Windows Registry Forensics from Coursera

What's inside

Syllabus

Introduction to the Windows Registry

Discover what the Windows Registry is and why it is important in digital forensic investigations. This module will explore the location and structure of the registry hives in a live and non-live environment, as well as the types of forensic evidence found in the Windows Registry. This will include: user account information, system-wide and user-specific settings, file access, program installation and execution, search terms, auto-start locations and devices attached to the system. Please use the links and tools provided in the two reading sections to get the URLs and other downloads you will need for the course.

Preparing to Examine the Windows Registry

Learn how to set up a forensic workstation to properly examine the Windows Registry. This module takes a look at the location of the Registry files within the Windows OS and the many tools freely available to view the file structure and artifacts contained within the Windows Registry. It includes instruction on the installation, proper use and validation of your forensic software, showing how to get the most out of your automated tools while maintaining an understanding of what the tool is doing behind the scenes.

NTUser.Dat Hive File Analysis

This module demonstrates an in-depth analysis of the artifacts contained within the NTUser.Dat hive file. This module will show examiners how to locate programs and applications, mounted volumes and connected devices specific to a user, user search terms and typed URLs. Examiners will also be able to locate and identify opened and saved files, typed URLs, user-specific programs set to run at startup and application installation and execution. Examiners will be able to locate, examine and interpret MRU lists (Most Recently Used), UserAssist, user system settings and recently used files.

SAM Hive File

This module explains forensic artifacts found in the SAM (Security Account Manager) file, which stores and organizes information about each user on a system. This module demonstrates how to identify each user account on a local machine using the relative identifier. Examiners can also learn to interpret username information including the users’ login dates, times and login count. The module will show how to identify the machine that the user account was created on, by interpreting a users’ SIDs (machine/domain identifiers) and recovering user password hashes.

Software Hive File

This module will show examiners how to locate information of forensic value relating to application execution and installation contained within the software hive file. The module will provide an overview of the forensic artifacts found in the software hive file, such as installed programs and applications, operating system type, install date and time, wireless network information, file association, domain logon information, the last logged-on user, programs set to run at startup and tracking USB devices that were attached to the system.

System Hive File

This module will demonstrate evidence of forensic value contained within the system hive file. This module explores the system hive file showing how to determine the current control set, computer name, last shutdown date and time, crash dump settings and location, services set to run at startup, page file settings, prefetch settings, last access file time settings, AppCompat Cache, BAM (background activities monitor) and USB device connections and disconnections with dates and times.

USRClass.dat Hive File

This module identifies and explains forensic artifacts found in the UsrClass.dat hive file. This module will look at the UsrClass.dat hive. The examiner will learn to explain Windows ShellBags, which track user-specific zip files and folder access and settings, including dates and times even on deleted folders and removable media. The examiner will also learn to interpret the sub-key MuiCache, to include installed applications. The Microsoft Photo App, showing recently accessed image files, will also be explored.

AmCache Hive File

This module will examine the AmCache hive file, which stores information relating to the execution of applications. A forensic examination of the AmCache hive file showing the following: application installation, application first run date and time, a file path to the executable file, the source of the application, a SHA-1 hash value of the executable file, plug-and-play connected devices, GUIDs of mounted volumes and system hardware information.

Good to know

Know what's good

, what to watch for

, and possible dealbreakers

Examines ethical issues of forensic science, which is highly relevant to digital investigators in today's legal climates

Taught by Denise Duffy, who is recognized for their work in the field of digital forensics

Provides a detailed understanding of Windows Registry forensics, which is a core skill for digital forensic analysts

Develops an understanding of the structure and organization of the Windows Registry, which is crucial for forensic investigations

Emphasizes the importance of setting up a proper forensic workstation, which is essential for conducting thorough digital investigations

Covers various types of forensic evidence found in the Windows Registry, which is critical for digital forensic analysts to master

Reviews summary

Detailed registry forensics

According to students, Windows Registry Forensics is a high-quality course that thoroughly covers important registry topics. The lectures are engaging and the instructor is knowledgeable and helpful. Students also appreciate the hands-on, practical aspects of the course and feel confident in their ability to apply what they have learned.

Well-structured and informative lessons.

"awesome course"

"really detailed course"

"learns indepth of windows registry"

Facilitator provides quality instruction.

"great learning"

"thank you to my learning instructor"

"knowledgeable and helpful"

Applicable skills in real-world scenarios.

"a real practising"

"infosec"

"forensic investigations"

Career center

Learners who complete Windows Registry Forensics will develop knowledge and skills that may be useful to these careers:

Forensic Investigator

Forensic Investigators are responsible for retrieving data, examining hardware, and interpreting digital evidence. The skills and knowledge taught in this course can help you build a foundation for success as a Forensic Investigator. The Windows Registry is a treasure trove of information and this course will teach you its key portions. This will allow you to find critical information about user account information, system-wide and user-specific settings, file access, program installation and execution, and even search terms.

