SlideShare ist ein Scribd-Unternehmen logo
1 von 47
COMPUTER FORENSICS & WINDOWS REGISTRY Aradhana Pandey Saumya Tripathi
STEP 1 ,[object Object]
[object Object]
FIVE BASIC KEYS OF REGISTRY USED IN FORENSICS
 
 
THE REGISTRY AS A LOG  ,[object Object]
[object Object],[object Object]
SIGNIFICANCE ,[object Object]
 
 
AUTORUN LOCATION ,[object Object]
[object Object]
[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
 
When you run a Microsoft Office XP program, the file Ctfmon.exe (Ctfmon) runs in the background, even after you quit all Office programs. Ctfmon.exe monitors the active windows and provides text input service support for speech recognition, handwriting recognition, keyboard, translation, and other alternative user input technologies.
 
MRU LISTS  ,[object Object]
 
 
[object Object]
[object Object]
Last accessed from RUN
USERASSIST  ,[object Object]
[object Object]
 
[object Object]
 
[object Object]
[object Object]
WIRELESS NETWORKS  ,[object Object]
 
 
 
LAN COMPUTERS  ,[object Object],[object Object]
 
USB DEVICES  ,[object Object],[object Object],[object Object],[object Object],[object Object]
List of all USB devices which are currently connected to the system
 
 
DEVICE ID
MOUNTED DEVICES  ,[object Object]
[object Object]
 
INTERNET EXPLORER ,[object Object]
Owner has visited various sites for different transactions
[object Object]

Weitere Àhnliche Inhalte

Was ist angesagt?

Alternate Data Streams
Alternate Data StreamsAlternate Data Streams
Alternate Data Streams
nephijohnson
 
Computer Forensics & Windows Registry
Computer Forensics & Windows RegistryComputer Forensics & Windows Registry
Computer Forensics & Windows Registry
somutripathi
 
Linux file system
Linux file systemLinux file system
Linux file system
Burhan Abbasi
 
Memory forensics
Memory forensicsMemory forensics
Memory forensics
Sunil Kumar
 
Lecture 9 and 10 comp forensics 09 10-18 file system
Lecture 9 and 10 comp forensics 09 10-18 file systemLecture 9 and 10 comp forensics 09 10-18 file system
Lecture 9 and 10 comp forensics 09 10-18 file system
Alchemist095
 

Was ist angesagt? (20)

MindMap - Forensics Windows Registry Cheat Sheet
MindMap - Forensics Windows Registry Cheat SheetMindMap - Forensics Windows Registry Cheat Sheet
MindMap - Forensics Windows Registry Cheat Sheet
 
Registry Forensics
Registry ForensicsRegistry Forensics
Registry Forensics
 
Web Application Forensics: Taxonomy and Trends
Web Application Forensics: Taxonomy and TrendsWeb Application Forensics: Taxonomy and Trends
Web Application Forensics: Taxonomy and Trends
 
CNIT 121: 8 Forensic Duplication
CNIT 121: 8 Forensic DuplicationCNIT 121: 8 Forensic Duplication
CNIT 121: 8 Forensic Duplication
 
Windows forensic artifacts
Windows forensic artifactsWindows forensic artifacts
Windows forensic artifacts
 
Alternate Data Streams
Alternate Data StreamsAlternate Data Streams
Alternate Data Streams
 
Registry forensics
Registry forensicsRegistry forensics
Registry forensics
 
Computer Forensics & Windows Registry
Computer Forensics & Windows RegistryComputer Forensics & Windows Registry
Computer Forensics & Windows Registry
 
Introduction to filesystems and computer forensics
Introduction to filesystems and computer forensicsIntroduction to filesystems and computer forensics
Introduction to filesystems and computer forensics
 
Autopsy Digital forensics tool
Autopsy Digital forensics toolAutopsy Digital forensics tool
Autopsy Digital forensics tool
 
