Windows Registry and Hiding Suspects' Secret in Registry

Abstract

Windows registry, a central repository for configuration data, should be investigated for obtaining forensic evidences, since it contains lots of information that are of potential evidential value. Using some forensic tools, forensic examiners can investigate values of windows registry and get information can be forensic evidences. However, since windows registry contains huge amount of values and these values can be modified by users, suspect can hide his secret like password in registry values. In this paper, we discuss the basics of Windows XP registry and extract some registry entries related to forensic analysis. Finally, we show that some countermeasures are needed, listing up consideration items for hiding secrets in registry as suspect's viewpoint.