See salaries and explore the career path for Forensic Investigator

Digital Evidence Analyst

A Digital Evidence Analyst reviews and interprets digital evidence to reconstruct past events. Through the analysis of the Windows Registry, you will learn to recover deleted data and extract information about user activity which will be vital to your success in this role.

See salaries and explore the career path for Digital Evidence Analyst

Cybersecurity Analyst

A Cybersecurity Analyst protects organizations from cyber threats, malicious actors, and data breaches. This course will equip you with incredible skills in threat detection and deterrence. Through the examination of hives such as USRClass.dat, you will be able to identify Windows ShellBags, which track user-specific zip files and folder access and settings. You will also learn to interpret the sub-key MuiCache, to include installed applications.

See salaries and explore the career path for Cybersecurity Analyst

IT Auditor

IT Auditors review and examine systems to analyze compliance and provide security recommendations. A deep understanding of the Windows Registry is crucial for successful IT Auditors as it is a vital source of security-related information. This course will help you build a solid background in this area.

See salaries and explore the career path for IT Auditor

Computer Forensics Analyst

Computer Forensics Analysts collect, analyze, and interpret digital data stored on electronic devices in the context of legal proceedings. This course can provide you with the skills you need to succeed as a Computer Forensics Analyst, such as the ability to analyze the live registry and the location of the registry files on the forensic image.

See salaries and explore the career path for Computer Forensics Analyst

Information Security Analyst

Information Security Analysts plan and implement security measures to protect an organization's information systems. This course can help you develop the skills and knowledge necessary to succeed as an Information Security Analyst, such as the ability to analyze the Windows Registry for security vulnerabilities.

See salaries and explore the career path for Information Security Analyst

Security Engineer

Security Engineers design, implement, and maintain security systems to protect an organization's information systems. This course can help you develop the skills and knowledge necessary to succeed as a Security Engineer, such as the ability to analyze the Windows Registry for security vulnerabilities.

See salaries and explore the career path for Security Engineer

Software Engineer

Software Engineers design, develop, and maintain software applications. This course can help you develop the skills and knowledge necessary to succeed as a Software Engineer, such as the ability to analyze the Windows Registry for potential software compatibility issues.

See salaries and explore the career path for Software Engineer

Systems Engineer

Systems Engineers design, implement, and maintain computer systems and networks. This course can help you develop the skills and knowledge necessary to succeed as a Systems Engineer, such as the ability to analyze the Windows Registry for performance issues.

See salaries and explore the career path for Systems Engineer

Cybersecurity Engineer

Cybersecurity Engineers design, implement, and maintain security systems to protect an organization's information systems from cyber threats. This course can help you develop the skills and knowledge necessary to succeed as a Cybersecurity Engineer, such as the ability to analyze the Windows Registry for security vulnerabilities.

See salaries and explore the career path for Cybersecurity Engineer

Network Administrator

As a Network Administrator, the maintenance of the infrastructure supporting a company's digital functions is your responsibility. It will be your role to ensure the security and smooth operation of this infrastructure. The exploration of Windows Registry topics in this course, such as the examination of the live registry, is a valuable tool for ensuring and maintaining the efficacy of a company's infrastructure.

See salaries and explore the career path for Network Administrator

Incident Response Analyst

Incident Response Analysts respond to and investigate security incidents. They also develop and implement security measures to prevent future incidents. This course can help you develop the skills and knowledge necessary to succeed as an Incident Response Analyst, such as the ability to examine the Windows Registry for evidence of security breaches.

See salaries and explore the career path for Incident Response Analyst

Vulnerability Analyst

Vulnerability Analysts identify, assess, and remediate security vulnerabilities in computer systems and networks. This course can help you develop the skills and knowledge necessary to succeed as a Vulnerability Analyst, such as the ability to analyze the Windows Registry for potential vulnerabilities.

See salaries and explore the career path for Vulnerability Analyst

Data Analyst

Data Analysts collect, analyze, and interpret data to help organizations make informed decisions. This course can help you develop the skills and knowledge necessary to succeed as a Data Analyst, such as the ability to analyze the Windows Registry for patterns and trends.

See salaries and explore the career path for Data Analyst

Database Administrator

Database Administrators design, implement, and maintain databases. This course can help you develop the skills and knowledge necessary to succeed as a Database Administrator, such as the ability to analyze the Windows Registry for performance issues.

See salaries and explore the career path for Database Administrator

Windows Registry Forensics

What's inside

Syllabus

Good to know

Save this course

Reviews summary

Detailed registry forensics

Activities

Career center

Reading list

Share

Similar courses