thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Windows Registry Forensics

Examining Windows registry hives for evidence of program execution, persistence, user activity and connected devices.

Definition

Key hives include SYSTEM, SOFTWARE, SAM, SECURITY, NTUSER.DAT and UsrClass.dat. Artifacts include Run keys, services, UserAssist, ShellBags, RecentDocs, USBSTOR device history and Amcache. Tools include Registry Explorer, RegRipper and Volatility for in-memory hives.

Example

Checking SYSTEM\CurrentControlSet\Enum\USBSTOR to identify a USB drive connected during data theft.

Exam tip

USBSTOR for USB history; Run keys for persistence; UserAssist and ShimCache/Amcache for execution.

Related terms