Welcome back to Course 2,
section 3 of Windows registry forensics.
In this section, we're going to learn how
to locate the registry hives within
an image file and
we're going to learn how to export these hives so we
can examine them with
other tools which we downloaded in the last section.
Just a quick recap of what we've
covered so far in this course.
In section 1, we looked at
the live registry files and then in section 2,
we prepared our environment for examining the registry.
In this section, we're going to be using FTK Imager,
Registry Browser, and the Windows 10 VMDK file.
The first thing I'd like you to do is go to
your desktop and make two folders.
I want you to name one of the folders
FTK rge files and the other folder RB rge files.
The next thing we're going to do
is we're going to go ahead and we're going to
start up FTK Imager.
Once you launch your FTK Imager,
we're going to go to File,
we're going to add an evidence item.
We're going to be adding an image file,
that Windows 10 VMDK.
You're going to click "Next". We're going to
browse to where you saved that file.
We're going to select the.vmdk
file and we're going to go ahead and open it up.
Then once you select it, you click "Finish",
and it will open it up.
We can see the name of
the file and that it is a forensic disk image.
The type is a VMware virtual disk image.
It also gives you some other drive geometry in here.
I'm going to expand that.
We're going to expand partition
2 because that is where the operating system is.
We're going to go ahead expand the no-name.
We're going to expand the root,
and we're going to start with the Windows folder.
I'm going to expand the Windows folder.
I'm going to navigate down to System32.
We're going to expand System32
and now we want to find the config folder.
We're going to find and highlight the config folder.
Once we've highlighted the config folder,
you can see the screen on the right is populated.
We want to find our registry files of interest.
We're looking for our SAM,
security, and software files.
We want to highlight each of these files.
If you hold down your control key,
you can highlight more than one file, SAM,
security, software,
and now we need to scroll down to get the system file.
Once you have all four of these files highlighted, SAM,
security, software, system,
we're going to go ahead and right-click.
We're going to export these files.
I want you to go ahead and go to
your desktop and we're going to find that file,
which would be the FTK rge files.
Select the FTK rge files, and click "Okay".
We're going to see that we exported
no folders and five files successfully.
Now if you'd like to, you can go ahead out to
your desktop and make sure that the files are
there. How you do that?
Very easily you just go ahead and go out to your desktop,
you locate FTK rge files,
and we can see that we have those files.
Somehow I got components too.
We don't need components.
But you should have SAM,
security, software, and system in this folder.
Once you've done that,
we're going to go back up to the top of FTK.
Go ahead and just collapse that
so we have a clear screen.
We're going to expand that again.
Expand no-name, collapse Windows,
and we want to look at the users folder now.
We want to go to the users folder.
I'm going to ahead and expand users,
and the user we're interested in is Ivan.
We're going to go ahead and expand Ivan's folder.
Now, go ahead and highlight
Ivan's folder and in the right pane we can see we
have a whole lot of things
under the user Ivan but what we're
looking for is the NTuser.dat file.
Once you've located that right-click,
you're going to export files,
and you're going to go back to your
desktop and we're going to
find our FTK rge files
and you're going to click "Okay"
and it exported that file out to that folder.
Now we're going to take another one from Ivan.
We want Ivan's userclass.dat
and where that's located is under Ivan,
we're going to expand App data,
we're going to expand Local,
we're going to expand Microsoft,
and then we're going to highlight Windows.
Then we're going to go to the pane on the right and we
want the userclass.dat file.
We're going to right-click again, export files.
It brings us back to our desktop, FTK rge files.
Is the folder we're going to select
and we're going to click "Okay".
Now, if we go look at our folder
again,
FTK rge files.
Now we should have NTuser, SAM,
Security, Software, System and userclass.dat.
We're going to take one more folder.
We want to collect the Amcache file and
this one is going to be located
under the Windows directory.
We're going to expand the Windows directory,
we're going to expand Appcompat here.
We're going to expand Appcompat
and go ahead and highlight programs.
You can see that we have the Amcache hive here.
Well, in this particular case,
we're going to need these log files also.
What we're going to do is we're going to right-click on
the folder and we're going to say export files.
We're going to go back and select
our FTK rge files and we're going to click "OK".
This time it tells us that it copied two folds and
nine files and we're going to say ''OK''.
If you were to go back out and look
on your desktop again,
that program's folder has been
exported and we can
see our Amcache files and our Log files.
This is what we really need.
If you want to you can go ahead and delete
the install file or just leave it.
It doesn't really matter for our purposes.
We've successfully exported
our registry files using FTK imager.
