In this course we're talking about the Windows Registry.
In this module, we're going to talk about the location
of the Registry files within our forensic image.
The file path to find are SAM,
security, software, and system,
sometimes referred to as the 4Ss,
is going to be from the root,
the Windows directory,
System32 and then we highlight the config folder.
When we look to the right,
we can see our SAM,
security, software, and system
files listed in the files path.
We would be able to export these files using
a tool such as FTK imager.
Now, like I said,
each user on the system will have their
very own ntuser.dat file.
You're going to find that beneath the user's profile.
You would go to the root users,
expand the user's folder and then
highlight the user that you want to investigate.
Then, you look to the right and in the file list page,
you would see that user's ntuser.dat file.
Using FTK imager, you can export this file.
We'll get to do that in our walkthrough.
The UsrClass.dat file, again,
is specific to each user.
Every user will have one of these.
You would again drill down from root users,
locate the particular user that you are interested in,
then you would have to go to
app data and you expand app data.
You'd expand local,
then you scroll down and expand Microsoft.
Then you would highlight the Windows folder.
Then you would look to the right and the files pan.
You can see that particularly users UsrClass.dat file.
Again, you can use FTK imager to export the file.
If you're exporting multiple NT users
or multiple UsrClass.dat files,
I highly recommend that you name
them uniquely so that you know which is which.
The AmCache hive is a system file.
It's not part of the users like
the NT user or the UsrClass.dat,
and it's going to be located under the Windows directory.
So from the root,
we will expand Windows,
and then we would expand AppCompat,
and then we're going to highlight programs.
When you look to the right when the file was pan,
you would see the Amcache.hve file,
that is the AmCache hive file.
Again, you can export this using a tool like FTK imager.
Now we're going to do our registry walkthrough.
We're going to take a look at our image
and we're going to find
these files and export them using FTK imager.
So we're going to need
our Windows 10 VMDK and FTK imager.