Forensic analysis of the Windows registry in memory

Brendan Dolan-Gavitt

Forensic analysis of the Windows registry in memory

Brendan Dolan-Gavitt

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

This paper describes the structure of the Windows registry as it is stored in physical memory. We present tools and techniques that can be used to extract this data directly from memory dumps. We also provide guidelines to aid investigators and experimentally demonstrate the value of our techniques. Finally, we describe a compelling attack that modifies the cached version of the registry without altering the on-disk version. While this attack would be undetectable with conventional on-disk registry analysis techniques, we demonstrate that such malicious modifications are easily detectable by examining memory.

Original language	English (US)
Title of host publication	DFRWS 2008 Annual Conference
State	Published - 2008
Event	8th Annual Digital Forensic Research Workshop, DFRWS 2008 - Baltimore, MD, United States Duration: Aug 11 2008 → Aug 13 2008

Other

Other	8th Annual Digital Forensic Research Workshop, DFRWS 2008
Country/Territory	United States
City	Baltimore, MD
Period	8/11/08 → 8/13/08

Keywords

Cached data
Digital forensics
Microsoft Windows
Registry
Volatile memory

ASJC Scopus subject areas

Information Systems

Cite this

@inproceedings{f1c2b88c31fd45ada46343c0fb3f9a53,

title = "Forensic analysis of the Windows registry in memory",

abstract = "This paper describes the structure of the Windows registry as it is stored in physical memory. We present tools and techniques that can be used to extract this data directly from memory dumps. We also provide guidelines to aid investigators and experimentally demonstrate the value of our techniques. Finally, we describe a compelling attack that modifies the cached version of the registry without altering the on-disk version. While this attack would be undetectable with conventional on-disk registry analysis techniques, we demonstrate that such malicious modifications are easily detectable by examining memory.",

keywords = "Cached data, Digital forensics, Microsoft Windows, Registry, Volatile memory",

author = "Brendan Dolan-Gavitt",

year = "2008",

language = "English (US)",

booktitle = "DFRWS 2008 Annual Conference",

note = "8th Annual Digital Forensic Research Workshop, DFRWS 2008 ; Conference date: 11-08-2008 Through 13-08-2008",

}

TY - GEN

T1 - Forensic analysis of the Windows registry in memory

AU - Dolan-Gavitt, Brendan

PY - 2008

Y1 - 2008

N2 - This paper describes the structure of the Windows registry as it is stored in physical memory. We present tools and techniques that can be used to extract this data directly from memory dumps. We also provide guidelines to aid investigators and experimentally demonstrate the value of our techniques. Finally, we describe a compelling attack that modifies the cached version of the registry without altering the on-disk version. While this attack would be undetectable with conventional on-disk registry analysis techniques, we demonstrate that such malicious modifications are easily detectable by examining memory.

AB - This paper describes the structure of the Windows registry as it is stored in physical memory. We present tools and techniques that can be used to extract this data directly from memory dumps. We also provide guidelines to aid investigators and experimentally demonstrate the value of our techniques. Finally, we describe a compelling attack that modifies the cached version of the registry without altering the on-disk version. While this attack would be undetectable with conventional on-disk registry analysis techniques, we demonstrate that such malicious modifications are easily detectable by examining memory.

KW - Cached data

KW - Digital forensics

KW - Microsoft Windows

KW - Registry

KW - Volatile memory

UR - http://www.scopus.com/inward/record.url?scp=77955345007&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=77955345007&partnerID=8YFLogxK

M3 - Conference contribution

AN - SCOPUS:77955345007

BT - DFRWS 2008 Annual Conference

T2 - 8th Annual Digital Forensic Research Workshop, DFRWS 2008

Y2 - 11 August 2008 through 13 August 2008

ER -

Forensic analysis of the Windows registry in memory

Abstract

Other

Keywords

ASJC Scopus subject areas

Other files and links

Fingerprint

Cite this