Welcome to Course to section two of Windows registry forensics.
In this section we're going to cover preparing our examination environment.
Were going to be setting up specialized software to view the registry files.
The first thing I'd like everybody to do is go ahead and go to this link and you
can download this document here, and it's going to be called Software_Tools.txt.
And what we're going to use this document for is to go to all the websites where we
can download these tools, we're going to need to examine the registry.
So once you download the document you can simply copy and paste the addresses into
your internet browser instead of having to type them all out.
If you don't already have seven zip installed on your computer,
please go ahead, copy that out.
Go to that website and download seven zip because we're going to need it for
some of the tools we're going to be extracted.
The first website we're going to go to is going to be the sleuthkit autopsy.
So go ahead and copy and paste that into your browser,
it's going to bring you to the autopsy website.
You can go ahead and download from here, when you click on that,
it's going to bring you to either 64 or 32-bit download.
For Windows there is a Lennox product, but hopefully you're working
in a Windows environment because a lot of these tools will only work on Windows.
So you go ahead and download and install that, the installer will walk you through.
Once you've completed that,
go ahead and go to the next web address,
github.com to give you the add-ons for
those tools if you would like them.
So you would go ahead and copy paste that in your browser.
And that's going to take you out to the additional modules,
the 3rd party modules for autopsy.
And then you would download the zip file, and
follow the directions here on how to install those modules.
Once you've completed that,
the next website we're going to go out to is Eric Zimmerman.
And here are his tools, okay?
We're going to take a few tools from here,
we're going to start with the AmcacheParser.
So you go ahead and click on it, and you'd see the AmcacheParser.zip come up.
You would say that and then walk through the installer,
you're going to have to extract that.
And this is where seven zip comes in because these programs will not
extract well with the Windows extractor, so please use seven zip.
We're going to take the AppCompactcacheParser,
follow the same procedures you did for AmcacheParser.
Then we're going to scroll down here, and we're going to extract Registry Explorer.
And then we're going to extract ShellBagExplorer.
So go ahead, once you just click on the links,
you download unzip them, extract the files,
and walk through the setup.
Once you do have all that done,
what I'd like you to go ahead and
do is run autopsy, so
we can get that started.
So once you've downloaded, install all the tools, go ahead and run autopsy.
Once you get that started, I'd like you to go out and download.
Locking codes, registry browser.
So again you would copy that into your search bar, and
you download in the stall locking codes, registry browser.
You need to click here, its registry browser version 3.11a.
And again you would follow the same process,
you're going to download, extract that, and
install it, walk through the installer.
Once we finished registry browser, you want to go ahead and install RegRipper.
And github, you can either Kelowna download, we go ahead and
download the zip.
When you click on that it's going to do the exact same thing as another zip files,
extract them using seven zip.
Walk through the installers,
then we're going to go to access datas ftk-imager,
and paste that into your browser.
What you're going to come to from there, it's the download site.
When you hit this download now button, it's going to take you to another page
where you're going to have to fill out your information.
Once you fill out your information, make sure you click yes to Opt in to email or
you won't get the email with the link to download ftk imager.
So you are going to have to check yes, you can unsubscribe later on.
And once you've done that, what you're going to do is you're going to
get an email from access data, you would click the link to download fbk-imager.
It'll take you out and it is the exact same process here, it's a zip,
download and extract it, and walk through the installer.
The next thing we're going to need is decode from digital-detective.net.
This is what it's going to look like.
You're going to click on download decode, and again you're going to have
the same zip file, you will extract it using seven zip, install it.
Then we just have one more piece of software we need, which is
going to be the Karen Hasher because we're going to need to do some hashing.
So once you copy and paste it your browser,
we're going to come to Karen Hasher site.
Please pick the first one,
the new setup and the same thing,
you're going to extract it, install it.
And once we've done all that,
go ahead back out to that link, that DropBox link.
And we're going to download the Windows 10 virtual machine image,
that dot VMDK-image.
And if you already created a case in autopsy,
we're going to go ahead and add that to our case in autopsy.
And in the next section,
we're going to take a look at these files as they exist in the file system.
And we're going to export the files out, so
we can examine them with some of the tools we just downloaded.