Quick answer: The Windows Registry is a hierarchical database holding the configuration of the operating system and users, and it is one of the richest sources of evidence in digital forensics. Which USB stick was plugged in, which program was run, which files the user opened, when the system was installed, which device connected to the network, all leave traces here. The most common free analysis tools are RegRipper, Registry Explorer and RECmd. The registry does not live in one place on disk but is scattered across hives: system wide SYSTEM, SOFTWARE, SAM, SECURITY; and per user NTUSER.DAT and UsrClass.dat. The secret to learning is not memorizing commands but knowing which question is answered in which key.

The fastest way to get to know a system in forensics is the registry. The disk gives you files, but the registry tells you what the user did with those files, which devices they connected and which programs they ran. This article explains reading the Windows Registry as a forensic evidence source and parsing it with RegRipper through a training lens.

What the registry is and where it lives

The registry is not a single file. It lives on disk in separate files called hives, which Windows merges at runtime into a logical tree. For forensic examination you need the physical on disk location of the hives:

Hive On disk location What it holds
SYSTEM Windows\System32\config Hardware, services, USB, network, time zone
SOFTWARE Windows\System32\config Installed programs, OS info, autostart
SAM Windows\System32\config Local user accounts
SECURITY Windows\System32\config Security policy
NTUSER.DAT User profile folder That user's activity, opened files, run programs
UsrClass.dat User AppData Jump lists, shell bags, UI traces

The critical point: on live running Windows these hives are locked and cannot be copied directly. A forensic copy is taken through raw disk access or from an image. Triage tools do this automatically, see our article on fast triage with KAPE.

Which questions the registry answers

Learn the registry not as a list of keys to memorize but as a set of questions to ask.

Which USB stick was plugged in? The USBSTOR and USB keys in the SYSTEM hive hold the vendor, serial number and first connection time of every device attached. It is the most frequently asked question in a data leak investigation.

Which program was run? UserAssist (NTUSER.DAT) holds the programs the user ran and how many times. ShimCache (AppCompatCache, SYSTEM) and Amcache give separate evidence of executed binaries.

Which files did the user open? RecentDocs and OpenSavePidlMRU (NTUSER.DAT) list recently opened and saved files. Shell bags show which folders the user browsed, even if that folder was later deleted.

When was the system installed, and what is the time zone? The SOFTWARE hive holds the install date, the SYSTEM hive the time zone. Because time zone affects all timeline analysis, it is one of the first places to look.

Which networks did it connect to? The NetworkList in the SOFTWARE hive holds the names of networks the device joined and first/last connection times. It is a strong clue to where the device has been.

Where was persistence established? Run and RunOnce keys, services and scheduled tasks are where malware sits to survive a reboot. It is one of the first places to check in incident response.

RegRipper, Registry Explorer and RECmd

Three free tools, three working styles:

RegRipper. A plugin based parser. You give it a hive, the relevant plugins automatically extract all known forensic keys and produce a readable text report. Ideal for a fast first look, answering "what is in this hive" within minutes.

Registry Explorer. Eric Zimmerman's graphical tool. You browse the hive as a tree, it recovers deleted keys and goes straight to important keys via built in bookmarks. Best for manual deep examination.

RECmd. The command line version of Registry Explorer. Suited to bulk, automated examination and scriptable workflows.

The common arrangement: RegRipper for a fast overview, Registry Explorer for pinpoint deep examination.

Deleted keys and recovery

When a key is deleted in the registry it often does not vanish immediately. The hive file works like a database, and the deleted key remains as a remnant until the space is reused. Registry Explorer can recover these remnants. Even if an attacker cleans a Run key to cover their tracks, the deleted record may still be found. This is one of the strongest aspects of registry analysis.

Hives also have transaction logs (.LOG files). These hold recent changes not yet written to the hive and should be examined together with the hive in a complete analysis.

Learning path

Stage 1. Learn the hive structure and physical locations. Using a tool without knowing which question is answered in which hive is a blind search.

Stage 2. Extract hives from your own test machine (through imaging or triage) and parse them with RegRipper. Plug in your own USB and see it in USBSTOR, run a program and find it in UserAssist. Recognizing your own activity is the best teacher.

Stage 3. Browse the same hive manually in Registry Explorer and find yourself what RegRipper found automatically. Try recovering a deleted key.

Stage 4. Tie registry findings to a timeline. A key's last written time is valuable for reconstructing the event order. See our article on super timeline with Plaso.

Common mistakes

  • Trying to copy a locked hive on a live system. Raw disk access or an image is required.
  • Skipping transaction logs. Recent changes may be in .LOG files.
  • Ignoring a key's last written time. This timestamp is valuable for the timeline.
  • Not trying deleted key recovery. The trace an attacker cleaned may still be found.
  • Trusting a single tool. RegRipper finds automatically but not everything, confirm a critical finding manually.
  • Interpreting time without checking the time zone. The time zone is in the SYSTEM hive, look there first.

Frequently asked questions

Can deleted data be recovered from the registry? Sometimes. A deleted key may remain as a remnant in the hive until the space is reused, and Registry Explorer can recover it.

Can I prove a USB stick was plugged in? Yes, the USBSTOR record in the SYSTEM hive is strong evidence with vendor, serial number and time. It should be confirmed with other artifacts.

Is RegRipper free? Yes, it is open source. Registry Explorer and RECmd are free too.

Can the registry be collected from a live system? Hives are locked and cannot be copied directly. Use raw disk access triage tools or an image.

Is registry analysis sufficient on its own? No. Combined with the file system, event logs, memory and network evidence it gives the full picture.

Which hive should I look at first? It depends on your question. SYSTEM for USB, NTUSER.DAT for run programs, SOFTWARE for installed software.

Sources

The registry is one of the richest sources telling what a user and a system actually did. For examination support or Windows forensics training for your team, contact DSET. From our Ankara Hacettepe Teknokent laboratory we run examinations, training and expert reporting.