Registry Hives

..................................................................................................................................................

The following registry keys are extracted and reported on by OnScene LHF. Many of these registry keys are a source of  valuable evidence during computer forensic investigations.

OnScene LHF will allow you to add your own registry keys. This can be useful for software licensing audits.

Registry Location:

NTUSER.DAT

Key Location:

\Software\Microsoft\MessengerService\ListCache\.NET Messenger Service

Description:

Contact, allow, block, reverse entry information

..................................................................................................................................................

Registry Location:

NTUSER.DAT

Key Location:

\Software\Microsoft\MessengerService\ListCache\.NET Messenger Service Identity Name

Description:

Last logged in user Screen Name

..................................................................................................................................................

Registry Location:

NTUSER.DAT

Key Location:

\Software\Microsoft\ProtectedSystemProvider\SID\Identification\INETCOMM Server Passwords

Description:

Outlook/Express account passwords

..................................................................................................................................................

Registry Location:

NTUSER.DAT

Key Location:

\Software\Microsoft\Office\version\Outlook\Security

Description:

Location of stored attachments

..................................................................................................................................................

Registry Location:

HKLM

Key Location:

\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards

Description:

Installed network cards

..................................................................................................................................................

Registry Location:

NTUSER.DAT

Key Location:

\Software\Miccrosoft\MSNMessenger\ FTReceive Folder

Description:

Location of received files

..................................................................................................................................................

Registry Location:

NTUSER.DAT

Key Location:

\Software\Microsof\MessengerService ContactListPath

Description:

Location of saved Contact List (.ctt)

..................................................................................................................................................

Registry Location:

NTUSER.DAT

Key Location:

\Software\Microsoft\MSNMessenger\FileSharing Autoshare

Description:

Sharing on/off

..................................................................................................................................................

Registry Location:

NTUSER.DAT

Key Location:

\Software\Microsoft\MSNMessenger\PerPassportSettings\MessageLog Path

Description:

Locatin of message history files

..................................................................................................................................................

Registry Location:

NTUSER.DAT

Key Location:

\Software\Microsoft\MSNMessenger\PerPassportSettings\MessageLoggingEnabled

Description:

Messaging logging on/off

..................................................................................................................................................

Triage LHF module reports on this key

194 Registry Hives: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20    [ view all ]

Computer Forensics Experts

Creating an Image with OSI

Previewing PST Files

On Scene Computer Forensics

Copy with MD5 report

Windows Recycle Bin

Computer Forensics For Apple Mac

Viewing the Internet Cache

Registry Hives



Using OnScene Investigator

Using Registry LHF

Down Data Sheet

Uses for OnScene Investigator

Project Roadmap



Find a Reseller

Become a Reseller




Training Certification


 
 
 
Home I Site Map I About Us I Help I Terms & Conditions
Copyright 2007 www.forensicsmatter.com All Rights Reserved.