Introduction to forensic imaging
Introduction to forensic imagingIntroduction to forensic imaging
Introduction to forensic imaging
 
Windows Forensic 101
Windows Forensic 101Windows Forensic 101
Windows Forensic 101
 
Malware forensics
Malware forensicsMalware forensics
Malware forensics
 
Shadow forensics print
Shadow forensics printShadow forensics print
Shadow forensics print
 
Linux file system
Linux file systemLinux file system
Linux file system
 
Memory forensics
Memory forensicsMemory forensics
Memory forensics
 
Computer Forensics ppt
Computer Forensics pptComputer Forensics ppt
Computer Forensics ppt
 
Lecture #31 : Windows Forensics
Lecture #31 : Windows ForensicsLecture #31 : Windows Forensics
Lecture #31 : Windows Forensics
 
Lecture 9 and 10 comp forensics 09 10-18 file system
Lecture 9 and 10 comp forensics 09 10-18 file systemLecture 9 and 10 comp forensics 09 10-18 file system
Lecture 9 and 10 comp forensics 09 10-18 file system
 
Module 02 ftk imager
Module 02 ftk imagerModule 02 ftk imager
Module 02 ftk imager
 

Andere mochten auch

Access lesson 06 Integrating Access
Access lesson 06  Integrating AccessAccess lesson 06  Integrating Access
Access lesson 06 Integrating Access
Aram SE
 
Lecture1
Lecture1Lecture1
Lecture1
rjaeh
 
Database and Access Power Point
Database and Access Power PointDatabase and Access Power Point
Database and Access Power Point
Ayee_Its_Bailey
 
Communication skills in english
Communication skills in englishCommunication skills in english
Communication skills in english
Aqib Memon
 
Access lesson 02 Creating a Database
Access lesson 02 Creating a DatabaseAccess lesson 02 Creating a Database
Access lesson 02 Creating a Database
Aram SE
 
01 computer%20 forensics%20in%20todays%20world
01 computer%20 forensics%20in%20todays%20world01 computer%20 forensics%20in%20todays%20world
01 computer%20 forensics%20in%20todays%20world
Aqib Memon
 
Chapter 4 microsoft access 2010
Chapter 4 microsoft access 2010Chapter 4 microsoft access 2010
Chapter 4 microsoft access 2010
home
 
Access lesson05
Access lesson05Access lesson05
Access lesson05
Aram SE
 
Access lesson 04 Creating and Modifying Forms
Access lesson 04 Creating and Modifying FormsAccess lesson 04 Creating and Modifying Forms
Access lesson 04 Creating and Modifying Forms
Aram SE
 
European pricing with monte carlo simulation
European pricing with monte carlo simulationEuropean pricing with monte carlo simulation
European pricing with monte carlo simulation
Giovanni Della Lunga
 

Andere mochten auch (20)

Access lesson 06 Integrating Access
Access lesson 06  Integrating AccessAccess lesson 06  Integrating Access
Access lesson 06 Integrating Access
 
Lecture1
Lecture1Lecture1
Lecture1
 
Database and Access Power Point
Database and Access Power PointDatabase and Access Power Point
Database and Access Power Point
 
OWASP Khartoum Cyber Security Session
OWASP Khartoum Cyber Security SessionOWASP Khartoum Cyber Security Session
OWASP Khartoum Cyber Security Session
 
Communication skills in english
Communication skills in englishCommunication skills in english
Communication skills in english
 
Monte Carlo Statistical Methods
Monte Carlo Statistical MethodsMonte Carlo Statistical Methods
Monte Carlo Statistical Methods
 
Monte Carlo Simulation
Monte Carlo SimulationMonte Carlo Simulation
Monte Carlo Simulation
 
Access lesson 02 Creating a Database
Access lesson 02 Creating a DatabaseAccess lesson 02 Creating a Database
Access lesson 02 Creating a Database
 
