Forensic Analysis of the Windows Registry

Windows registry contains lots of information that are of potential evidential value or helpful in aiding forensic examiners on other aspects of forensic analysis. This paper discusses the basics of Windows XP registry and its structure, data hiding techniques in registry, and analysis on potential Windows XP registry entries that are of forensic values.

https://www.forensicfocus.com/forensic-analysis-windows-registry

Urs

Comments

• Anonymous
  April 08, 2006
  Great article -- here's the direct link to the (easier to read) PDF
  
  http://www.forensicfocus.com/downloads/forensic-analysis-windows-registry.pdf