There is another tool that we want to
utilize called Registry browser.
Registry browser will only accept the Windows folder.
We have to export the files with
the full path which we're not able to do with FTK imager.
But we do have a way to do that using Registry browser.
The first thing we're going to need to do is we need to
mount the Ivan image file.
We're going to go to image mounting
and once that comes up we're going to
navigate to where we have
our Ivan VMDK file where you save that file out to.
You're going to select the W10.VMDK
and we're going to choose Open.
Now, how are we going to mount it?
We're going to go ahead and do physical and logical.
I'm going to choose a specific drive letter.
You can use next available if you'd like.
Now, we can't use block device,
we have to use block device readable,
what this is going to do is create a cache folder.
It's not going to write to our image file.
It's going to create a cache folder
and write to that cache folder.
Once you've done all this,
then go ahead and click "Mount".
This will take a second, don't worry about it.
Once the file has mounted,
we can see our drives.
We can see we have physical drive 11,
logical drive R is partition one,
logical drive S is partition two.
Whatever your partition two logical drive is,
that's the one we're interested in.
So make a note of that drive letter.
We can go ahead and close the screen.
Go ahead and minimize FTK imager.
Don't close FTK imager,
minimize it, and now
we're going to launch Registry browser.
It's that yellow cube.
It's Registry browser version three, just double-click.
A license agreement will come up,
I agree and Registry browser will go ahead and open up.
Now we want to open the Registry.
We have to navigate to where that file is,
where that particular drive mounted to.
In my computer, if you remember,
it was S. On yours, it may be different.
Once we've located the drive,
expand it, navigate to the Windows folder.
Once you've highlighted the Windows folder, click "Okay".
This error message will come up, just click "Okay".
Now, we can see in Registry Browser,
we actually see it looks a little
more like regedit than FTK did,
we have the HKEY_ LOCAL_ MACHINE and the HKEY_ USERS.
You can expand them and you'll see the Software,
Sam, Security, System,
you'll also see the components and the BCD.
Under the user's key,
you will see all the users on the computer.
What we're going to do here is we want to export
these files with their full path,
the registry files with their full path.
We're going to click on "Tools",
and we're going to click on "Skeleton Copy".
What Registry Browser will allow us to do
is make a copy of these files.
Now, we don't want all of these,
we just want the ones that are relevant to us.
We're going to keep Sam, Security, Software, System,
we're going to get rid of components,
give it a BCD, unclick all of these.
We do want Ivan's ntuser.dat folder,
so we're going to leave that.
We do want Ivan's UsrClass.dat folder,
so I'm going to leave that.
Everything past Ivan's UsrClass.dat folder,
we're going to go ahead and uncheck.
If we do need these folders,
we can always come back and get them.
But for right now, I don't want you
to have a lot of clutter in your folder.
What we should have selected Sam, Security, Software,
System, ntuser.dat, and UsrClass.dat.
Once you've got that selected,
go ahead and click "Okay".
It's going to tell you
how much space is going to take up.
Let's go ahead and click "Yes".
Again, we're going to navigate
back to our desktop
and you should already have let folder pre-created.
If you don't, you can go
ahead and make a new folder.
We're going to name this folder RB_reg_Files.
If highlight desktop, make new folder,
and we're going to name it RB_reg_Files.
Click "Okay", and it's
going to go ahead and export those files out.
Then go ahead and close it.
Again, we can go back to our desktop,
we'll go and look at RB_reg_Files.
Once you've located RB_reg_Files,
go ahead and open it up, and you're going to see
two folders and there are users and Windows.
You're going to see Ivan's ntuser.dat,
and we're going to see Ivan's UsrClass.dat.
Under the Windows folder.
You'll going to see the full
path and we're going to see Sam,
Security, Software, and System.
These are the files we're going to need
throughout this course.
Now, once we've done that,
we're going to go ahead,
and for now, we're going to close Registry Browser.
We're going to bring back up FTK Imager.
We're going to go to File,
Image Mounting, and we need to unmount these images.
We're going to highlight all of these.
You can use the Shift key to do that,
the Control key or whoever you'd like to.
But once you get them all highlighted,
we're going to go ahead and click 'Unmount",
and it will unmount those files.
Once that's done, you can go ahead and close that up.
You can go ahead and close FTK Imager for now.
In the next section,
we're going to go ahead and look at
some key registry values we need to look at
before we can start our registry examination.
We need to know what type
of operating system we're looking at,
and we need to know what time zone we're in,
so we are going to locate those keys in
the next section and we're going to
do that using autopsy.