Hack Like a Pro: Digital Forensics for the Aspiring Hacker, Part 5 (Windows Registry Forensics) « Null Byte :: WonderHowTo

Welcome back, my aspiring hackers!As I mentioned in earlier posts, the best hackers (or at least those not behind bars) have a keen understanding ofdigital forensics. If I am tasked to intrude upon an enemy's file server to retrieve war plans, such as inthis tutorial, it is essential to my country's (and my own) well-being that it not be traced back to me. Understanding digital forensics helps us to leave without a trace and never have a trail back to us or our employer.Although nearly all Microsoft Windows users are aware that their system has a registry, few understand what it does, and even fewer understand how to manipulate it for their purposes. As a forensic analyst, the registry can be a treasure trove of evidence of what, where, when, and how something occurred on the system.In this post, I want to help you to understand how the Windows registry works and what evidence it leaves behind when someone uses the system for good or ill.What Is the Registry?The registry is a database of stored configuration information about the users, hardware, and software on a Windows system. Although the registry was designed to configure the system, to do so, it tracks such a plethora of information about the user's activities, the devices connected to system, what software was used and when, etc. All of this can be useful for the forensic investigator in tracking the who, what, where, and when of a forensic investigation. The key is just knowing where to look.HivesInside the registry, there are root folders. These root folders are referred to as hives. There are five (5) registry hives.HKEY_USERS: contains all the loaded user profilesHKEYCURRENT_USER: profile of the currently logged-on userHKEYCLASSES_ROOT: configuration information on the application used to open filesHKEYCURRENT_CONFIG: hardware profile of the system at startupHKEYLOCAL_MACHINE: configuration information including hardware and software settingsRegistry StructureThe registry is structured very similarly to the Windows directory/subdirectory structure. You have the five root keys or hives and then subkeys. In some cases, you have sub-subkeys. These subkeys then have descriptions and values that are displayed in the contents pane. Very often, the values are simply 0 or 1, meaning on or off, but also can contain more complex information usually displayed in hexadecimal.Accessing the RegistryOn our own system—not in a forensic mode—we can access the registry by using theregeditutility built into Windows. Simply type regedit in the search window and then click on it to open the registry editor like that below.Information in the Registry with Forensic ValueAs a forensic investigator, the registry can prove to be a treasure trove of information on who, what, where, and when something took place on a system that can directly link the perpetrator to the actions being called into question. As a hacker, the registry can provide that evidence necessary to put you away in prison for quite awhile.Information that can be found in the registry includes:Users and the time they last used the systemMost recently used softwareAny devices mounted to the system including unique identifiers of flash drives, hard drives, phones, tablets, etc.When the system connected to a specific wireless access pointWhat and when files were accessedA list any searches done on the systemAnd much, much moreWireless Evidence in the RegistryMany hackers crack a local wireless access point and use it for their intrusions. In this way, if the IP address is traced, it will lead back to the neighbor's or other wireless AP and not them.For example, back in January 2012, an Anonymous member, John Borrell III, hacked into the computer systems of the Salt Lake City police department and the Utah Chiefs of Police. The FBI was called in to investigate and they traced the hacker back to the IP address of Blessed Sacrament Church's Wi-Fi AP in Toledo, Ohio. The hacker had apparently cracked the password of the church's wireless AP and was using it to hack "anonymously" on the Internet.John Borrell III/FacebookEventually, the FBI was able to find the suspect through various investigation techniques, mostly low-tech, exhaustive, detective work. It helped that John Borrell had bragged on Twitter of his success as a hacker. Eventually, Mr. Borrell was convicted and sentenced to two years in Federal prison.When the FBI tracked down Mr. Borrell and seized his computer, they were able to prove he had been connected to the church AP by examining his registry. The forensic investigator simply had to look in the registry at this location:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\ProfilesThere, you will find a list of GUIDs of wireless access points the machine has been connected to. When you click on one, it reveals information including the SSID name and the date last connected in hexadecimal. So, although Mr. Borrell initially denied his involvement with this hack, this evidence was conclusive and he eventually plead guilty.You can see in this screenshot below showing the perpetrator had connected to the "HolidayInnColumbia" SSID in November 2014.We will further explore how the registry can be used in digital forensics infuture tutorials, so keep coming back, my aspiring hackers, as we further explore the science and art of digital forensics! And if you want to start putting some of these tasks to work, make sure to check out mydigital forensics series for Kali, too.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 8 (More Windows Registry Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 1 (Tools & Techniques)Hack Like a Pro:Digital Forensics Using Kali, Part 1 (The Tools of a Forensic Investigator)News:Why YOU Should Study Digital ForensicsHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 11 (Using Splunk)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 9 (Finding Storage Device Artifacts in the Registry)How To:The Essential Skills to Becoming a Master HackerHow To:Become a Computer Forensics Pro with This $29 TrainingHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 6 (Using IDA Pro)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 12 (Windows Prefetch Files)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 2 (Network Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 7 (Windows Sysinternals)SPLOIT:Forensics with Metasploit ~ ( Recovering Deleted Files )Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 15 (Parsing Out Key Info from Memory)News:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 10 (Identifying Signatures of a Port Scan & DoS Attack)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 14 (Live Memory Forensics)News:What to Expect from Null Byte in 2015News:Airline Offers Frequent Flyer Miles to HackersHack Like a Pro:Digital Forensics Using Kali, Part 2 (Acquiring a Hard Drive Image for Analysis)Hack Like a Pro:Digital Forensics Using Kali, Part 3 (Creating Cases in Autopsy & Sleuth Kit)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 16 (Extracting EXIF Data from Image Files)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 13 (Browser Forensics)News:Becoming a HackerHow To:Why You Should Study to Be a HackerHack Like a Pro:How to Use the New p0f 3.0 for OS Fingerprinting & ForensicsHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 3 (Recovering Deleted Files)Hack Like a Pro:How to Hack Facebook (Facebook Password Extractor)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 4 (Evading Detection While DoSing)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 6 (Networking Basics)Hack Like a Pro:Getting Started with BackTrack, Your New Hacking SystemNews:Flawed Laptop Fingerprint Readers Make Your Windows Password Vulnerable to HackersNews:Sneaky! WhatsApp Adds Encryption to iCloud Backups on the SlyHacking Windows 10:How to Find Sensitive & 'Deleted' Files RemotelyHow To:Install a Persistant Backdoor in Windows Using NetcatHow To:Don't Get Caught! How to Protect Your Hard Drives from Data ForensicsNews:FIX WINDOWS 7 SLOW STARTUP TIMES...How To:log on Windows 7 with username & passwordNews:VARIOUS WINDOWS ISSUES RESOLVED BELOW...