Mining Data from the Windows Registry
Explore techniques for mining valuable data from the Windows Registry in this 50-minute conference talk from Louisville Infosec 2014. Delve into registry terminology, primary hives, and the progression of the registry structure. Learn methods for extracting information from both offline hives and live systems. Discover how to uncover executed programs through UserAssist, MuiCache, and AppCompatCache analysis. Investigate file access history using RecentDocs, ComDlg32, and Office 2013 artifacts. Examine the significance of Shellbags in forensic investigations. Address anti-forensics tools like Privazer and CCleaner, and explore countermeasures such as timestomping detection. Gain practical insights into Windows Registry forensics for enhancing your information security skillset.