El propósito de este artículo es brindarle una comprensión de los Registros de Windows y la gran cantidad de información que contiene. Hoy en día es importanta, para la mayoría de los administradores y analistas forenses. .
LINKS
https://gbhackers-com.cdn.ampproject.or ... ystem/amp/
VIDEO TUTORIAL
Info Extra
HKEY_CLASSES_ROOT hive contains configuration information relating to which application is used to open various files on the system.
HKEY_CURRENT_USER hive is the active, loaded user profile for the currently logged-on-user.
HKEY_LOCAL_MACHINE contains a vast configuration information for the system, including hardware settings and software settings.
HKEY_USERS contiene todo el perfil de usuarios cargado activamente para ese sistema.
HKEY_CURRENT_CONFIG contains the hardware profile the system uses at startup.
Ejemplos:
MRU, throughout or”most recently used” list contains entries made due to specific actions
performed by the user. There are numerous MRU LIS throughout various Registry keys.
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\Explorer\RunMRU
This key stores the contents of the product and device ID values of any USB devices that have ever been connected to the system.
HKEY_LOCAL_MACHINE\SYSTEM\controlset001\Enum\USBSTOR
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs
Attached Hardware:
Navigating to the following key HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices.This information can be useful
to a forensic examiner as it shows any connected storage device has been recognized by the operating system.
If the examiner notes a discrepancy between the physically attached devices and the ones reported here,
it can be an indication that some device was removed prior to the evidence being seized.
HKEY_LOCAL_MACHINE\SYSTEM|MountedDevices
HKEY_CURRENT_USER\Software\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps
Temas relacionados: claves del Registro de Windows, análisis forense, administración de sistemas.
