11.1 Windows Registry Forensics: SYSTEM, SOFTWARE, SAM & NTUSER.DAT Hive Analysis

11.1 Windows Registry Forensics: SYSTEM, SOFTWARE, SAM & NTUSER.DAT Hive Analysis

Quick Answer: The Windows Registry is a hierarchical database containing vital forensic artifacts regarding operating system configuration, user activity, hardware usage, and malware persistence. It is physically partitioned into system-wide hives located in %SystemRoot%\System32\config\ (SYSTEM, SOFTWARE, SAM, SECURITY, DEFAULT) and user-specific hives (NTUSER.DAT in %UserProfile%\ and UsrClass.dat in %LocalAppData%\Microsoft\Windows\). Because active registries utilize transaction logs (.LOG1, .LOG2), examiners must replay dirty hive transaction logs using tools like Eric Zimmerman's Registry Explorer or yarp before performing analysis. Key investigative targets include USB device tracking via SYSTEM\CurrentControlSet\Enum\USBSTOR, persistence mechanisms under SOFTWARE\Microsoft\Windows\CurrentVersion\Run, user account telemetry within the SAM\Domains\Account\Users keys (RIDs, binary F and V values), and user activity traces (TypedURLs, RecentDocs, ShellBags) in NTUSER.DAT and UsrClass.dat.

---

Windows Registry Architecture & Storage Mechanics

The Windows Registry serves as the central configuration repository for the Windows NT kernel, device drivers, services, Security Account Manager, and user applications. Understanding its architectural layout, logical-to-physical mapping, and binary storage mechanics is fundamental to forensic reconstruction.

Logical Root Keys vs. Physical On-Disk Hives

Logically, the registry presents five root keys within Windows tools like regedit.exe. However, only two of these keys are physically stored on disk as primary hives; the remaining three are dynamic pointer links generated by the kernel at boot:

Registry Physical File Locations

The physical binary files containing registry data are called hives. Unlike standard flat files, hives are structured in 4,096-byte database pages ("hbins") containing data cells (keys, values, security descriptors, and subkey lists):

+-------------------------------------------------------------------------+
|                    WINDOWS REGISTRY HIVE FILE LOCATIONS                 |
+-------------------------------------------------------------------------+
| Hive Name    | File System Path                                         |
|--------------|----------------------------------------------------------|
| SYSTEM       | %SystemRoot%\System32\config\SYSTEM                      |
| SOFTWARE     | %SystemRoot%\System32\config\SOFTWARE                    |
| SAM          | %SystemRoot%\System32\config\SAM                         |
| SECURITY     | %SystemRoot%\System32\config\SECURITY                    |
| DEFAULT      | %SystemRoot%\System32\config\DEFAULT                     |
| NTUSER.DAT   | %UserProfile%\NTUSER.DAT (e.g., C:\Users\Alice\)         |
| UsrClass.dat | %UserProfile%\AppData\Local\Microsoft\Windows\UsrClass.dat|
| Amcache      | %SystemRoot%\appcompat\Programs\Amcache.hve             |
+-------------------------------------------------------------------------+

Registry Value Data Types

Registry keys function like filesystem directories and contain named values. Each value possesses a specific binary data type:

• REG_SZ: Fixed-length null-terminated Unicode string.
• REG_EXPAND_SZ: Expandable string containing unexpanded environment variables (e.g., %SystemRoot%\System32\cmd.exe).
• REG_BINARY: Raw binary data of arbitrary size (used for timestamps, hardware descriptors, and encryption hashes).
• REG_DWORD: 32-bit unsigned integer (often used for boolean flags and numerical limits).
• REG_QWORD: 64-bit unsigned integer (commonly used for 64-bit memory addresses and high-resolution timestamps).
• REG_MULTI_SZ: Multi-string array containing multiple null-terminated strings ending with a double-null character.

---

Transaction Logs and Dirty Hive Recovery

Modern Windows operating systems (Windows 8.1, Windows 10, and Windows 11) utilize a transactional logging mechanism to protect the registry database from disk corruption during sudden power loss or kernel crashes.

Transaction Log Architecture (.LOG1 and .LOG2)

Each physical hive file is accompanied by two transaction log files:

• <HiveName>.LOG1
• <HiveName>.LOG2

When Windows updates a registry key or value, it writes the modified memory pages into the transaction log (.LOG1 / .LOG2) before committing them to the primary hive file on disk. The transaction log contains raw sector journal entries, sequence numbers, and dirty page lists.

