Some common malware scanners are not able to detect such maliciously crafted registry values (Gregg, 2005). Fortunately, Windows console registry tool (reg.exe) can display overly long registry values.

For instance, storing string (hexadecimal notation for “pass” in ASCII) in the REG_SZ registry value. However, this technique requires a simple piece of code to encode the text before storing it into the registry, and to decode the binary data to its readable form when retrieving it. It is not-trivial for forensic examiner to find such hidden data as the binary data (encoded text in hexadecimal form) is stored as it is in the registry, and binary data is common in registry. An example of a place to hide data is in the time zone information key, HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TimeZoneInformation (Carvey, 2004).

Was The Windows Registry A Good Idea?

For instance, to detect values in registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Run, the instruction is reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run. A better way to hide data is to encode text-based information into binary format in hexadecimal notation and stored the binary form in registry values as string using type REG_SZ.

By correlating the entry with registry key LastWrite time, investigator would know when the removable device is connected. The second key also contains similar information as MountedDevices key, which is located under the respective device GUID (Globally Unique Identifiers) subkey and in the binary registry value named Data. This key correlates to the previous OpenSaveMRU key to provide extra information. Whenever a new entry is added to the previous OpenSaveMRU key, registry value is created or updated in this key.

This key contains time zone information, including the difference in minutes between UTC and local time, and reference information during daylight saving time. Windows reads this registry key into TIME_ZONE_INFORMATION structure during system startup.

• Every time you make a configuration change, that information is automatically written to the Registry.
• The Registry is also updated whenever you install a new software program or hardware device.
• In this sense, the Registry functions like a control centre for your entire computer system; it defines how every part of your system looks and works.
• Each hive is stored in https://wikidll.com/microsoft/nwapi32-dll its own system file on your PC’s hard disk.
• When Windows needs to do just about anything, it accesses the Registry to obtain the proper configuration information.

Windows Registry

Each binary registry value under this key contains a recently used program executable filename, and the folder path of a file to which the program has been used to open or save it. If a file is saved, the folder path refers to the saved file destination path; if a file is opened, the folder path refers to the file source path. New registry value will only be created to this key, if no existing registry values contain the program executable filename. However, if there is a matching executable filename in the existing values, only the folder path section of the related registry value is updated.

For instance, if the binary data for registry value “\DosDevices\F” contains “\ \Storage#RemoveableMedia” at the beginning of the value, it signifies a USB removable disk was connected to the system USB port.

Subsequent four subkeys may also contain suspicious entries. Similar 5 sets of “Run” registry keys may exist under root key HKCU, pertaining to the logged on user configuration (Carvey, 2004). The first key contains a list of mounted devices, with associated persistent volume name and unique internal identifier for respective devices (Carvey, 2004). This key lists any volume that is mounted and assigned a drive letter, including USB storage devices and external DVD/CDROM drives. From the listed registry values, value’s name that starts with “\DosDevices\” and ends with the associated drive letter, contains information regarding that particular mounted device.