Some Pitfalls of Interpreting Forensic Artifacts in Windows Registry

This post is on behalf of one of our students, Ms. Jacky Fox. Given below is the archive that contains her MSc dissertation and the Bash scripts she wrote to extract and correlate Windows registry artifacts. During her research she discovered that recent versions of Microsoft Windows introduced subtle changes to forensic interpretation of Windows registry keys, including UserAssist and the keys related to USB devices. Modern forensic literature and tools do not reflect these changes – hence this post.

WindowsRegistryForensics.zip

Posted

4 October, 2012

Computer Forensics

Pavel Gladyshev

Tags:

Comments

3 responses to “Some Pitfalls of Interpreting Forensic Artifacts in Windows Registry”

Habeeb

2 November, 2012

Thank you for sharing your observations and Learning.

Reply
Jason Farina

9 November, 2012

Thanks. a very interesting read and I look forward to playing with the bash scripts 🙂

Reply
Daniel Beaulieu

11 August, 2013

Daniel Beaulieu

I cannot thanks enough for that article.Really thank you!

Reply

Some Pitfalls of Interpreting Forensic Artifacts in Windows Registry

Comments

3 responses to “Some Pitfalls of Interpreting Forensic Artifacts in Windows Registry”

Leave a Reply to Daniel Beaulieu Cancel reply