Skip to content

Understanding the Windows Registry

The Windows Registry stores configuration and state for the operating system, applications, devices, services, and user profiles.

What you will learn

By the end, you should be able to distinguish hives, keys, and values, explain user versus system context, and preserve transaction data.

What is the Registry?

Core concept

The Registry is a hierarchy backed by hive files. System hives describe computer-wide configuration; user hives describe profile-specific settings and activity. Transaction logs and recovered cells may add context not visible in a simple live view.

SYSTEMSOFTWARESAMNTUSER.DATUsrClass.dat

Keep in mind: A key's last-write time applies to the key, not individually to every value. It does not directly explain which value changed or who changed it.

01HiveA file containing a Registry hierarchy02KeyA container that can hold subkeys and values03ValueNamed data stored under a key

Registry contexts

System hivesComputer configuration, services, software, and accounts
User hivesProfile-specific settings and activity
Transaction logsData used to maintain hive consistency
Live RegistryA current operating-system view that may change during access

Why it matters

Understand configuration

Registry data records operating-system and application settings.

Investigate persistence

Services, startup locations, and application settings can support persistence findings.

Identify devices

System and user records may describe connected storage and device interaction.

Add user context

Profile hives connect selected settings and artefacts to a user SID.

How Registry analysis works

  1. AcquireCollect relevant hives, transaction logs, and profile context from a verified source.
  2. IdentifyMap hives to the computer, control set, users, SIDs, and relevant time zone.
  3. ParseUse a recorded parser and retain the original hive and recovery warnings.
  4. InterpretApply key-specific meaning, data types, path expansion, and last-write limitations.
  5. CorroborateCompare file-system, event, execution, and user-activity evidence.

Choose the next step

ScenarioA user hive contains a reference to a removable drive. What should you establish next?

Keep hive context attached

  1. 1MapAssociate hives with system and user context.
  2. 2RecoverInclude transaction logs where appropriate.
  3. 3InterpretApply artefact-specific meaning and limits.
  4. 4CorroborateCompare with independent evidence.

Registry tools in SUSA

Hive examination

Registry Explorer

Browse Registry hives and inspect forensic keys and values.

Change comparison

RegShot

Compare Registry snapshots in a controlled test environment.

USB context

USB Detective

Examine Registry and related evidence for USB-device activity.

Continue learning