Monte Carlo G P U Jan2010
Monte  Carlo  G P U  Jan2010Monte  Carlo  G P U  Jan2010
Monte Carlo G P U Jan2010
 
01 computer%20 forensics%20in%20todays%20world
01 computer%20 forensics%20in%20todays%20world01 computer%20 forensics%20in%20todays%20world
01 computer%20 forensics%20in%20todays%20world
 
Chapter 4 microsoft access 2010
Chapter 4 microsoft access 2010Chapter 4 microsoft access 2010
Chapter 4 microsoft access 2010
 
Computer Forensics
Computer ForensicsComputer Forensics
Computer Forensics
 
Model inquiri
Model inquiriModel inquiri
Model inquiri
 
Super Efficient Monte Carlo Simulation
Super Efficient Monte Carlo SimulationSuper Efficient Monte Carlo Simulation
Super Efficient Monte Carlo Simulation
 
Access lesson05
Access lesson05Access lesson05
Access lesson05
 
Access lesson 04 Creating and Modifying Forms
Access lesson 04 Creating and Modifying FormsAccess lesson 04 Creating and Modifying Forms
Access lesson 04 Creating and Modifying Forms
 
Agape explains the importance Of Computer Forensics.
Agape explains the importance Of Computer Forensics.Agape explains the importance Of Computer Forensics.
Agape explains the importance Of Computer Forensics.
 
Unit 5 general principles, simulation software
Unit 5 general principles, simulation softwareUnit 5 general principles, simulation software
Unit 5 general principles, simulation software
 
Hemolytic anaemia
Hemolytic anaemiaHemolytic anaemia
Hemolytic anaemia
 
European pricing with monte carlo simulation
European pricing with monte carlo simulationEuropean pricing with monte carlo simulation
European pricing with monte carlo simulation
 

Ähnlich wie Computer Forensics & Windows Registry

Đ’ŃŃ‡Đ”ŃĐ»Đ°ĐČ ĐšĐ°Đ±Đ°Đș "Microsoft Sysinternals-Useful Utilities"
Đ’ŃŃ‡Đ”ŃĐ»Đ°ĐČ ĐšĐ°Đ±Đ°Đș "Microsoft Sysinternals-Useful Utilities"Đ’ŃŃ‡Đ”ŃĐ»Đ°ĐČ ĐšĐ°Đ±Đ°Đș "Microsoft Sysinternals-Useful Utilities"
Đ’ŃŃ‡Đ”ŃĐ»Đ°ĐČ ĐšĐ°Đ±Đ°Đș "Microsoft Sysinternals-Useful Utilities"
EPAM Systems
 
SANS 20 Security Controls
SANS 20 Security ControlsSANS 20 Security Controls
SANS 20 Security Controls
Casey Wimmer
 
Ch11 system administration
Ch11 system administration Ch11 system administration
Ch11 system administration
Raja Waseem Akhtar
 
computerforensics-140529094816-phpapp01 (1).pdf
computerforensics-140529094816-phpapp01 (1).pdfcomputerforensics-140529094816-phpapp01 (1).pdf
computerforensics-140529094816-phpapp01 (1).pdf
Gnanavi2
 
Ch07 system administration
Ch07 system administration Ch07 system administration
Ch07 system administration
Raja Waseem Akhtar
 

Ähnlich wie Computer Forensics & Windows Registry (20)

Intrusion Discovery on Windows
Intrusion Discovery on WindowsIntrusion Discovery on Windows
Intrusion Discovery on Windows
 
Đ’ŃŃ‡Đ”ŃĐ»Đ°ĐČ ĐšĐ°Đ±Đ°Đș "Microsoft Sysinternals-Useful Utilities"
Đ’ŃŃ‡Đ”ŃĐ»Đ°ĐČ ĐšĐ°Đ±Đ°Đș "Microsoft Sysinternals-Useful Utilities"Đ’ŃŃ‡Đ”ŃĐ»Đ°ĐČ ĐšĐ°Đ±Đ°Đș "Microsoft Sysinternals-Useful Utilities"
Đ’ŃŃ‡Đ”ŃĐ»Đ°ĐČ ĐšĐ°Đ±Đ°Đș "Microsoft Sysinternals-Useful Utilities"
 
