Digital Forensic Identification, Collection, Examination and Decoding of Windows Registry Keys for Discovering User Activities Patterns
 |
International Journal of Computer Trends and Technology (IJCTT) |  |
| © 2014 by IJCTT Journal | ||
| Volume-17 Number-2 |
||
| Year of Publication : 2014 | ||
| Authors : Abhijeet Ramani , Somesh Kumar Dewangan | ||
| DOI : 10.14445/22312803/IJCTT-V17P120 |
Abhijeet Ramani , Somesh Kumar Dewangan. "Digital Forensic Identification, Collection, Examination and Decoding of Windows Registry Keys for Discovering User Activities Patterns". International Journal of Computer Trends and Technology (IJCTT) V17(2):101-111, Nov 2014. ISSN:2231-2803. www.ijcttjournal.org. Published by Seventh Sense Research Group.
Abstract -
The Key study in this paper is to begin the investigation process with the initial forensic analysis in the segments of the storage media which would definitely contain the digital forensic evidences. These Storage media Locations is referred as the Windows registry. Identifying the forensic evidence from windows registry may take less time than required in the case of all locations of a storage media. Our main focus in this research will be to study the registry structure of Windows 7 and identify the useful information within the registry keys of windows 7 that may be extremely useful to carry out any task of digital forensic analysis. The main aim is to describe the importance of the study on computer & digital forensics. The Idea behind the research is to implement a forensic tool which will be very useful in extracting the digital evidences and present them in usable form to a forensic investigator. The work includes identifying various events registry keys value such as machine last shut down time along with machine name, List of all the wireless networks that the computer has connected to; List of the most recently used files or applications, List of all the USB devices that have been attached to the computer and many more. This work aims to point out the importance of windows forensic analysis to extract and identify the hidden information which shall act as an evidence tool to track and gather the user activities pattern. All Research was conducted in a Windows 7 Environment.
References
[1] Ramani, A & Dewangan, S (2014). Auditing Windows 7 Registry Keys to track the traces left out in copying files from system to external USB Device. Retrieved August,2014, from http://www.ijcsit.com/docs/ Volume%205/ vol5issue02/ijcsit2014050220.pdf
[2] Carvey, H.(2011). Windows Registry Forensics: Advanced Digital Forensic Analysis of the Windows Registry. Burlington: Syngress.
[3] Farmer, D.J.(n.d.). A windows registry Quick Reference: For the Everyday Examiner. Retrieved December, 2013, from http://www.forensicfocus.com/downloads/windows-registry-quick-reference.pdf
[4] Windows registry information for advanced users. Retrieved December 2013, from Microsoft Support. http://support.microsoft.com/kb/256986
[5] Barbara, J.J.(2011).Windows 7 Registry Forensics. Retrieved January, 2014, from http://www.forensicmag.com/articles/2012/ 06/windows-7-registry-forensics-part-5#.Uv-TkPtfaSo
[6] Wong, L.W.(n. d.).Forensic Analysis of Windows Registry. Retrieved January, 2014, from http://www.forensictv.net/Downloads /digital_forensics/forensic_analysis_of_windows_registry_by_lih_ wern_wong.pdf
[7] Jain, A & Roy, T.(2012).Windows Registry Forensics: An Imperative Step in Tracking Data Theft via USB Devices. Retrieved January, 2014, from http://www.ijcsit.com/docs/Volume%203/vol3Issue3/ ijcsit20120303126.pdf
[8] Alghafli, K.A & Jones, A & Martin T.A. (2010) .Forensic Analysis of the Windows 7 Registry. Retrieved Retrieved January, 2014, from Edith Cawan University Research online. http://ro.ecu.edu.au/cgi/ viewcontent.cgi?article=1071&context=adf
