computer forensics

USB devices

The Registry key HKEY_LOCAL_MACHINE\System\ControlSet\Enum\UBSTOR lists USB devices that have been connected to the machine. It is often the case that a criminal will move evidence or exfiltrate other information to an external device and take it with him or her. This Registry setting tells you about the external drives that have been connected to this system.

Wireless networks

The Registry stores passphrases for accessing wireless networks. When an individual connects to a wireless network, the service set identifier (SSID) is logged as a preferred network connection. This information can be found in the Registry in the HKEY_LOCAL_MACHINE \SOFTWARE\Microsoft\WZCSVC\Parameters\Interfaces key.

Tracking Word documents

It is possible to track Word documents in the Registry. Many versions of Word store a PID_GUID value in the Registry, for example, something like: { 1 2 3 A 8 B 2 2 - 6 2 2 B - 1 4 C 4 - 8 4 A D - 0 0 D 1 B 6 1 B 0 3 A 4 }. The string 0 0 D 1 B 6 1 B 0 3 A 4 is the MAC address of the machine on which this document was created.

Malware

Malware may be found in the Registry. If you search the Registry and find HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon, it has a value named Shell with default data Explorer.exe. This tells the system to launch Windows Explorer when the logon is completed. Some malware appends the malware executable file to the default values data, so that the malware will load every time the system launches. It is important to check this Registry setting if you suspect malware is an issue. The key HKLM\SYSTEM\CurrentControlSet\Services\ lists system services. Several types of malware install as a service, particularly backdoor software. Be sure to also check this key if you suspect malware is an issue.

Uninstalled software

The HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall key lets you see all the software that has been uninstalled from this machine.

Passwords

If the user tells Internet Explorer to remember passwords, then those passwords are stored in the Registry and you can retrieve them. The following key holds these values:

HKCU\Software\Microsoft\Internet Explorer\IntelliForms\SPW

ShellBag

This entry can be found at HKCU\Software\Microsoft\Shell\Bags. ShellBag entries indicate a given folder was accessed, not a specific file. This Windows Registry key is of particular interest in child pornography investigations

Prefetch

See next slide.

7/3/2017

37

Prefetch