Digital forensics-Module 6
Introduction to Windows Forensics
Volatile Data in Windows
Non-Volatile Data in Windows
Other Non-Volatile Data
Analyzing Volatile Data with Volatility
Page File
Windows Registry
Windows Registry
Registry Structure within a Hive File
What is the Windows Registry?
The Windows Registry is a central database that stores configuration settings and
options for the operating system (OS), applications, and hardware.
It’s like the “brain” of Windows, keeping track of how the system should run.
Stored in files like:
SYSTEM , SOFTWARE , SAM , SECURITY , DEFAULT (in C:\Windows\System32\Config )
Each user also has a personal registry file ( [Link] ).
Registry Structure
The Registry is organized into keys (like folders) and values (like files). Internally, the
Registry is stored in a database format, where the smallest storage unit is called a cell.
Types of Registry Cells (with examples):
1. Key Cell
Stores information about a registry key (like a folder in the registry).
Contains metadata such as the key’s name, last modified time, and subkey list.
Example: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft → “Microsoft” is a key cell.
2. Value Cell
Stores the name, type, and data of a registry value.
Each registry key can have multiple values.
Example: Under HKEY_CURRENT_USER\Control Panel\Desktop → the value
Wallpaper stores the current desktop background.
3. Security Cell
Contains the security descriptor for a registry key.
Defines permissions (who can read/write/delete the key).
Example: Admins may have full access to HKEY_LOCAL_MACHINE\SYSTEM , while
normal users have read-only access.
4. List Cell
Used to manage lists of subkeys under a key.
Acts like a “pointer” to other key cells.
Example: If a key has 50 subkeys, a list cell keeps track of all those references.
5. Data Cell
Stores the actual data for a value cell.
Can hold strings, numbers, binary data, or configuration details.
Example: For the value Wallpaper , the data cell might contain
"C:\Users\User\Pictures\[Link]" .
Simple Analogy
Think of the Registry like a library:
Key Cells = Shelves (organize books by category).
Value Cells = Book titles (the name of the setting).
Data Cells = Book contents (actual setting details).
Security Cells = Lock on the shelf (who can read/write).
List Cells = Index card (points to where other shelves/books are).
👉 In short:
The Windows Registry is a database of OS and application settings.
It stores information in cells: key, value, security, list, and data — each serving a different
role in organizing and protecting settings.
Windows Registry: Forensic Analysis
Collecting System Information
USB Removable Storage Devices
Volume Shadow Copy
Windows Shell Beg
Shellbag
LNK Files