Registry Hives

..................................................................................................................................................

The following registry keys are extracted and reported on by OnScene LHF. Many of these registry keys are a source of  valuable evidence during computer forensic investigations.

OnScene LHF will allow you to add your own registry keys. This can be useful for software licensing audits.

Registry Location:

NTUSER.DAT

Key Location:

\Software\Yahoo\Pager Eoptions String

Description:

Yahoos Encrypted password

..................................................................................................................................................

Registry Location:

NTUSER.DAT

Key Location:

\Software\Yahoo\Pager Save Password

Description:

Details on if the password is saved yes/no

..................................................................................................................................................

Registry Location:

NTUSER.DAT

Key Location:

\Software\Yahoo\Pager Yahoo User ID

Description:

Yahoo's last logged user

..................................................................................................................................................

Registry Location:

NTUSER.DAT

Key Location:

\Software\Yahoo\Pager\FileTransfer

Description:

Number of file transfers

..................................................................................................................................................

Registry Location:

NTUSER.DAT

Key Location:

\Software\Yahoo\Pager\IMVironments

Description:

Yahoo's environment uses

..................................................................................................................................................

Registry Location:

NTUSER.DAT

Key Location:

\Software\Yahoo\Pager\Profiles\Screen_name

Description:

Registed screen names/identities used in Yahoo

..................................................................................................................................................

Registry Location:

NTUSER.DAT

Key Location:

\Software\Yahoo\Pager\Profiles\screen_name\All Identities Selected Identities

Description:

Other user identities

..................................................................................................................................................

Registry Location:

NTUSER.DAT

Key Location:

\Software\Yahoo\Pager\Profiles\Screen_name\Archive

Description:

Message archive settings

..................................................................................................................................................

Registry Location:

NTUSER.DAT

Key Location:

\Software\Yahoo\Pager\Profiles\screen_name\Chat

Description:

Visited and/or created Chat Rooms

..................................................................................................................................................

Registry Location:

NTUSER.DAT

Key Location:

\Software\Yahoo\Pager\profiles\screen_name\FileTransfer

Description:

File transfer settings

..................................................................................................................................................

Triage LHF module reports on this key

194 Registry Hives: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20    [ view all ]

Computer Forensics Experts

Creating an Image with OSI

Previewing PST Files

On Scene Computer Forensics

Copy with MD5 report

Windows Recycle Bin

Computer Forensics For Apple Mac

Viewing the Internet Cache

Registry Hives



Using OnScene Investigator

Using Registry LHF

Down Data Sheet

Uses for OnScene Investigator

Project Roadmap



Find a Reseller

Become a Reseller




Training Certification


 
 
 
Home I Site Map I About Us I Help I Terms & Conditions
Copyright 2007 www.forensicsmatter.com All Rights Reserved.