Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

FOR 500 - GIAC > 500.2 - Windows Registry > Flashcards

500.2 - Windows Registry Flashcards

1
Q

<p>Overall System Hives</p>

A

<p>- SAM - Local user acounts &amp;amp; groups (not admin)

- SECURITY - Security info utilized by SAM &amp;amp; the OS (password policy, group memberships)
- SYSTEM - Hardware and service config, raw device names &amp;amp; drive (USB keys)
- SOFTWARE - All application settings
- AMCACHE.HVE - Application Compatibility &amp;amp; Tracking exe's
- NTUSER.DAT - Config &amp;amp; enviromental settings (SPECIFIC user activity)</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

<p>Root Keys</p>

A

<p>- HKEY_CLASSES_ROOT, HKEY_CURRENT_USER, HKEY-LOCAL_MACHINE (S,S,S&amp;amp;S), HKEY_USERS</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

<p>Backup Hives</p>

A

<p>- SAM, DEFAULT, SYSTEM, SOFTWARE, &amp;amp; SECURITY

- %WinDir%\System32\Config\ RegBack
- RegIdleBackup</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

<p>User Registry Hives</p>

A

<p>- NTUSER.DAT - SPECIFIC user activity - (HKEY_CURRENT_USER)

- C:\doc &amp;amp; settings\username\NTUSER.dat &amp;amp; C:\username\NTUSER.dat
- USRCLASS.DAT - Program exe by user - - folders opened and closed
- Virtualized in Registry in NTUSER.DAT/Software/Classes &amp;amp; HKCU/Software/Classes
- C:users\username appdata\local\microsoft\windows\userclass.dat</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

<p>Reg. Keys and Values</p>

A

<p>- Keys: Similar to folders (keys) &amp;amp; subfolders (subkeys) - Produces a folder | directory hierarchy - Values: Data stored within a key - Data in the form of Stings, binary data, integers, lists - Most valuable forensic data is found</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q
A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q
A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Offline Registry Viewing

A
  • Offline - NTUSER.DAT
    • NTUSER.DAT\software\microsoft\windows\currentversion\run
  • Online - HKCU
    • HKCU\software\microsoft\windows\currentversion\run
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Registry Hive Transaction Logs

A
  • Most recent Hive activity not written in Registry (1hr)
    • .Log1
    • .Log2
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Registry Key Last Write Time

A
  • All KEYS have

- Time stored in UTC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Most Recently Used Lists (MRU)

A
  • Provides the order of artifact (newest to oldest)

- (0,16,18,1,15,13,14)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Deleted Registry Keys/Values

A
  • Regs Hives have unallocated space for deleted files
  • Keys that are possible recovery
    • Keys
    • Values
    • Timestamps
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

cafae.exe

A
  • Automates Registry extraction
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

SAM

A
  • Username
    • Relative ID or RID = a #
    • Login Info - Last login, failed login, logon count, password policy, acct. creation
    • Groups info - Admins, users, RDP users

** Local Accounts Only - NOT domain accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Profile Local Users

A
  • Lists the local accounts of the system & their equivalent security IDs
  • Discover the username & RID (helps map ID # to usernames)
  • SAM\Domains\Accounts\Users\
  • Last Login
  • Last failed login
  • Logon count
  • Password policy
  • Account creation time
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

SAMInside

A
  • Used to determine if a password is Empty (31D6CFE0D16AE931B7)
  • Is the password required
  • Has NTLMv2 Password
  • Has LanManager Password
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Examining System Configurations

A
  • Systems
  • Software
  • Security
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

ID Microsoft OS Version

A
  • Determine Versions, Service pack, install date/time, OS
    • Install date in EPOCH TIME (convert to hex)
    • Install time is in Win time
  • Key Location:
    • SOFTWARE\Microsoft\Windows NT\Current Version
19
Q

Identify CurrentControlSets

A
  • Identifies which control set is current
  • Contains info about the systems config settings
  • “Data # 1 = “Last Known Good Set”
    • CurrentControlSet001 - Controlset that just booted
    • CurrentControlSet002 - Last known good version
  • Key Location:
    • SYSTEM\Select\Current
20
Q

Computer Name

A
  • SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
21
Q

Time Zone Information (UTC Time)

A
  • Found in the Cuurent Good control set

- SYSTEM\CurrentControlSet\Control\TimeZoneInformation

22
Q

NTFS Last Access Time On/Off

A
  • Updates when the system touches a file -> not always when a user accessed a file
    • NtfsDisabledLastAccessUpdate -> 0x1 = Timestamps are off
  • Key Location:
    • SYSTEM\CurrentControlSet\Control\Filesystem
23
Q

