Welcome back to Windows registry forensics Course 3,
the NT user.dat hive,
Section 8, typed paths.
Before we get started,
let's take a look at what we've covered so far.
In Section 1, we covered the recent docs subkey,
and that showed us recently used documents.
In Section 2, we covered the typed URL subkey,
and those are URLs web addresses that
are typed into the Internet Explorer address bar.
In Section 3, we covered UserAssist,
and that becomes populated,
the more you use a program it'll go into UserAssist.
We covered recent apps which showed
us recently used applications,
and it even showed us some of the files that
were opened with those specific applications.
We covered the run and run once subkey,
which showed us programs that were set to run at
startup without any interaction from the user.
We saw the Com Dialogue 32 subkey in Section 6.
That showed us programs that were interacted
with through the Windows Explorer,
open save dialog box.
In Section 7, we covered the RunMRU,
which showed us programs that were run using
the Runbox located down by the "Start" button.
In this section, Section 8,
we're going to cover typed paths.
What this is going to show us is files or programs or
even directories that were
accessed by typing a file path into Windows Explorer.
This key will contain
an MRU order and a key last access date.
The tools we're going to use for
this section are going to be Registry Explorer,
Ivan's NT user.dat file,
RegRipper, and Registry Browser.
Let's do a quick demonstration
of how this key becomes populated.
If I were to go down and bring up Windows Explorer,
and I were to type in a path.
In this case, I'm going to
copy and paste just because it's easier.
You see the file path is going to a PDF document.
Once I hit "Enter",
it will open that PDF document,
which in this case is the Registry Explorer manual.
This is how you would access a file using typed paths.
I can also access a directory using typed paths.
What I would need to do would be
to type in here or cut and
paste the path to that particular directory.
It will take me there and show me
all the files and folders within that directory.
I could also execute a program by typing in
the full path and
the name of the executable file I wish to run.
As we can see, Registry Explorer,
which is what I typed in there, has opened.
So I'm able to launch a file,
I'm able to launch an application,
and I'm able to go to a specific directory.
Let's all open Registry Browser.
That was the little yellow cube.
Let's go ahead if you haven't already done so and
load in Ivan's hive.
We go to open Registry,
and then you would navigate to
Ivan's hive and go ahead and open that up.
The file path we're going to follow to get to
typed path is we're going to be in the NT user.
We're going to be in the user, software, Microsoft,
Windows, CurrentVersion, then Explorer,
and we're going to go down to the TypedPath subkey.
Then we click on that,
we can see that data populates
here on the right-hand side.
If we look at the typed path,
we can see that it's C. We can see
its System32 Config and Videos.
You can see in the bottom
the Hex and SQ representation of those.
Also, note the key date.
It's giving it to us in
local time and in UTC or GMT time.
If we were to look at Registry Explorer,
we can use our bookmarks,
Common, maybe we can't.
We're going to have to negotiate to it again.
Let's go to Software,
Microsoft, Windows, CurrentVersion, Explorer,
and then navigate to TypedPaths.
We can see again we have the same URL order,
and we can see down here we have
our last write timestamp is the same.
Now we've already run
RegRipper report for the Ivan NT user account.
Let's just take a look at
that report and see
what that has to say about typed URLs.
Since we know this is a big report,
we're going to do a Control F on our keyboard.
I'm going to use Control F,
and then we're going to type in
simply typed paths and click "Find",
and it will find the typed paths subkey for us.
We can see, we do have the same URL order,
but we can see again this January 1st, 1970 date.
Now we've already seen
the correct date in two other tools,
so we know there's something wrong with this date.
You might want to keep that in mind when you're using it
because we've seen an error now in
two different subkeys on the last write time.
This is why you always want to use
more than one tool to validate your findings.
We can take a look at another tool also, TypedPaths.
We can see down here that January 1st,
2020, 13:26:12, minus 5, it's in local time.
Well, we also saw that in Registry Browser.
We can be pretty sure that this is the
correct last write time of that subkey.
But again, this is one of
the reasons you always want to validate
your findings with more than one tool.
If you're finding discrepancies,
then we need to go look in the Hex.
We're going to look at
registry file structure in a later block,
and we will actually look at the hex and see
where some of these dates
and times are being pulled from.