[Registry Write Request]
       │
       ▼
[Write to RAM Cache] ──> [Append Transaction Log (.LOG1)] ──> [Commit to Disk Hive]
                                                                       │
                                                              [Clear Dirty Bit Flag]

The Dirty Bit Flag

The primary hive header contains a Primary Sequence Number, a Secondary Sequence Number, and a Dirty Hive Flag:

• In a cleanly dismounted hive (e.g., after a standard shutdown), the primary and secondary sequence numbers match, and the dirty flag is set to 0x00000000.
• When a system crashes, is abruptly powered off, or evidence is acquired live (or via hard power termination), the sequence numbers do not match, and the dirty flag is set to 0x00000001 (Dirty).

Forensic Implications & Log Replay

[!CAUTION] Parsing a raw, dirty registry hive directly without replaying its companion transaction logs (.LOG1 / .LOG2) causes substantial evidence loss. Critical keys—such as malware persistence Run keys, recently connected USB devices, or deleted event log indicators—may reside exclusively inside the uncommitted transaction logs.

Forensic examiners must utilize tools capable of transaction log replay:

• Registry Explorer (Eric Zimmerman): Automatically detects companion .LOG1 and .LOG2 files in the source directory, prompts the examiner to apply transactions, and creates a recovered hive containing all uncommitted transactions alongside a detailed transaction changelog.
• yarp (Yet Another Registry Parser): Python library that programmatically parses dirty hives with transaction log merging.
• RegRipper (v3.0+): Harlan Carvey's utility supporting dirty hive reconciliation when configured with appropriate transaction log arguments.

---

SYSTEM Hive Analysis: Hardware & Storage Artifacts

The SYSTEM hive preserves system hardware configurations, operating system boot profiles, network interfaces, and peripheral storage records.

CurrentControlSet vs. ControlSet001/002

When viewing an offline SYSTEM hive, examiners will not observe a CurrentControlSet key. Instead, the hive contains numbered control sets (e.g., ControlSet001, ControlSet002) and a Select key:

HKLM\SYSTEM\Select
  ├── Current  : 0x00000001 (Points to ControlSet001 as active)
  ├── Default  : 0x00000001 (Points to ControlSet001 as default)
  ├── Failed   : 0x00000000 (No control set has failed)
  └── LastKnownGood : 0x00000002 (Points to ControlSet002)

Examiners must inspect SYSTEM\Select\Current to identify which numbered ControlSet00X was actively mounted as CurrentControlSet during the incident.

System Identity and Time Zone Configuration

• Computer Name: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName -> ComputerName (REG_SZ)
• Time Zone Bias & UTC Normalization: SYSTEM\CurrentControlSet\Control\TimeZoneInformation
  • TimeZoneKeyName: Standard Windows name of the configured time zone (e.g., "Eastern Standard Time").
  • ActiveTimeBias: Signed 32-bit integer indicating the current offset in minutes from UTC (including daylight saving adjustments).
  • Bias: Standard time offset from UTC in minutes (e.g., 300 minutes = UTC-5).
  • Forensic Utility: Essential for normalizing file timestamps across multi-timezone distributed investigations.

Network Interfaces

SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{GUID}

• Records IP configurations, network adapter GUIDs, subnet masks, default gateways, and DHCP server assignments (DhcpIPAddress, DhcpServer, LeaseObtainedTime, LeaseTerminatesTime).

USB Storage Forensic Tracking (USBSTOR)

Tracking external USB mass storage devices is vital for intellectual property theft, data exfiltration, and malware introduction inquiries. Windows tracks connected USB devices across multiple interrelated SYSTEM keys:

1. Device Enumeration:   SYSTEM\CurrentControlSet\Enum\USBSTOR
2. Device Classification: SYSTEM\CurrentControlSet\Control\DeviceClasses\{53f56307...}
3. Volume Correlation:   SYSTEM\MountedDevices
4. User Attribution:     NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Step 1: Enumeration in USBSTOR

SYSTEM\CurrentControlSet\Enum\USBSTOR\<DeviceClass>&Ven_<Vendor>&Prod_<Product>&Rev_<Revision>\<SerialNumber>&<Index>

