Registry Analysis Using RegRipper

Digital and Cyber Forensics Labs – Registry Analysis Using RegRipper 1 Introduction The Windows registry is a critical component of Windows operating systems, yet it is likely the least understood component of a Windows system when it comes to digital analysis. The Windows registry stores a great deal of configuration information, including settings for various functions within the system. Additionally, the registry also maintains historical information about the user activity, details about the applications installed and accessed, and much more. All this data can be incredibly useful to a forensic examiner, especially when trying to piece together a timeline of the system and/or user activity. The registry is divided into Hives. A hive in the Windows Registry is the name given to a major section of the registry that contains registry keys, registry subkeys, and registry values. Hives hold information about user profiles, applications, configurations, network connections, printers, etc [1]. RegRipper works by pulling information from the supporting files of the Windows registry hive. The registry is divided into five hives namely: HKEY_CLASSES_ROOT: This hive contains information about registered applications and file associations. HKEY_CURRENT_USER: This hive stores settings that are specific to the currently logged-in user such as mapped network drives, keyboard layout etc. HKEY_LOCAL_MACHINE: This hive stores settings that are specific to the local computer. It has five subkeys which are commonly used for extracting evidence. SAM: This is used to reference the Security Accounts Manager databases for all domains into which the local system has been administratively authorized or configured. Security: This key is linked to the security database of the domain into which the current is logged on such as security policies. System: This key contains information about the Windows system setup such as mounted devices, filesystem-related information, etc. Software: This key contains software and windows settings. It is mostly modified by application and system installers. HKEY_USERS: This hive contains user-specific configuration for all currently active users on the computer. HKEY_CURRENT_CONFIG: This hive acts as a pointer to the registry key that keeps the information about the hardware profile currently being used. In this lab, we will use the tool RegRipper to extract information from the registry. 2 Overview RegRipper was created and maintained by Harlan Carvey. RegRipper, written in Perl, is the fastest, easiest, and best tool for registry analysis in forensics examinations. It is an open-source tool, written in Perl, for extracting/parsing information (key, values, data) from the registry and presenting it for analysis. RegRipper consists of two basic tools, both of which provide similar capabilities. The RegRipper GUI allows the analyst to select a hive to parse, an output file for the results, and a profile (list of plugins) to run against the hive. RegRipper also includes a command-line (CLI) tool called rip. Rip can be pointed against a hive and can run either a profile (a list of plugins) or an individual plugin against that hive. This lab focuses on locating inculpatory or exculpatory evidence on a Windows registry so that it may be presented in a court of law. You are a forensic analyst and you have been assigned a case. A first responding officer seized the hard drive of the computer and a crime scene evidence technician skilled in data acquisition made an image of the hard drive and the protected areas (registry) with FTK imager. You are given the registry hives and are expected to examine them for any evidentiary artifacts that might relate to this case using RegRipper. This lab makes use of RegRipper version 2.8 due to the variety of plugins it offers. If interested, you can check out the latest version of RegRipper (RegRipper 3.0) which is available on the website given below. This version also offers a GUI interface for easy usage. https://github.com/keydet89/RegRipper3.0 [2] While the required installer files and manuals are available in the repository, we would recommend you browse through the website and familiarize yourself with the tool. 3 Learning Objectives After completing the lab, a student should be able to: 1. 2. 3. 4. Understand the Windows registry and its role for digital forensic analysts Understand how the Windows registry can be used to track activities on suspect systems Using RegRipper to analyze Windows registry hives for the purpose of extracting evidence Comprehending the different ‘plugins’ available for RegRipper and the purpose that they serve 5. Using RegRipper in command-line mode and grasping the available options 4 Background Knowledge This lab is intended for undergraduate digital forensic classes. The background knowledge required by the student, prior to starting the lab are: 1. 2. 3. 4. Understanding of what a Windows registry is Knowledge on the structure of the Windows registry Basic knowledge on how to use the Windows command line Follow the instructions to utilize the software to conduct a forensic investigation. 5 Lab Environment Before doing the activity, the students are expected to download and install RegRipper on their windows device keeping in mind the minimum system requirements needed for the application. 6 Tools Required 1. RegRipper 2.8 (Older or newer versions may also suffice) 7 Lab Tasks 1) Uncompress the “RegistryForensicsLab.rar” file given with this lab to get the lab materials. 2) Unzip the “RegRipper2.8.rar” file 3) Place the lab materials in a folder comfortable for you to use them. We would recommend putting in your “C:” drive. 4) For ease of use, you can also copy the path and put it in the environment variables of the system to avoid writing the path repeatedly. 5) Place the registry hives in a suitable handy folder for ease of use. We recommend placing the registry hives inside the RegRipper folder. Note: The NTUSER.dat file might be hidden by default. Ensure that you are viewing hidden files to locate that file. 6) Have a look at the csv file attached in the folder for the different plugins that RegRipper offers. This will come in handy during the lab. 8 Brief Overview of the Interface We will start with the command line interface of RegRipper for our analysis. Execution of the main executable file (rip.exe) shows you the different options it has. Figure 1: Different options used in RegRipper Notice that -r is used to load a registry hive file, while -p is used to load a specific plugin module. These are the most used options that will be used in the lab. RegRipper has a lot of different plugins for various tasks. You can use the command “rip.exe -l” to view all the plugins. Figure 2: Different plugins used in RegRipper 9 Lab Challenges and Deliverables/Lab Questions 1. The suspect’s computer could be a workstation, a server, or a domain controller. Determine the type of system it is. Hint: System hive file By using the plugin “producttype” and the system hive file, I was given the output of WinNT which indicates that the suspect’s computer was a workstation. 2. What is the operating system and its version? When was it installed? Hint: Software hive file By using the “winver” plugin and the software hive file, I was able to determine that the operating system was Windows and the version was Windows 10 Pro. 3. What time zone is used by the computer? Hint: System hive file By using the “timezone” plugin and the system hive file I was able to determine that the time zone used by the computer was Central Standard Time. 4. What is the name of the computer being investigated? Hint: System hive file By using the “compname” plugin and the system hive file, I was able to determine that the computer’s name was DESKTOP-BQQIOUA. 5. Which user logged on last and when? Hint: Software hive file By using the plugin “lastloggedon” and the software hive file I was able to determine that the last logged on user was .\Test and they last logged on Thursday January 1, 1970 at 00:00:00. 6. When was the system last shut down? Hint: System hive file By using the “shutdown” plugin and the system hive file I was able to determine that the last shut down occurred on Saturday August 9, 2022 at 19:57:44. Great Job! After the successful completion of this lab, we gathered some key pieces of evidence that are of great value to the investigation. We got the product type of the machine, the operating system it was running on, the time zone it used, the different users on the system, the installed applications, and much more. 9.1 Estimated Completion Time The total estimated time to complete this lab is about two hours. 9.1.1 Validation/Evaluation Criteria The grade for this lab is based on the correctness and exposition quality of the answers to the above questions. 10 Lab Submission Guidelines Please turn in the deliverables, including the solutions to the questions and the approach taken to arrive at these conclusions to the learning management system as directed by your instructor. 11 Notes for Instructors (and learners) Instructors and students, this lab aims to develop a fundamental skill in using a seminal digital forensic software, Regripper.