[9] Fisher, T. (n.d.). Windows Registry. Retrieved January, 2014, from http://pcsupport.about.com/od/termsr/p/registrywindows.htm
[10] Fisher, T. (n.d.). Registry Hives. Retrieved January, 2014, from http://pcsupport.about.com/od/termsr/g/registryhive.htm
[11] Fisher, T. (n.d.). HKEY_CLASSES_ROOT Retrieved January, 2014, from http://pcsupport.about.com/od/termshm/g/hkey_ classes_ root.htm
[12] Fisher, T. (n.d.). HKEY_CURRENT_USER. Retrieved January, 2014, fromhttp://pcsupport.about.com/od/termshm/g/hkey_current_user.htm
[13] Fisher, T. (n.d.). HKEY_LOCAL_MACHINE. Retrieved January, 2014, from http://pcsupport.about.com/od/termshm/g/hkey_ local_ machine.htm
[14] Fisher, T. (n.d.). HKEY_USERS. Retrieved January, 2014, from http://pcsupport.about.com/od/termshm/g/hkey_users.htm
[15] Fisher, T. (n.d.). HKEY_CURRENT_CONFIG. Retrieved January, 2014 from http://pcsupport.about.com/od/termshm/g/hkey_ current_config.htm
[16] Liming Cai & Jing Sha & Wei Qian (2013). Study on Forensic Analysis of Physical Memory. Retrieved March 2014 from www.atlantis-press.com/php/download_ paper.php?id=10172
[17] Haoyang Xie & Keyu Jiang Xiaohong Yuan & Hongbiao Zeng (2012). Forensic Analysis of Windows Registry Against Intrusion. Retrieved July 2014 from http://caeiae.ncat.edu/Forensic%20Analysis%20of%20 Windows %20Registry%20Against%20Intrusion.pdf
[18] Lih Wern Wong (n.d.).Forensic Analysis of the Windows Registry.Retrieved July 2014 From https://www.scribd.com/doc/2251 55972/Forensic-Analysis-of-Windows-Registry-by-Lih-Wern-Wong
[19] Yuri Gubanov (2012).Retrieving Digital Evidence: Methods, Techniques and Issues.Retrieved on July 2014 From http://forensic.belkasoft.com /en/retrieving-digital-evidence-methods-techniques-and-issues
[20] Jerry Honeycutt (2005).Microsoft Windows Registry Guide 2nd Edition. Retrieved on october 2014 from https://www.it-ebooks.info.
[21] "msdn.microsoft" [Online] Available: http://msdn.microsoft.com/en-us/library/windows/desktop /ms7248 71%28v=vs.85%29.aspx
[22] "msdn.microsoft" [Online] Available:http://msdn.microsoft.com/en-us/library/windows/desktop/ ms7248 77%28v=vs.85%29.aspx
[23] "support.microsoft" [Online] Available:http://support.microsoft.com/kb/256986/en-us/
[24] "sqlcoffee" [Online] Available:Available:http://www.sqlcoffee.com/troubleshooting051.htm "gaurangpatel" [Online]
[25] Available:http://gaurangpatel.net/sql-server-installation-rules-and-system- reboot-required-error [26] "microsoft" [Online]
Available:http://www.microsoft.com/en-in/download/details.aspx? id=23691
[27] "msdn.microsoft" [Online] Available:http://msdn.microsoft.com/en-us/library/w0x726c2 (v=vs.100).aspx
[28] "msdn.microsoft" [Online] Available:http://msdn.microsoft.com/en-us/library/ff361664 (v=vs.110).aspx
[29] "msdn.microsoft" [Online] Available:http://msdn.microsoft.com/en-us/library/gg14501 1(v=vs.100).aspx
[30] "msdn.microsoft" [Online] Available:http://msdn.microsoft.com/en-us/library/Microsoft.Win32 (v=vs.100).aspx
[31] "msdn.microsoft" [Online] Available:http://msdn.microsoft.com/en-us/library/aa289494 (v=vs.71).aspx
[32] "msdn.microsoft" [Online] Available:http://msdn.microsoft.com/en-us/library/microsoft.win32. registry(v=vs.71).aspx
[33] "msdn.microsoft" [Online] Available:http://msdn.microsoft.com/en-us/library/microsoft.win32. registrykey(v=vs.100).aspx
[34] "msdn.microsoft" [Online] Available:http://msdn.microsoft.com/en-us/library/z9f66s0a (v=vs.100).aspx
[35] "msdn.microsoft" [Online] Available:http://msdn.microsoft.com/en-us/library/8zha3xws (v=vs.110).aspx
[36] "msdn.microsoft" [Online] Available:http://msdn.microsoft.com/en-us/library/gg265786 (v=vs.100).aspx
Keywords
Windows Registry, Windows 7 Forensic Analysis, Windows Registry Structure, Analysing Registry Key, Digital Forensic Identification, Forensic data Collection, Examination of Windows Registry, Decoding of Windows Registry Keys, Discovering User Activities Patterns, Computer Forensic Investigation Tool.