Hacktricks-skills windows-registry-forensics

Analyze Windows Registry hives for forensic investigations. Use this skill whenever you need to extract system information, user activity, USB device history, network configurations, or timeline data from Windows Registry files (SYSTEM, NTUSER.DAT, USRCLASS.DAT, SOFTWARE). Trigger this skill for any Windows forensics task involving registry analysis, malware persistence detection, user activity reconstruction, or incident response investigations.

install

source · Clone the upstream repo

git clone https://github.com/abelrguezr/hacktricks-skills

manifest:

skills/generic-methodologies-and-resources/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys/SKILL.MD

source content

Windows Registry Forensics

A comprehensive guide for analyzing Windows Registry hives during forensic investigations. This skill helps you extract critical system information, user activity data, and evidence from Windows Registry files.

Quick Reference: Key Registry Paths

System Information

Information	Registry Path
Windows Version & Owner	`Software\Microsoft\Windows NT\CurrentVersion`
Computer Name	`System\ControlSet001\Control\ComputerName\ComputerName`
Time Zone	`System\ControlSet001\Control\TimeZoneInformation`
Shutdown Details	`System\ControlSet001\Control\Windows`
Volume Serial Numbers	`System\MountedDevices`

User Activity

Information	Registry Path
Recent Documents	`NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs`
Typed Paths	`NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths`
User Assist (App Usage)	`NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count`
MRU Lists	`NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32`
Shellbags	`NTUSER.DAT` & `USRCLASS.DAT\Software\Microsoft\Windows\Shell`

Persistence & Startup

Information	Registry Path
AutoStart Programs	`NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run`
RunOnce Keys	`NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\RunOnce`
System Run Keys	`Software\Microsoft\Windows\CurrentVersion\Run`

Network & USB

Information	Registry Path
Network Interfaces	`System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{GUID}`
Network List	`Software\Microsoft\Windows NT\CurrentVersion\NetworkList`
USB Device History	`System\ControlSet001\Enum\USBSTOR`
USB Devices	`System\ControlSet001\Enum\USB`
Last Mounted Device	`System\MountedDevices`

Investigation Workflow

Step 1: Identify Available Hives

First, determine which registry hives you have access to:

SYSTEM - System-wide configuration, boot info, services
NTUSER.DAT - User-specific settings, activity tracking (one per user)
USRCLASS.DAT - User class settings, shellbags
SOFTWARE - Installed software, system-wide settings
SAM - Security accounts (requires special handling)
SECURITY - Security policies (requires special handling)

Step 2: Extract System Information

Use the

parse-registry-hive.py

script to extract key system information:

python parse-registry-hive.py --hive SYSTEM --output system-info.json

This extracts:

Windows version and build number
Computer name and hostname
Time zone configuration
Service pack information
Installation date

Step 3: Analyze User Activity

For each user hive (NTUSER.DAT), extract activity artifacts:

python parse-registry-hive.py --hive NTUSER.DAT --user-activity --output user-activity.json

This extracts:

Recent documents accessed
Typed command paths
User Assist application usage statistics
MRU (Most Recently Used) lists
Shellbag folder access history

Step 4: Check for Persistence Mechanisms

Identify auto-start programs and potential malware persistence:

python parse-registry-hive.py --hive NTUSER.DAT --persistence --output persistence.json

This checks:

Run and RunOnce keys
Scheduled task references
Service configurations
Browser helper objects

Step 5: USB Device Analysis

Extract USB device connection history:

python parse-registry-hive.py --hive SYSTEM --usb-history --output usb-history.json

This extracts:

Device manufacturer and model
Connection timestamps
Serial numbers
Volume serial numbers
Associated user accounts

Step 6: Network Configuration Analysis

Extract network interface and connection data:

python parse-registry-hive.py --hive SYSTEM --network --output network-config.json

This extracts:

Network interface configurations
IP address assignments
Network connection timestamps
VPN connection history

Step 7: Generate Comprehensive Report

Create a consolidated forensic report:

python generate-forensic-report.py \
  --system-hive SYSTEM \
  --user-hives NTUSER.DAT \
  --output forensic-report.html

Common Forensic Questions & Answers

"When was this system installed?"

Check

Software\Microsoft\Windows NT\CurrentVersion\InstallDate

(Windows file time format)

"What USB devices were connected?"

Check

System\ControlSet001\Enum\USBSTOR

for device details and timestamps

"Which user accessed this folder?"

Check Shellbags in

NTUSER.DAT

and

USRCLASS.DAT

under

Software\Microsoft\Windows\Shell

for folder access history

"What programs run at startup?"

Check

Run

and

RunOnce

keys in both user and system hives

"What files did the user recently open?"

Check

RecentDocs

and

UserAssist

keys in NTUSER.DAT

"What is the system's timezone?"

Check

System\ControlSet001\Control\TimeZoneInformation

"When was the system last shut down?"

Check

System\ControlSet001\Control\Windows

for shutdown timestamps

Tools & Resources

Recommended Tools

Shellbag Explorer - https://ericzimmerman.github.io/#!index.md
Registry Explorer - Built-in Windows tool or third-party alternatives
Plaso/Log2Timeline - For timeline analysis
Eric Zimmerman's Tools - Various registry analysis utilities

File Time Conversion

Windows Registry timestamps are in Windows File Time format (100-nanosecond intervals since January 1, 1601 UTC). Use the provided scripts to convert these to human-readable dates.

Best Practices

Always work on copies - Never analyze registry hives directly from a live system
Document your process - Keep detailed notes of which hives you analyzed and what you found
Preserve timestamps - Note the original file timestamps before any analysis
Cross-reference data - Correlate registry findings with other artifacts (logs, file system, memory)
Consider timezone - Account for system timezone when interpreting timestamps
Check all ControlSets - Registry may have multiple ControlSets (001, 002, Current)

Limitations

Registry hives from different Windows versions may have different structures
Some keys may be encrypted or protected
User hives (NTUSER.DAT) are user-specific and may not exist for all users
Some forensic artifacts may be cleared by anti-forensic tools
Live system analysis may modify registry data

Next Steps

After initial analysis:

Correlate findings with file system artifacts
Build a timeline of events
Identify gaps in the evidence
Consider memory forensics for additional context
Document all findings for reporting