Example Key: 
SYSTEM\CurrentControlSet\Enum\USBSTOR\Disk&Ven_SanDisk&Prod_Ultra&Rev_1.00\0123456789ABCDEF&0

• Vendor & Product ID: Identifies manufacturer and model (e.g., SanDisk Ultra).
• Unique Serial Number vs. OS-Generated ID:
  • If the second character of the serial number string is NOT an ampersand (&), the string is the unique hardware serial number assigned by the manufacturer (e.g., 0123456789ABCDEF).
  • If the second character IS an ampersand (&), the device did not provide a compliant serial number, and Windows generated a pseudo-unique identifier containing ampersands (e.g., 7&1b4d32f&0).
• Last Disconnection Timestamp: The Last Written Timestamp of the specific device subkey represents the last time the device was disconnected from the system.

Step 2: First Insertion Timestamp

SYSTEM\CurrentControlSet\Control\DeviceClasses\{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\...

• The GUID {53f56307-b6bf-11d0-94f2-00a0c91efb8b} represents the Disk Device Interface Class. Subkeys matching the device serial number reveal the first insertion timestamp recorded under the subkey's Last Written Time.

Step 3: Volume Correlation (MountedDevices)

SYSTEM\MountedDevices

• Correlates drive letters (e.g., \DosDevices\E:) and Volume GUIDs (\??\Volume{GUID}) with the binary device signature containing the USB serial number. This confirms which drive letter Windows assigned to the USB drive.

Step 4: User Attribution (MountPoints2)

To prove which user plugged in the drive, open each user's NTUSER.DAT: NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{Volume-GUID}

• If a user was logged in when the USB volume was mounted, Windows creates a subkey under MountPoints2 matching the Volume GUID identified in MountedDevices. The presence of this key establishes definitive user attribution.

---

SOFTWARE Hive Analysis: OS Metadata, Persistence & Networks

The SOFTWARE hive contains configuration details for the Windows OS, third-party applications, file associations, and autostart persistence mechanisms.

Operating System Version & Install History

SOFTWARE\Microsoft\Windows NT\CurrentVersion

Autostart Extensibility Points (ASEPs) / Persistence Keys

Threat actors maintain persistence by registering malicious binaries into Autostart Extensibility Points (ASEPs) within the SOFTWARE and NTUSER.DAT hives:

# System-wide Autostart Keys (Run with Elevated Privileges)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run

# User-Specific Autostart Keys (Run at User Logon)
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

# Winlogon Authentication Hijacking
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  ├── Shell    : explorer.exe (Adversaries append or replace with malware)
  └── Userinit : C:\Windows\system32\userinit.exe, (Note trailing comma)

Installed Application Inventory

To determine software installed on the system (and identify uninstalled anti-forensic tools or unauthorized software):

• 64-bit Software: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{GUID or AppName}
• 32-bit Software on 64-bit OS: SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{GUID or AppName}
• Values parsed: DisplayName, DisplayVersion, InstallLocation, InstallDate, UninstallString.

Network List Profiles (SSID & Connection Tracking)

SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{Profile_GUID}

• ProfileName: SSID of Wi-Fi network or name of wired connection.
• Category: 0x00 = Public, 0x01 = Private, 0x02 = Domain.
• DateCreated: 128-bit SYSTEMTIME binary structure marking when the host first connected to the network.
• DateLastConnected: 128-bit SYSTEMTIME binary structure marking the most recent connection timestamp.

---

SAM Hive Analysis: Account Governance & Binary Values

The Security Account Manager (SAM) hive contains local account credentials, group memberships, and logon security metrics. Located at %SystemRoot%\System32\config\SAM, it is protected by the Windows kernel and inaccessible to standard users while the OS is running.

Account Structure and Relative Identifiers (RIDs)

Every local user account on Windows is assigned a unique Security Identifier (SID) terminating in a Relative Identifier (RID): S-1-5-21-<Domain_Identifier>-<RID>

+-------------------------------------------------------------------------+
|                   STANDARD WINDOWS RELATIVE IDENTIFIERS (RIDs)          |
+-------------------------------------------------------------------------+
| RID (Hex / Decimal) | Account Identity & Purpose                        |
|---------------------|---------------------------------------------------|
| 0x01F4 / 500        | Default Built-in Administrator Account            |
| 0x01F5 / 501        | Built-in Guest Account                            |
| 0x01F7 / 503        | DefaultAccount (Application container)            |
| 0x01F8 / 504        | WDAGUtilityAccount (Windows Defender Application Guard) |
| >= 0x03E8 / >= 1000 | Custom User Accounts created by administrators    |
+-------------------------------------------------------------------------+

Account subkeys reside under: SAM\Domains\Account\Users\<RID_in_Hex> (e.g., 000003E8 for RID 1000). The mapping between usernames and RIDs is stored under SAM\Domains\Account\Users\Names\<Username>.

