>> Hey everyone, welcome back to the course.
In the last video, we talked
about collecting volatile data.
In this video, we're going to talk
about non-volatile data.
Some of the non-volatile information
we would want to grab is going to be
a registry information as well as information from ESE,
which is the extensible storage engine.
Windows registry and this
is something that you'll definitely want to
know pretty well in depth for the exam,
you might see many things
tested about the Windows registry by chance.
Some of the common things you'll want to
know are this HKEY_CLASSES_ROOT,
CURRENT_USER, LOCAL_MACHINE,
USERS, and CURRENT_CONFIG.
HKEY_CLASSES_ROOT,
basically this one ensures a correct program opens
when executed so hence the name root there
if you think of the Linux systems.
Drag and drop rules is what it contains
as well as information
about shortcuts and the user interface.
HKEY_CURRENT_USER as the name implies,
it shows information about the current logged in user.
Local machine specifies hardware-specific information
and then also shows the mounted drives.
HKEY_USERS contains information about all the users.
Notice the differentiation between
current users and just users.
CURRENT_CONFIG just shows you
the system's current configuration.
Some of these are easy to know what it's talking about.
Other areas of the registry that you're
going to want to be familiar with
and these paths you're just going to want
to focus on the last couple of things in the path,
so for example, with share names,
you'll just want to know like services and
then Lanman server and then shares.
You don't necessarily need to memorize HKLM system.
For the most part, that's probably not going to
change if they're testing it on the exam,
but what will change is the last chunks of those.
For example, like with time zones,
you'll just want to make sure you know
its current control set,
control on the time zone information, the pre-fetching,
you'll just want to know a session manager and
memory management, pre-fetched parameters, etc.
Again, just remember the last half of those
and that'll help you on the examination,
just in case it's tested.
Wireless service set identifier or SSID.
This is how you can identify the wireless networks.
Says we go to Starbucks,
or we go to the store or whatever the case might be,
our device or a laptop,
it's identifying those by the SSID.
One thing again here
you'll want to keep in mind is this path.
You'll just want to know basically
from the WZCSVC forward.
Again, we're just memorizing
>> that last half of the path.
>> Different types of registry tools,
not an all inclusive list,
but these are some of the common ones,
that you may actually just see
mentioned if they ask about it on the exam,
so RegRipper, ProDiscover,
RegEdit, and RegScanner.
The extensible storage engine,
this is related to email.
If you see anything about it on the exam,
you think of it in the context of email,
and then basically the files have a .edb extension,
so you also want to memorize that as well.
In this video, we'll come to talk to
them very high level of
some non volatile data
and different ways we can look for it.
In the next video, we're going to go
with basically some browser pass,
things like Firefox, Google Chrome.
Again, these are just some process you'll
want to memorize for the exam.
You may see different things about it.