Windows Registry
Windows Registry
Windows-Registrierungsdatenbank
The Windows Registry is the central configuration database of the operating system, in which system and application settings, user profiles and countless traces of usage are stored. For forensics it is a veritable treasure trove: it documents connected devices, started programs, logins and much more. It is one of the most important Windows artefacts of all.
History & facts. The registry is hierarchically structured and divided into several files (hives); alongside configurations it also records numerous activity traces — recently connected USB devices, recently opened documents, automatically starting programs (often a place for malware persistence), network profiles and remnants of deleted entries. Many keys carry timestamps that can be placed into a timeline.
Outlook & recommendation. Because of its abundance, the registry is at once productive and confusing; specific knowledge of where which traces reside is decisive. For the investigation of persistence (how malware embeds itself permanently) and user activity it is indispensable. As with all artefacts: work on a forensic image, match findings against other sources and place them into an overall timeline, rather than interpreting individual keys in isolation.