## The Windows Registry

The Registry is a massive hierarchical database storing ALL configuration settings.
*   Tool: `regedit.exe`.

### The 5 Hives (Root Keys)
1.  **HKLM (HKEY_LOCAL_MACHINE)**: Settings for the computer (regardless of who is logged in).
    *   `HKLMSoftware`: Installed programs.
    *   `HKLMSystem`: Drivers, Services, Boot config.
2.  **HKCU (HKEY_CURRENT_USER)**: Settings for YOU.
    *   Wallpaper, theme, saved passwords.
    *   Actually points to `HKUSID`.
3.  **HKCR (Classes Root)**: File associations (open .pdf with Acrobat).
4.  **HKU (Users)**: Stores profiles for all users.
5.  **HKCC (Current Config)**: Hardware profile.

### Persistence in Registry
Hackers love the registry because you can tell Windows to run malware at boot.
*   **Run Keys**: `HKLMSoftwareMicrosoftWindowsCurrentVersionRun`. Anything here starts when ANY user logs in.
*   **RunOnce**: Starts once then deletes itself.
*   **Services**: `HKLMSystemCurrentControlSetServices`.

### Forensics Value
*   **ShimCache / AmCache**: Evidence of program execution (even if deleted).
*   **shellbags**: Evidence of which folders were opened.
*   **USBSTOR**: History of every USB drive ever plugged in.