The Binary F and V Values

Within each RID subkey (SAM\Domains\Account\Users\<Hex_RID>), Windows maintains two binary values:

SAM\Domains\Account\Users\000003E8\
  ├── F : [Fixed-length binary data - 80 bytes]
  └── V : [Variable-length binary data - variable size]

+-------------------------------------------------------------------------+
|                    THE BINARY 'F' VALUE (FIXED LENGTH: 80 BYTES)        |
+-------------------------------------------------------------------------+
| Byte Offset | Length   | Value Stored (Little-Endian)                  |
|-------------|----------|-----------------------------------------------|
| 0x08 - 0x0F | 8 bytes  | Last Logon Timestamp (FILETIME)               |
| 0x18 - 0x1F | 8 bytes  | Password Last Set Timestamp (FILETIME)        |
| 0x20 - 0x27 | 8 bytes  | Account Expiration Timestamp (FILETIME)       |
| 0x28 - 0x2F | 8 bytes  | Last Failed Login Timestamp (FILETIME)        |
| 0x38 - 0x39 | 2 bytes  | Account Control Flags (0x0001 = Disabled)     |
| 0x40 - 0x41 | 2 bytes  | Failed Login Counter (Tracks brute force)     |
| 0x42 - 0x43 | 2 bytes  | Total Successful Logon Counter                |
+-------------------------------------------------------------------------+

• Account Control Flags (Offset 0x38): If the least significant bit is set (0x0001), the account is disabled. If bit 0x0010 is set, the account is locked out.
• The Variable-Length V Value: Contains relative offset pointers and lengths to null-terminated Unicode strings: Username, Full Name, User Comment, User Profile Path, and encrypted password hash structures (NTLM hashes encrypted with the Syskey/SYSKEY derived from the SYSTEM hive).

---

User Hives: NTUSER.DAT & UsrClass.dat

User hives provide detailed insight into the specific actions, file accesses, and web browsing habits of individual user accounts.

NTUSER.DAT Artifacts

Located in %UserProfile%\NTUSER.DAT (e.g., C:\Users\Bob\NTUSER.DAT):

1. TypedURLs: NTUSER.DAT\Software\Microsoft\Internet Explorer\TypedURLs

   • Contains URLs manually typed into the address bar of Internet Explorer, Windows Explorer, or legacy Edge.
   • Values: url1, url2, etc., sorted in reverse chronological order.
   • Note: Also inspect TypedURLsTime for 64-bit FILETIME timestamps of when each URL was typed.

2. RecentDocs (Most Recently Used - MRU): NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

   • Tracks recently opened files categorized by file extension subkeys (e.g., .pdf, .docx, .exe) as well as the root key.
   • Contains binary values and an MRUListEx value (array of 4-byte integers defining the exact order of access, with the first integer representing the most recent file).

3. Office Recent Files: NTUSER.DAT\Software\Microsoft\Office\<Version>\<Application>\User MRU\<AD_SID>\File MRU

   • Tracks exact file paths, full filenames, and live access timestamps for Microsoft Word, Excel, and PowerPoint documents.

UsrClass.dat Artifacts

Located in %UserProfile%\AppData\Local\Microsoft\Windows\UsrClass.dat:

• Associated with HKEY_CURRENT_USER\Software\Classes.
• MuiCache (Multilingual User Interface Cache): UsrClass.dat\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
  • Populated whenever an application executes and registers its friendly display name.
  • Preserves full file system paths of executed binaries, including portable tools executed from temp folders or USB drives that may have been subsequently deleted.
• ShellBags: UsrClass.dat\Local Settings\Software\Microsoft\Windows\Shell\Bags and BagMRU
  • Detailed in Section 11.3; proves folder browsing, folder access dates, and external drive navigation.