Hey everyone welcome to Windows registry analysis with Reg Ripper in the previous video we covered the
sleuth kit and showed how to analyze the NTFS file system of a Windows image in this video.
We're going to illustrate how to analyze another important source of information for Windows forensic
analysis Windows registry.
To begin we're going introduce the Windows registry.
Its structure location and features and explain why it's relevant for the forensic analyst.
Then we'll introduce uncover Reg Ripper an open source tool specifically developed to analyze the registry.
The Windows registry is a hierarchical database that stores most of its configuration and settings not
only from the Windows system but also applications users and devices that reason it's a valuable source
of information that needs to be considered in a forensic analysis of a Windows image.
The information and artifacts that could be extracted from the registry ranged from the OS settings
to the installed and executed programs from the user's activities to the connected devices and many
others examining certain artifacts from the registry.
For example the auto run keys could also lead to the detection of malware on the investigated system.
The registry is composed of binary data files also called HIV's.
The main registry hives that are common through the different versions of Windows are the same security
software and system HIV's.
They're located in the system 32 config folder under the windows system directory.
There are also registry hives that are specific to each user of the system.
These are the anti user dot dot and the User class dot dot HIV's.
The former is located in the main user's profile directory but the path of the folders in which are
located slightly differ between versions of Windows up to XP and the newer ones the same haif contains
information about the local system users and groups including the password stored in hashed format.
The security hived stores the system security settings such as the accounts audit users rights and applications
control policies.
The software hive as the name says stores the windows configuration as well as of the installed programs
system HIV's contain the settings of the system and other devices that are currently or have previously
been attached to the computer.
The information in the registry is structured on two basic elements keys and values.
Keys are containers similar to folders that could include values or other keys.
Values are objects similar to files identify by a name type and the associated data value the highest
keys in the hierarchy are called Root keys and the most important is the key local machine or HK L.M.
or KLM key under which are mapped as subkey as the contents of the four main registry hives.
We've seen Sam security software and system users and I.T. admins generally interact with the registry
using Reg edit or similar ed. programs.
This approach isn't very effective when dealing with forensic analysis because the registry has quite
a complex structure and simply using an editor will certainly make us miss many artifacts to automatize
the analysis of the registry.
There's a very useful tool pre-installed on Kelly Linux Reg Ripper.
It's a program written in Perl by Harlan Carvey.
It comes in the form of both a g y and a Seelye tool.
It's originally been written for Windows but also runs on Linux through the wine program.
Reg Ripper has a modular structure as it's capable of running many plug ins on the high files each plug
in extracting different types of artifacts.
There are hundreds of plug ins available.
Also written in Perl that are continuously being updated and everyone could write and add their plug
ins.
We're going to use the graphical version before running the tool.
If our forensic system is 64 bit we'll have to install the 32 bit version of wine to do so let's execute
the following command.
Then we run the usual apt get install command.
In this case the output says 132 is already installed.
Reg Ripper works on registry hives so we must find a way to take them out of our split roll images.
It's here that comes to our rescue a tool from the Libs suite AFFO use this tool could combine all the
image files into a single one that we can then mount under our local file system.
First we create a Malle directory for example and then image then we list the files in the current directory.
We notice that we have renamed the files adding the digit 0 because that use only accepts image names
that end with three digits.
Now we can execute the use command given the input of the image files.
This case we named the first image file and the directory display the content of the image directory.
We could see that the image file has been created.
These files combines all the split image files.
Then we come down to the Mount image directory then create a mail directory.
Now we can execute the Malc command.
Note that we have used the ARO option to mount the image read only and specify the offset of the NTFS
partition which is in bytes starting sector 63.
Multiply by sector size 512 bytes.
Now we can access the file system under NMT suspect and move to the Windows system 32 config directory
where the registry hives are located.
We have to copy the Sam security software and system HIV's to our examination directory.
Then we move to the user profiles directory.
In our case a Windows XP system is Documents and Settings then we would have to copy the end to user
dot dot and the User class dot dot HIV's of all the user accounts.
Now that we have all the registry hives we can execute Reg ripper to run the program.
We click on the applications menu then forensics digital forensics Reg Ripper the interface.
The program is very simple.
First we have to select the high files Samm then select the output report file and the profile.
The profile defines a list of plugins that are going to be executed on the hive.
Each type of pipe has its relative profile and we can select it in the dropdown menu.
In this case we select system plug in file.
We click on the repeat button and the status of all the running plugins is displayed in the text window
below.
When the execution is finished the status bar at the bottom of the window shows done.
We repeat this procedure for each registry hives selecting the appropriate profile.
Now that all the hives have been analyzed we can open some of the report files with a text editor to
give a look to the extracted information.
We first open the same report file as we could see shows info about users and groups.
Here's the most useful information seemed to be when the accounts had been created and the last log
in time.
Then we open the system report file.
But here we will use the Liberty office to show it more clearly.
In particular interesting information are reported about the computer's name I.D. hard disks mounted
drives network interfaces list of services and drivers and at the bottom the USP drives connected.
It's usually a very useful information for forensic investigation because a list all connected USP devices
and the time when they've been connected the model and the serial number of the device.
We take a look at the end to user Deedat report file.
We're going to find the information relative to the user's activities.
The first are the more you list that provide the most recently used files also grouped by file type.
Other important registry keys are the typed paths and type q r l keys and the autostart keys.
The latter lists all the programs or services that are automatically started when the user logs in.
The main one of these keys is a software Microsoft Windows current version run key.
These keys are one of the main indicators of a malware infection because malware typically uses these
keys to achieve persistence on the system.
Another important key to consider is the user assist key that displays a list of the programs executed
along with the date time and the running count.
There are a lot of info and artifacts that can be retrieved from the registry.
In this video we only looked at those which are generally considered the most relevant.
As with any type of artifacts their importance greatly depends on what you're looking for.
Great job in this video we introduce the Windows registry its structure locations and features.
Then we looked at reg Ripper and have shown how to practically extract and analyze the most relevant
artifacts in the next video extracting and analyzing browser and e-mail and instant messaging artifacts.
We're going to cover the tools available on Kelly Linux to extract and analyze forensic artifacts of
the most common browser and email.
And I am clients.