# Non-Volatile Memory Forensic Analysis in Windows 10 IoT Core
## 5 Forensic Evidence in Windows 10 IoT Core
### Registry  
This is one of the main sources of information on Windows systems, containing data regarding users and system configurations, hardware devices and applications installed. The information is organized in a hive form, which is divided into registry keys, sub-keys, and values. The common registries that are normally present in a Windows desktop operating system are also available in the IoT version. In fact, they are present in the three existing partitions, although only the ones stored in \"MainOS\" provide useful information, the rest of them are almost empty. The most relevant registries of both the system and users are listed and described below. * System registry hives: they are located in Windows/System32/config. * COMPONENTS: holds data associated with Windows Update configuration and status [45]. * DEFAULT: profile for the Local System account. Used by programs and services that run as Local System such as winlogon or logonui [46]. * DRIVERS: stores the drivers installed on the machine and their dependencies. * SAM: contains information used by the Security Accounts Manager. Among other data, it contains usernames and passwords. \begin{table}
\begin{tabular}{l l} \hline \hline
**File** & **Description** \\ \hline \$AttrDef & Describes the attributes supported on the volume. It is essential for the filesystem, since a file is a representation of these attributes. \\ \hline \$BadClus & Informs of the clusters that contain bad sectors. \\ \hline \$Bitmap & Contains the status of the clusters in the filesystem. \\ \hline \$Boot & Provides data with respect to the booting process such as the boot sector. \\ \hline \$I30 & Representation of the \$INDEX\_ROOT, \$INDEX\_ALLOCATION and \$BITMAP attributes. \\ \hline \$LogFile & Stores the transactions that have been performed in the system to allow their recovery after a failure. \\ \hline \$MFT & Most important file of all, as it is a table that contains information for every file and directory that has been stored in the filesystem. It is extremely useful in forensic investigations as it logs all the activities that have occurred, providing information regarding timestamps, attributes, names or how it was created, among other data. \\ \hline \$MFTMirr & File to allow the recovery of the MFT. \\ \hline \$Secure & Lists the security descriptors for the volume. \\ \hline \$TFX\_DATA & Contains transactional data. Corresponds to the \$LOGGED\_UTILITY\_STREAM, attribute, but some tools such as FTK Imager represents it as an independent file [43]. \\ \hline \$UpCase & Used to compare and sort filenames. \\ \hline \$Volume & Describes the characteristics of the volume, such as its identifier, label or version [44]. \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Metadata files in NTFS. Figure 6: Graphical view of \$MFT file content. * SECURITY: collects local security information used by the system and network. * SOFTWARE: stores program variables and settings that apply to all the device users. * SYSTEM: contains device drivers and service configurations, which are stored in control set form [47; 48]. * User registry hives: stored in the corresponding user directory and in Users\*user*\AppData\Local\Microsoft\Windows. * NTUSER.dat: stores personal files, preferences, and settings for each user [49]. * Userclass: used to record configuration information from user processes that do not have write permission to the standard registry hives. Information regarding shellbags is also stored here [50]. Some of the information that can be extracted from these registries is:  
* Device details, such as number of cores, amount of storage and memory. * Partitions on the system. * Location of the Default Application, Temp, Program Files and Common Files paths, among others. * Packages installed in the system. * Digital certificates. * Network profiles. * Bluetooth devices paired. * Mounted devices. * USBs connected. * Drivers installed. * Browser history and settings.