https://4n6post.com/tags/registry/Recent content in Registry on 4n6Posthttps://4n6post.com/artifacts/registrydb-sam/2025-10-14SAM Database - Windows Security Account Manager Security Account Manager (SAM) database in short, is the critical components of Windows security architecture. It stores user account information, password hashes for local accounts, groups associations, and security policies for local accounts on Windows systems. When considering user accounts, the SAM database provides evidence about user accounts, authentication attempts, and insight on user activity and potential security compromises. Understanding how to properly extract, analyze, and interpret SAM data is essential for any serious Windows forensic investigation.https://4n6post.com/artifacts/mru/2024-10-02The MRU (Most Recently Used) registry is a database in Microsoft Windows that stores information about recently opened files, URLs, and other items. This information can be used for a variety of purposes, both benign and malicious. This is NOT the same as runMRU. Normal Use Case The MRU registry is commonly used by applications to keep track of recently opened files and other items. For example, a word processor might use the MRU registry to keep a list of the last ten documents a user has worked on.https://4n6post.com/artifacts/amcache.hve/2024-10-01Amcache.hve is a forensic artifact that can be used to uncover valuable information about a computer system, both in normal and malicious use cases. The Amcache.hve file is a hive file that is located in the Windows operating system, and it provides a wealth of information about the software and files that have been executed on the system. In normal use cases, the Amcache.hve file can be used to track software installations and updates, as well as to determine which files were recently executed on the system.https://4n6post.com/artifacts/shellbags/2024-01-02Understanding ShellBags in the Windows Registry: A Deep Dive As my other posts likely portrais. The Windows operating system is a treasure of love and trove-like of forensic evidence. Along with the various artifacts, ShellBags stand out for their ability to provide valuable timeline and insights into a user’s general activity. Whether used for legitimate investigations or malicious purposes, understanding ShellBags is crucial for anyone dealing with digital forensics and even cybersecurity defenses like EDR.https://4n6post.com/artifacts/registry-start-shutdown-count/2023-10-01Windows Registry: System Start, Shutdown, and Reboot Tracking The Windows registry is a hierarchical database that stores configuration settings for Windows operating systems, including Windows 10, Windows 8, and Windows 7. The registry is organized into five main components, namely HKEY_CLASSES_ROOT, HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE, HKEY_USERS, and HKEY_CURRENT_CONFIG. Each of these components contains subkeys that store configuration data, including the data and time for when a computer turns on, shuts down, and restarts.https://4n6post.com/artifacts/shimcache/2023-10-01ShimCache - Windows Application Compatibility Cache for Digital Forensics Shimcache is a Windows artifact that stores information about programs that have been executed on a Windows machine. The Shimcache can be used for both benign and malicious purposes, making it a useful tool for system administrators, digital forensics analysts, and attackers. You should keep in mind that ShimCache and AMCache are very similar and depending on the version of Windows you are looking into, the AMCache might be more valuable to focus on.https://4n6post.com/artifacts/osinstalldatetime/2023-01-15The Windows registry is a central repository of configuration data for the Windows operating system and its applications. One important aspect of the registry is the section involving the Windows install time. This information can be used in a variety of ways, both for normal system usage and for malicious purposes. Finding the InstallDate/InstallTime Registry To find the registry section involving the Windows install time and timezone, you can navigate to the following location in the file system:https://4n6post.com/artifacts/addisablingtailoredexperience/2023-01-01Customizing Windows: Ad Disabling and Tailored Experience In the realm of Windows customization, users often seek ways to tailor their experience to suit personal preferences. This blog post explores a specific aspect of this customization - the modification of registry keys to disable ads in Windows and control tailored experiences. Disabling Ads in Windows What is it About? Windows often displays ads and promotes certain apps to users. However, not everyone appreciates this feature.https://4n6post.com/artifacts/enablingwindowsbsoddetail/2023-01-01Introduction By default, Windows displays a simple emoticon (smiley face) when a Blue Screen of Death (BSOD) occurs. However, if you prefer to see detailed information about the error, you can modify specific registry entries. This guide will walk you through the process. Disabling Ads in Windows What is it About? Windows often displays ads and promotes certain apps to users. However, not everyone appreciates this feature. To gain more control over your Windows experience, you can disable specific apps’ promotional activities using Registry Keys.https://4n6post.com/artifacts/runmru/2023-01-01Understanding the RunMRU Registry: Security Implications and Forensic Value The RunMRU (Most Recently Used) registry is a key component of the Microsoft Windows operating system, storing information about the most recently executed applications and documents. This information is used to populate the “Recent Items” list in the Start menu, as well as for application compatibility purposes. While the RunMRU registry serves a useful purpose for end users, it also presents a potential security risk if not properly managed.https://4n6post.com/artifacts/registry-sysinternals/2023-01-01SysInternals Tools - Registry Forensics and Analysis What is SysInternals? SysInternals is a suite of advanced system utilities for Microsoft Windows that provides deep technical insight into the operating system. These tools are designed to help IT professionals, system administrators, and software developers manage, troubleshoot, and diagnose Windows systems effectively. From process management to network monitoring, SysInternals offers a wide range of utilities that enhance system performance, security, and reliability.https://4n6post.com/artifacts/timezoneinformation/2023-01-01The Windows registry is a critical component of the Windows operating system. It stores important configuration data and settings that help the operating system function properly. One of the registry keys that play an important role in the functioning of the system is the TimeZoneInformation registry key. In this blog post, we’ll delve into the registry TimeZoneInformation, its connection with the Dynamic Link Library (DLL) it uses, and how it is used in both normal and malicious scenarios.https://4n6post.com/artifacts/typedpath/2023-01-01Registry Section of TypedPath: Understanding Its Importance in Digital Forensics The registry is an important aspect of a computer’s operating system, as it stores information about the configuration, settings, and installed software. In digital forensics, the registry can provide valuable information to investigators, as it can reveal data about software execution and system changes. The registry section of TypedPath is a digital forensics tool that can be used to extract information from the registry of a computer.https://4n6post.com/artifacts/windows_border_size/2023-01-01Exploring Windows Border Size Modification Welcome to our exploration of a subtle yet impactful customization in the Windows operating system. Today, we’ll delve into the world of Windows Border size modification and how a few Registry Keys can unlock a realm of personalization. Understanding Windows Border Customization Windows border size modification allows users to adjust the thickness of window borders in the Windows interface. This customization affects the visual appearance of application windows and can impact both usability and accessibility.https://4n6post.com/artifacts/windows-usb-connection/2023-01-01USB connections are a commonly used method for transferring data between computers and other electronic devices. In Windows, the use of USB connections can affect the registry in several ways, including within the registry are the USB, USBSTOR and MountPoints keys. In this post, we’ll explore the connection between USB Mountpoints and the setupapi.dev.log, and provide examples of both normal and malicious use cases. USB Forensics Overview USB device forensics involves analyzing multiple Windows artifacts to track USB device usage, including:https://4n6post.com/artifacts/wordwheelquery/2023-01-01The Registry Section of WordWheelQuery: An Overview for Digital Forensic Investigators The WordWheelQuery registry section is a critical component for digital forensic investigations, as it contains information about the user’s search queries made using the Windows operating system. In this blog post, we’ll take a closer look at what exactly can be found in the WordWheelQuery registry section and its significance for both normal and malicious use cases. Finding the WordWheelQuery Registry What is the Significance of the Registry Section of WordWheelQuery?