The registry is a set of hive files. Each artefact below lives in one hive, so the first question in an investigation is always "which file do I need?". Open hives exported from a forensic image with Registry Forensics, which decodes most of these keys in the browser.
Hive files
| Hive | File on disk | Mounted as | Holds |
|---|---|---|---|
| SYSTEM | C:\Windows\System32\config\SYSTEM |
HKLM\SYSTEM |
Services, devices, USB, time zone, computer name |
| SOFTWARE | C:\Windows\System32\config\SOFTWARE |
HKLM\SOFTWARE |
Installed programs, machine-wide autoruns, network profiles |
| SAM | C:\Windows\System32\config\SAM |
HKLM\SAM |
Local accounts, logon counts, last logon |
| SECURITY | C:\Windows\System32\config\SECURITY |
HKLM\SECURITY |
Local security policy, cached secrets |
| NTUSER.DAT | C:\Users\<user>\NTUSER.DAT |
HKCU |
Per-user activity: MRU lists, UserAssist, per-user autoruns |
| UsrClass.dat | C:\Users\<user>\AppData\Local\Microsoft\Windows\UsrClass.dat |
HKCU\Software\Classes |
ShellBags (Windows 7 and later) |
| Amcache.hve | C:\Windows\AppCompat\Programs\Amcache.hve |
not mounted | Program execution and installation inventory |
Copy the .LOG1 and .LOG2 transaction logs next to each hive: recent changes may still be only in them.
In the paths below, CCS means the active control set: read SYSTEM\Select\Current (for example 1) and use SYSTEM\ControlSet001.
Autoruns and persistence
| Artefact | Hive | Key path |
|---|---|---|
| Run (every logon) | SOFTWARE | Microsoft\Windows\CurrentVersion\Run |
| RunOnce | SOFTWARE | Microsoft\Windows\CurrentVersion\RunOnce |
| 32-bit Run on 64-bit Windows | SOFTWARE | WOW6432Node\Microsoft\Windows\CurrentVersion\Run |
| Per-user Run | NTUSER.DAT | Software\Microsoft\Windows\CurrentVersion\Run |
| Per-user RunOnce | NTUSER.DAT | Software\Microsoft\Windows\CurrentVersion\RunOnce |
| Winlogon shell and userinit | SOFTWARE | Microsoft\Windows NT\CurrentVersion\Winlogon (Shell, Userinit) |
| Image File Execution Options | SOFTWARE | Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<exe> (Debugger) |
| Services and drivers | SYSTEM | CCS\Services\<name> (ImagePath, Start, Parameters\ServiceDll) |
A service Start value of 2 means automatic, 3 manual, 4 disabled. New services also log event 7045, see Windows Event IDs Cheat Sheet.
Program execution
| Artefact | Hive | Key path | What it gives |
|---|---|---|---|
| UserAssist | NTUSER.DAT | Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count |
GUI programs launched, run count, last run time |
| BAM | SYSTEM | CCS\Services\bam\State\UserSettings\<SID> |
Last execution time per program and user (Windows 10 1809 and later) |
| ShimCache (AppCompatCache) | SYSTEM | CCS\Control\Session Manager\AppCompatCache (value AppCompatCache) |
Programs seen by the compatibility layer, with file modification times |
| Amcache | Amcache.hve | Root\InventoryApplicationFile |
Path, SHA-1 of the file (FileId, prefixed with 0000) and first-seen data |
| RunMRU | NTUSER.DAT | Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU |
Commands typed in the Run dialog (Win+R) |
UserAssist value names are ROT13-encoded: {1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\pzq.rkr decodes to {1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\cmd.exe, where that GUID is the known-folder ID of C:\Windows\System32. Decode one by hand with the ROT13 / Caesar Cipher. The two GUIDs to know are {CEBFF5CD-ACE2-4F4F-9178-9926F41749EA} (executables) and {F4E57C4B-2036-45F0-A9AB-443BCFE33D9F} (shortcuts). ShimCache presence does not prove a program ran, only that Windows saw it.
Files and folders opened
| Artefact | Hive | Key path |
|---|---|---|
| RecentDocs | NTUSER.DAT | Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs (subkey per extension) |
| Open/Save dialog MRU | NTUSER.DAT | Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU |
| Last folder per program | NTUSER.DAT | Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU |
| Typed Explorer paths | NTUSER.DAT | Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths |
| Explorer search terms | NTUSER.DAT | Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery |
| ShellBags | UsrClass.dat | Local Settings\Software\Microsoft\Windows\Shell\BagMRU and \Bags |
| Typed URLs (Internet Explorer) | NTUSER.DAT | Software\Microsoft\Internet Explorer\TypedURLs |
MRU keys keep their order in an MRUListEx value: a list of 4-byte little-endian indexes, most recent first, ending with FF FF FF FF. ShellBags remember folders a user browsed, including folders on removable drives and network shares that no longer exist.
USB and external devices
| Artefact | Hive | Key path |
|---|---|---|
| USB storage devices | SYSTEM | CCS\Enum\USBSTOR\<vendor&product>\<serial> |
| All USB devices (VID/PID) | SYSTEM | CCS\Enum\USB |
| First install, last connect and removal | SYSTEM | ...\USBSTOR\...\<serial>\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065, 0066, 0067 |
| Drive letters and volume GUIDs | SYSTEM | MountedDevices |
| Volume names | SOFTWARE | Microsoft\Windows Portable Devices\Devices |
| Which user used the device | NTUSER.DAT | Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 |
The property IDs are 0064 install date, 0065 first install date, 0066 last arrival (connect) and 0067 last removal, each a FILETIME.
System and network
| Artefact | Hive | Key path / value |
|---|---|---|
| Computer name | SYSTEM | CCS\Control\ComputerName\ComputerName |
| Time zone | SYSTEM | CCS\Control\TimeZoneInformation (TimeZoneKeyName, Bias in minutes) |
| Last clean shutdown | SYSTEM | CCS\Control\Windows (ShutdownTime, FILETIME) |
| Interfaces and IP settings | SYSTEM | CCS\Services\Tcpip\Parameters\Interfaces\{GUID} |
| Windows version, install date | SOFTWARE | Microsoft\Windows NT\CurrentVersion (ProductName, InstallDate in Unix seconds) |
| Networks joined | SOFTWARE | Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{GUID} (ProfileName, DateCreated, DateLastConnected) |
| Gateway MAC per network | SOFTWARE | Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Unmanaged\<id> (DefaultGatewayMac) |
| Installed programs | SOFTWARE | Microsoft\Windows\CurrentVersion\Uninstall\<id> |
| Local accounts | SAM | SAM\Domains\Account\Users |
DateCreated and DateLastConnected are 16-byte SYSTEMTIME structures, not FILETIMEs. The gateway MAC identifies the router (and so the place) behind a Wi-Fi profile; look up its manufacturer with the MAC Address Vendor Lookup.
Timestamps you will meet
| Format | Where | Epoch and unit |
|---|---|---|
| Key last-write time | Every key | FILETIME: 100 ns intervals since 1601-01-01 UTC |
| FILETIME values | UserAssist, BAM, USB properties, ShutdownTime | Same as above, 8 bytes little-endian |
| Unix seconds | InstallDate |
Seconds since 1970-01-01 UTC |
| SYSTEMTIME | NetworkList profiles | Year, month, day of week, day, hour, minute, second, milliseconds (16 bytes) |
Registry times are UTC. Apply the TimeZoneInformation bias only when presenting them, and confirm activity against the event logs with Log Forensics.