Windows Registry Forensics: Persistence & User Activity Artefacts

Prerequisites

• DFA-K003: NTFS Forensics
• CIR-K005: Persistence Hunting (recommended)

Why This Lesson Matters

The Windows Registry is a treasure chest for forensic investigators. It records what programmes were installed, what USB drives were plugged in, what files were recently opened, what network connections were made, and — critically — what persistence mechanisms an attacker configured. Every relevant key has a last-written timestamp. Think of the registry as the system's diary: it does not lie, but you have to know which pages to read.

1. Registry Structure Refresher

The registry is a hierarchical database of keys and values, split across hive files on disk.

Hive file locations:

To analyse offline (from a forensic image):

# Mount the hive in Registry Explorer (Windows GUI tool — Eric Zimmerman)
# or load offline with regedit:
regedit → HKLM → File → Load Hive → select NTUSER.DAT

2. Forensic Artefacts by Investigation Goal

2.1 Persistence Artefacts

# Parse Run key from offline NTUSER.DAT (using RegRipper)
rip.pl -r NTUSER.DAT -p run
# Output: each Run key entry with name, value, and last-written time

2.2 Evidence of Execution Artefacts

These keys record what programmes have been run, even if the binary was later deleted.

AppCompatCache (Shimcache) Records every executable that ran (or was present on disk) since last boot. Survives binary deletion.

rip.pl -r SYSTEM -p appcompatcache
# Lists executable paths and last modification timestamps

Amcache.hve

Location: C:WindowsAppCompatProgramsAmcache.hve

Records SHA-1 hashes of executed binaries. You can look up the hash on VirusTotal even if the binary is gone.

# Parse Amcache with AmcacheParser (Eric Zimmerman)
AmcacheParser.exe -f Amcache.hve --csv /cases/IR-001/amcache_output/

UserAssist Records GUI applications launched by the user, with execution count and last run time. The key names are ROT13-encoded.

rip.pl -r NTUSER.DAT -p userassist
# Automatically decodes ROT13, shows: program path, run count, last run time

2.3 Recent File Access

RecentDocs

HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerRecentDocs

Lists the most recently opened documents. Shows filenames even if the files were deleted.

OpenSavePidlMRU / LastVisitedPidlMRU Records files opened and the folders browsed in Open/Save dialogs — useful for tracking data staging.

rip.pl -r NTUSER.DAT -p recentdocs
rip.pl -r NTUSER.DAT -p opensavepidlmru

2.4 USB Device Forensics

Every USB device that has ever been connected leaves multiple registry entries:

HKLMSYSTEMCurrentControlSetEnumUSBSTOR
  → VID/PID → serial number → friendly name, first/last connect timestamps

HKLMSYSTEMCurrentControlSetEnumUSB
  → lower-level USB device records

HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2
  → drive letters assigned to USB devices

rip.pl -r SYSTEM -p usbstor      # USB storage device history
rip.pl -r SYSTEM -p usb          # broader USB history
rip.pl -r NTUSER.DAT -p mountpoints2   # drive letter assignments

Example output:

VendorID/ProductID: 0951/1666
Serial: 001CC0EC35A6F490
FriendlyName: Kingston DataTraveler 3.0 USB Device
First connected: 2026-06-08 14:15:32 UTC
Last connected:  2026-06-08 15:22:04 UTC
Drive letter assigned: E:

3. RegRipper: Automated Registry Parsing

RegRipper is a Perl-based tool with 300+ plugins, each targeting a specific forensic artefact.

# Run all plugins against a hive (comprehensive output)
rip.pl -r NTUSER.DAT -a > ntuser_full_report.txt

# Run a specific plugin
rip.pl -r SYSTEM -p usbstor > usb_history.txt
rip.pl -r SOFTWARE -p uninstall > installed_software.txt
rip.pl -r NTUSER.DAT -p typedurls > browsing_history.txt

# Key plugins for forensic investigations:
# SYSTEM hive:  computername, timezone, usbstor, services, appcompatcache
# SOFTWARE:     uninstall, networklist, officemru
# NTUSER.DAT:   userassist, recentdocs, run, typedurls, muicache

4. Registry Last-Written Timestamps

Every registry key has a last-written timestamp — the time the key or any of its values was last modified. This is invaluable for timeline reconstruction.

# View last-written timestamp in Registry Explorer (GUI)
# The timestamp appears on the key details pane

# From command line (online registry):
reg query "HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun" /t REG_SZ /s
# Timestamps only visible in forensic tools, not regedit

5. Common Mistakes

Mistake 1: Only checking HKLM Run keys. User-space persistence (HKCU Run) is just as effective as system-wide (HKLM) and is easier to install without admin rights. Check both.

Mistake 2: Forgetting UsrClass.dat. ShellBag artefacts (which folders a user browsed) live in UsrClass.dat, not NTUSER.DAT. A user who browsed to a USB drive and opened files leaves a trail there — even if the files were deleted.

Mistake 3: Not correlating registry timestamps with other artefacts. A Run key with a last-written time of 14:32 UTC on the incident date, combined with an auth.log SSH login at 14:31 UTC, is strong evidence of attacker persistence installation. Timestamps only become meaningful when correlated.

6. Practice Exercises

1. Amcache shows an executable C:UsersPublicupdate.exe with hash a3f9b2... and an execution timestamp of 14:32 UTC. The binary is no longer on disk. What three things do you do next?

2. USB forensics shows a Kingston DataTraveler was connected at 14:15 UTC and disconnected at 15:22 UTC. The incident is believed to have started at 14:30 UTC. What is the forensic significance of this timing?

3. UserAssist shows Mimikatz.exe with a run count of 3 and last run time 14:35 UTC. Identify the ATT&CK technique and explain why UserAssist is useful even if the binary was deleted.

7. Lab

Assessment mode: quiz

6 questions: identify the correct registry key for five described investigation goals (persistence, USB history, execution evidence, recent files, typed URLs), and interpret a provided RegRipper output snippet.

8. Framework Alignment

9. Further Reading

• RegRipper — https://github.com/keydet89/RegRipper3.0 — Plugin list is also a complete registry forensics reference
• Eric Zimmerman's Registry Explorer — Excellent GUI; free; handles offline hives cleanly
• "Windows Registry Forensics" — Harlan Carvey — The reference book; Carvey also wrote RegRipper

["Map five forensic investigation goals (persistence, execution evidence, USB history, recent files, typed URLs) to their corresponding registry hive file and key path", "Run RegRipper against an offline NTUSER.DAT hive with at least three relevant plugins and interpret the output to identify a persistence mechanism and two execution artefacts", "Detect a timestomping inconsistency in a registry last-written timestamp vs a correlated log timestamp and explain the forensic significance"]

Prerequisites → Why this matters (diary analogy) → Registry structure and hive file locations → Forensic artefacts by goal (persistence, execution, recent files, USB) → RegRipper workflow → Last-written timestamps → Common mistakes → Practice exercises → Quiz lab → Framework alignment → Further reading