decrypting…# 🎩 **Registry Explorer** 🕵️♂️🔍 #tool #TTDF #EZ #BLUE > **A Powerful Forensic Tool by [Eric Zimmerman](https://ericzimmerman.github.io/)** > A fast and modern way to analyze Windows Registry hives with ease! 🚀 ## 📌 **Introduction** **Registry Explorer** is a cutting-edge tool designed for forensic analysis of Windows Registry hives. Built for speed and flexibility, it outperforms traditional registry analysis tools, making it an essential asset for digital forensic professionals. 🔥 ## Dirty Hives In **Registry Explorer**, a **dirty hive** refers to a Windows registry hive that was not properly closed before the system was shut down. This typically happens when the system crashes, experiences a power failure, or shuts down unexpectedly while registry changes were still being written. ### Key Points About a Dirty Hive: - It may contain inconsistencies or uncommitted transactions. - Windows uses a transaction log to recover or roll back changes upon reboot. - Registry Explorer may still allow you to open and analyze a dirty hive, but some data might be corrupted. - You might need to use tools like **esentutl** or forensic tools to attempt recovery if the hive is severely damaged. To fix dirty hives update the transaction logs by adding the stuck logs to the current transaction ## 🛠 **Getting Started** ### 📥 **Download & Install** 1. Download **Registry Explorer** from [Eric Zimmerman's GitHub](https://github.com/EricZimmerman/RECmd). 2. Extract the ZIP file. 3. Run `RegistryExplorer.exe` (No installation required! 🎉). ### 🏃♂️ **Using Registry Explorer** #### 🔍 **Opening a Registry Hive** 4. Click on `File` → `Load Hive` 📂. 5. Select a registry hive (e.g., `NTUSER.DAT`, `SYSTEM`, `SOFTWARE`). 6. View the parsed structure instantly! #### 🕵️ **Searching the Registry** 7. Press `Ctrl + F` or click on `Find` 🧐. 8. Enter your search term (e.g., `LastWrite`, `MRUList`). 9. Filter results using **regex** and wildcards! #### 📤 **Exporting Data** 10. Right-click on a key or value. 11. Select `Export` → Choose **CSV, JSON, or XML** 📊. 12. Save it for forensic reports. ## ⚡ **Command-Line Power: RECmd** Registry Explorer also includes a command-line counterpart: **RECmd**! 💻 ```powershell RECmd.exe -f C:\Windows\System32\config\SYSTEM -p output_folder ``` ✅ **Batch processing** & automated registry parsing! ## Valuable Hive values ### **Important Digital Forensics Artifacts in Windows Registry Hives** When analyzing Windows registry hives from a **digital forensics perspective**, certain keys and values provide crucial information regarding user activity, security settings, and system configurations. --- ## **1. SAM (Security Account Manager) Hive** 📌 **Location**: `C:\Windows\System32\Config\SAM` 🔍 **Key Forensic Values**: |Key|Value|Description| |---|---|---| |`SAM\Domains\Account\Users\Names\`|**Username**|Lists local user accounts.| |`SAM\Domains\Account\Users\`|**RID (Relative Identifier)**|Identifies user accounts, each having a unique **RID**.| |`SAM\Domains\Account\Users\%RID%`|**V (Hashed Password Data)**|Stores **NTLM** and **LM** password hashes (encrypted).| |`SAM\Domains\Account\Aliases\Names\Administrators`|**Group Membership**|Lists users in the **Administrators** group.| |`SAM\Domains\Account\Aliases\Names\Users`|**Standard Users**|Lists standard user accounts.| |`SAM\Domains\Builtin\Aliases`|**Aliases**|Stores security identifiers (SIDs) and group membership information for built-in Windows groups, such as Administrators, Users, and Guests.| --- ## **2. NTUSER.DAT Hive** 📌 **Location**: `C:\Users\%USERNAME%\NTUSER.DAT` (Per User) 🔍 **Key Forensic Values**: |Key|Value|Description| |---|---|---| |`Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs`|**Recent Documents**|Tracks recently opened files (timestamps).| |`Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU`|**Run Command History**|Records executed commands in the **Run dialog** (Start > Run).| |`Software\Microsoft\Windows\CurrentVersion\Search\RecentApps`|**Recent Applications**|List of recently used programs.| |`Software\Microsoft\Windows\Shell\Bags` & `BagMRU`|**Folder Views & Accessed Locations**|Stores details about accessed folders.