5. Create timeline

Last Updated: June 15, 2026