I recently completed the free SANS mini-course on cyber forensics (see my post, Free Mini-courses from SANS). That course could not have shown up at a more opportune time as I had just been asked to see if I could determine whether a client’s former employee had stolen their customer list. I learned a bit about looking in some nooks and crannies–specifically, the Windows registry–that I hadn’t considered before and was able to determine with reasonable certainty that the employee had not saved any sensitive information to any external storage media.
I’m no expert in this subject, but I’m confident that I now have a good idea of how to conduct a quick and dirty preliminary forensic examination based upon information found in the Windows registry. When you consider that virtually everything you or a program does in Windows refers to or is recorded into the registry, it stands to reason that it will reveal most anything from minor mischief to major mayhem to the examiner who knows where to look. In this first part, we’ll take a look at how to examine the registry and explore a few of the more common registry entries that have potential forensic value.
Let me first introduce you to the concept of date/time coincidence. All the evidence in the world means little unless it can be shown that it coincides with the time window of the specific incident in question. Therefore, it’s very important that you examine the “LastWrite” time of each key you examine. While this property doesn’t tell you what value was written, knowing the LastWrite time of a key can allow you to infer the date/time coincidence of an event. You can determine the LastWrite time by right-clicking any key, selecting “Export” and then saving it in .txt format. When you open the .txt file, you’ll see something similar to this:
Key Name: HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices
Class Name: <NO CLASS>
Last Write Time: 5/27/2009 – 12:29 PM
Here are five keys that can give you a quick overview of the activity on a given system and will tell you if it’s worth your effort to dig deeper. The fact that you’re investigating in the first place means that you have some idea of what you’re looking for and if you’re dealing with a non-technical user, it’s a good bet you’ll find something among these.
MRU is the abbreviation for “most recently used.” This key contains a list of files that were recently opened or saved via the Windows Explorer common dialog boxes. Note that this does not apply to Microsoft Office documents. The subkey * contains the file paths to the 10 most recently opened/saved files.
Similar to the OpenSaveMRU key, but it also contains the name of the program executable file that was used to open/save the document as well as the path to the file. All of the information is in binary format.
This key has a similar arrangement to OpenSaveMRU. Only the filename in binary format is stored here and it contains both network and local files recently opened.
Here you’ll find a list of entries with full file paths and commands that have been executed using the Start>Run command. This is useful to determine whether your suspect has been messing around in the registry, using the cmd shell or any management consoles.
A listing of the 25 recent URLs or file paths typed into the IE or Windows Explorer address bar. Useful to determine what websites your suspect has been surfing, but this key is cleared if IE’s Clear History option is invoked. Still, some people may not know about it and some may forget. It’s a good way to disprove the I-have-no-idea-where-that-came-from excuse.
Next time, we’ll look into how data can be encrypted and hidden in the registry.