| |`Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths`|**Typed Paths**|URLs and paths typed in Windows Explorer.| |`Software\Microsoft\Windows\CurrentVersion\Run`|**Auto-Start Programs**|Lists programs that launch at startup.| |`Software\Microsoft\Windows\CurrentVersion\RunOnce`|**One-Time Startup Programs**|Executes once at next login.| |`Software\Microsoft\Windows\CurrentVersion\Uninstall`|**Installed Programs**|List of installed applications.| |`Software\Microsoft\Internet Explorer\TypedURLs`|**Internet Explorer History**|Tracks URLs typed in **Internet Explorer**.| |`Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2`|**USB Device History**|Tracks connected USB devices.| |`Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist`|**User Activity Logging**|Contains obfuscated user activity (program execution).| |`Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell`|**Custom Shells**|Can indicate malware persistence.| |`Software\Microsoft\Windows\CurrentVersion\Policies\System`|**User Rights & Restrictions**|May indicate disabled features like **Task Manager, CMD, Regedit**.| --- ## **3. SYSTEM Hive** 📌 **Location**: `C:\Windows\System32\Config\SYSTEM` 🔍 **Key Forensic Values**: |Key|Value|Description| |---|---|---| |`ControlSet001\Services\`|**Installed Services**|Lists system services, including malware-created ones.| |`ControlSet001\Control\Session Manager\BootExecute`|**Auto-Execute Programs at Boot**|Can contain malware-related persistence.| |`ControlSet001\Control\Session Manager\Environment`|**Processor Architecture**|Specifies the CPU architecture of the system (e.g., `AMD64` for 64-bit or `x86` for 32-bit).| |`ControlSet001\Control\ComputerName\ComputerName`|**Computer Name**|Stores the current name assigned to the computer.| |`ControlSet001\Control\TimeZoneInformation`|**Timezone Settings**|Useful for timeline analysis.| |`ControlSet001\Enum\USBSTOR`|**USB Storage Devices**|Records connected USB devices (Vendor ID, Product ID, Serial Number).| |`ControlSet001\Services\Tcpip\Parameters`|**Network Configuration**|IP addresses, DNS servers, DHCP settings.| |`ControlSet001\Services\Tcpip\Parameters\Interfaces\<GUID>`|**Network Configuration**|Contains network settings for a specific network adapter, including IP addresses, DHCP settings, and gateway information.| |`ControlSet001\Services\LanmanServer\Shares`|**Shared Folders**|Lists network shares.| |`ControlSet001\Control\Lsa\Audit\AccountLogon`|**Security Auditing Settings**|Can show if login audits are enabled.| |`ControlSet001\Control\CrashControl`|**Crash Dump Settings**|Configurations for system crash dumps.| |`ControlSet001\Enum\Root\LEGACY_`|**Legacy Drivers**|Can indicate rootkits or leftover malware.| --- ## **4. SOFTWARE Hive** 📌 **Location**: `C:\Windows\System32\Config\SOFTWARE` 🔍 **Key Forensic Values**: |Key|Value|Description| |---|---|---| |`SOFTWARE\Microsoft\Windows NT\CurrentVersion`|**System Root**|Specifies the root directory of the Windows installation (e.g., `C:\Windows`).| |`SOFTWARE\Microsoft\Windows NT\CurrentVersion`|**Edition ID**|Indicates the edition of Windows installed (e.g., `Professional`, `Enterprise`, `Home`).| |`SOFTWARE\Microsoft\Windows NT\CurrentVersion`|**Product Name**|Displays the full product name of the installed Windows version (e.g., `Windows 10 Pro`).| |`SOFTWARE\Microsoft\Windows NT\CurrentVersion`|**Current Build**|Specifies the build number of the Windows OS (e.g., `19044` for Windows 10 21H2).| |`SOFTWARE\Microsoft\Windows NT\CurrentVersion`|**Current Version**|Displays the major and minor version of Windows (e.g., `10.0`).| |`SOFTWARE\Microsoft\Windows NT\CurrentVersion`|**Install Date**|Stores the installation date and time of the OS in **Unix Epoch format** (convert it to a human-readable date).| |`SOFTWARE\Microsoft\Windows NT\CurrentVersion`|**Registered Owner**|Displays the name of the user or organization that registered Windows.| |`SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI`|**Last Logged On User**|Stores the username of the last account that successfully logged into the system.|