# The Windows Registry

The Windows Registry is the central hierarchical database used to store information necessary to configure the system for one or more users, applications, and hardware devices. For forensics analysts, it is an absolute goldmine.

Whenever a user executes a program, plugs in a USB drive, or changes a setting, a trace is left in the Registry.

## Structure of the Registry
The registry is divided into five main logical root keys (Hives):
1.  **HKEY_LOCAL_MACHINE (HKLM):** Settings applied to the entire machine, regardless of who is logged in.
2.  **HKEY_CURRENT_USER (HKCU):** Settings unique to the currently logged-in user.
3.  **HKEY_USERS (HKU):** Contains all the loaded user profiles. (HKCU is actually just a pointer into a specific subkey inside HKU).
4.  **HKEY_CLASSES_ROOT (HKCR):** File extension associations (e.g., telling Windows that `.txt` opens with Notepad).
5.  **HKEY_CURRENT_CONFIG (HKCC):** Information about the hardware profile currently being used.

## Where are the files?
When you image a hard drive, you don't get a file called `registry.exe`. The registry is actually made up of several physical files called **Hives** located on the disk:
*   `C:\Windows\System32\config\SYSTEM` (Maps to HKLM\SYSTEM)
*   `C:\Windows\System32\config\SOFTWARE` (Maps to HKLM\SOFTWARE)
*   `C:\Windows\System32\config\SECURITY` (Maps to HKLM\SECURITY)
*   `C:\Windows\System32\config\SAM` (Security Account Manager - Holds local password hashes)
*   `C:\Users\<username>\NTUSER.DAT` (Maps to the specific user's HKCU)

## Key Forensic Artifacts in the Registry

### 1. Persistence (Auto-Start Extensibility Points)
Attackers want their malware to survive a reboot. The easiest way to do this is to add a registry key telling Windows to run the malware every time it starts.
*   **Run Keys:** `HKLM\Software\Microsoft\Windows\CurrentVersion\Run` and `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`
*   *Forensic Value:* Always check these keys. If you see `C:\Users\Public\svchost.exe` launching from a Run key, the machine is compromised.

### 2. USB Device History (USBStor)
Did the suspected employee copy the secret blueprints to a thumb drive? 
*   **Location:** `HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR`
*   *Forensic Value:* Records the Vendor, Product ID, and unique Serial Number of *every* USB mass storage device that has ever been plugged into the machine.

### 3. UserAssist
*   **Location:** `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist`
*   *Forensic Value:* Tracks which GUI applications the user executed, how many times they ran them, and the last time they were executed. The names of the programs are lightly obfuscated using ROT-13 encryption, which your forensic tools will decrypt automatically.