First Responders Course - Session 4 - Forensic Readiness [2004]
First Responders Course - Session 4 - Forensic Readiness [2004]First Responders Course - Session 4 - Forensic Readiness [2004]
First Responders Course - Session 4 - Forensic Readiness [2004]
 
SANS 20 Security Controls
SANS 20 Security ControlsSANS 20 Security Controls
SANS 20 Security Controls
 
FORENSIC ANALYSIS OF WINDOWS REGISTRY AGAINST INTRUSION
FORENSIC ANALYSIS OF WINDOWS REGISTRY AGAINST INTRUSIONFORENSIC ANALYSIS OF WINDOWS REGISTRY AGAINST INTRUSION
FORENSIC ANALYSIS OF WINDOWS REGISTRY AGAINST INTRUSION
 
Ch11
Ch11Ch11
Ch11
 
Ch11 system administration
Ch11 system administration Ch11 system administration
Ch11 system administration
 
"Backoff" Malware: How to Know If You're Infected
"Backoff" Malware: How to Know If You're Infected"Backoff" Malware: How to Know If You're Infected
"Backoff" Malware: How to Know If You're Infected
 
Computer forensics
Computer forensicsComputer forensics
Computer forensics
 
computerforensics-140529094816-phpapp01 (1).pdf
computerforensics-140529094816-phpapp01 (1).pdfcomputerforensics-140529094816-phpapp01 (1).pdf
computerforensics-140529094816-phpapp01 (1).pdf
 
Desktop support qua
Desktop support quaDesktop support qua
Desktop support qua
 
Desktop support qua
Desktop support quaDesktop support qua
Desktop support qua
 
20 Trip-Wire-.pdf
20 Trip-Wire-.pdf20 Trip-Wire-.pdf
20 Trip-Wire-.pdf
 
20 Trip-Wire-.pdf
20 Trip-Wire-.pdf20 Trip-Wire-.pdf
20 Trip-Wire-.pdf
 
Ch07 system administration
Ch07 system administration Ch07 system administration
Ch07 system administration
 
10 resource kit remote administration tools
10 resource kit remote administration tools10 resource kit remote administration tools
10 resource kit remote administration tools
 
Backtrack Manual Part8
Backtrack Manual Part8Backtrack Manual Part8
Backtrack Manual Part8
 
First Responders Course - Session 7 - Incident Scope Assessment [2004]
First Responders Course - Session 7 - Incident Scope Assessment [2004]First Responders Course - Session 7 - Incident Scope Assessment [2004]
First Responders Course - Session 7 - Incident Scope Assessment [2004]
 
Operating systems system structures
Operating systems   system structuresOperating systems   system structures
Operating systems system structures
 
Osonto documentatie
Osonto documentatieOsonto documentatie
Osonto documentatie
 

KĂŒrzlich hochgeladen

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
?#DUbAI#??##{{(☎+971_581248768%)**%*]'#abortion pills for sale in dubai@
 

KĂŒrzlich hochgeladen (20)

Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
 
Developing An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of BrazilDeveloping An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of Brazil
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
 
Advantages of Hiring UIUX Design Service Providers for Your Business
Advantages of Hiring UIUX Design Service Providers for Your BusinessAdvantages of Hiring UIUX Design Service Providers for Your Business
Advantages of Hiring UIUX Design Service Providers for Your Business
 
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
HTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation StrategiesHTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation Strategies
 
Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024
 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Script
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed texts
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024
 
GenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdfGenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdf
 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processors
 
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUnderstanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
 

Computer Forensics & Windows Registry