Network Interfaces

A
  • Identifies the computers network interface card
  • TCP/IP info configured, IP, gateway, DCHP IP (subnet mask DHCP server IP)
  • Key Location:
    • SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces
24
Q

Historical Networks

A
  • Identify Network that the computer has been connected to
  • Network List Keys
  • Ntwrks, Domain, SSID,MAC, LOC Awareness
25
Q

ProfileGuid

A
  • Determine First & Last network in SOFTWARE Hive (Network Profile Key)
26
Q

Network Profiles Key

A
  • Idenitfy the types of Ntwrks & wireless SSIDs - Local Time
    • SOFTWARE\Microsoft\Windows NT\CurrentVersion\Networklist\Profiles (Win10)
    • Wireless = 0x47
    • Wired = 0x06
    • Broadband (3g) = 0x17
27
Q

Geo-Location of MAC Address/SSID

A

wigle.net

28
Q

Shares and Offline caching (CSC)

A
  • Lists the open network shares on the local system
  • Lists Flags and configuration settings
  • Key Location:
    • SYSTEM\CurrentControlSet\Services\Lamanserver\Shares\
29
Q

System Boot Autostart Programs

A
  • Determine programs that will start automatically
  • if Start Key is set 0x2 then service will start @ boot
  • Key Location:
    • SYSTEM\CurrentControlSet\Services
30
Q

TypedPaths

A
  • Manually Typed paths in the Start menu and Explorer Bar
  • Key Location:
    • NTUSER.DAT\Software\Microsoft\CurrentVersion\Explorer\TypedPaths
31
Q

RecentDocs via Registry Explorer

A
  • Most Recent used Docs
  • Key Location:
    • NTUSER.DAT\Software\Microsoft\CurrentVersion\Explorer\RecentDocs
32
Q

Microsoft Office RecentDocs

A
  • Provides the specific version of Microsoft Office used
  • Tracks last docs saved - Located in (FileMRU)
  • O365/LiveID syns all devices
  • Key Location:
    • NTUSER.DAT\Software\Microsoft\Office\Version
33
Q

Win7/8/10 Search History

A
  • WordWheelQuery - Win7 records searches of programs/files (Start menu & Explorer folder/ Search) - Prove File Knownledge
    • Win 8/8 - Explorer Search Bar
  • Key Location:
    • NTUSER.DAT\Software\Microsoft\CurrentVersion\Explorer\WordWheelQuery
34
Q

Office 365/2013 File MRU Keys

A
  • File Path, Last opened, Last closed (reading location)

- Key Location:

35
Q

LastVisitedMRU

A
  • Last file path opened & exe used
36
Q

OpenSaveMRU

A
  • Save/Open shell dialogue box & last file opened/save by a specfic extension
37
Q

Last Visited

A
  • exe used by app to open files in OpenSaveMRU
38
Q

Office 365/2013 File MRU Keys

A
  • File Opening / Creation
  • File Path, Last opened, Last closed (reading location)
  • Place MRU just shows the folder location where the file was opened
39
Q

Last Commands Executed (WinXP - 8)

A
  • Tracks cmds exe from the RUN dialog box (RunMRU)
40
Q

UserAssist KeyTracks

A
  • Shows that last time of execution as well as the number of times a program was execute
  • Located in the NTUSER.dat hive
  • Last run time, Run count, Name of GUI, Focus time (how long open), Focus Count (activity)
41
Q

Application Compatibility Cache

A
  • checks to see if the application needs to be “shimmed” (properties applied) to run an applications on the current OS
  • Detect program capability challenges when a program launches (choose the right mode/OS)
  • looks at the AppCompactCache reg key to see if a program needs shimming
  • ShimCache
  • Tracks a files last las mod data, file path, file size, and when it was exe
  • XP +
  • Different Modes = Shims
  • Located in the System hive
42
Q

AppCompactCache

A
  • Figuring out if a program needs shimming for compatibility
  • exe’s last mod date, file path, & fize … last executed (XP)
  • Reads the Shim Cache stored in Win reg
  • AppCompactCache exe History - ShimCacheParser.py
43
Q

Application Compatibility Cache:

A
  • Entry for every exe run, full path, file’s standardinfo, last mod time, disk volume, SHA1 hash
  • Can attribute actions to specific users
  • Amcache.hve

FOR 500 - GIAC (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions