1 / 27

Registry Structure

Registry Structure. What is it? What does it contain?. Objectives. Logical and physical structure of the Registry Format of Registry files Examination of the Registry Forensically important keys Analyzing Registry information. The Registry. Hierarchal database

gary
Download Presentation

Registry Structure

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Registry Structure What is it? What does it contain?

  2. Objectives • Logical and physical structure of the Registry • Format of Registry files • Examination of the Registry • Forensically important keys • Analyzing Registry information

  3. The Registry • Hierarchal database • Maintains configuration settings • Applications • Hardware • Devices • Users

  4. Registry Access • regedit.exe – A “GUI” interface to the Registry • Native to XP and Vista • NT and 2000 has regedit.exe but with limited capabilities

  5. Physical Structure • Binary files • Stored in RAM and hard drive • Limited data types

  6. Logical Structure • Highest Level • My Computer • Contains Five Root Hives • Each Hive consists of • Hives and Keys • Each key has a set of • <Name Type Value> triples • Subkey list • Last access time

  7. Key Structure

  8. Key Structure

  9. Registry Data Types Series of nested arrays designed to store a list of resources A list of resources used by a physical HW device A list of HW resources used by a device driver

  10. Hives - Physical • A Hive is a logical file from multiple files on disk and RAM • The Registry is the collection of these hives • Each hive contains a registry tree • Each hive has a key that serves as the root or starting point of the tree • The integration of all these hives into the root hives consists of the registry

  11. Five Root Hives

  12. Root Hives • HKEY_USERS • Contains all the actively loaded user profiles for the system • HKEY_CURRENT_USER • Is the active, loaded user profile currently logged on • HKEY_LOCAL_MACHINE • Contains configuration information for the system bot HW and SW

  13. Root Hives (cont’d) • HKEY_CURRENT_CONFIG • Contains the hardware profile the system uses at startup • HKEY_CLASSES_ROOT • Contains configuration information for which apps open which files

  14. Registry-to-File Correspondence

  15. Hive File Locations

  16. Restore Points

  17. HKEY_USERSUser Profiles

  18. HKEY_CURRENT_USERLogged on user profile

  19. Current User One of those listed in HKEY_USERS

  20. HKEY_LOCAL_MACHINEHW and SW Configs

  21. HKEY_CURRENT_CONFIGStartup Profile

  22. HKEY_CLASSES_ROOTApplication to File Mapping This hive is subclassed to HKCU\Software\Classes HKLM \Software\Classes

  23. Registry Cell Types • Key cell • Key info, offsets to subkeys and LastWrite time • Value cell • Holds a value/name and its data • Subkey list cell • Series of subkey offsets • Value list cell • Series of offsets to value cells

  24. Registry Structure Keys Subkeys Type Values Data

  25. Raw Registry File Key Cell Value Cell

More Related