Forensic Analysis of the Windows Registry


Windows registry contains lots of information that are of potential evidential value or helpful in aiding forensic examiners on other aspects of forensic analysis. This paper discusses the basics of Windows XP registry and its structure, data hiding techniques in registry, and analysis on potential Windows XP registry entries that are of forensic values.


http://www.forensicfocus.com/forensic-analysis-windows-registry


Urs


 


Comments (1)

  1. Blake Handler says:

    Great article — here’s the direct link to the (easier to read) PDF

    http://www.forensicfocus.com/downloads/forensic-analysis-windows-registry.pdf