Recovering deleted data from the Windows registry

DFRWS 2008 Annual Conference

Volumn 5, Issue , 2008, Pages

  Morgan, Timothy D ^a  

^a VSR Investigations LLC   (United States)

Author keywords

Registry data recovery; Registry data structures; Registry forensics; Registry undelete; Windows registry

Indexed keywords

COMPUTER CRIME; DATA STRUCTURES; DIGITAL STORAGE; ELECTRONIC CRIME COUNTERMEASURES; RECOVERY;

REGISTRY DATA RECOVERY; REGISTRY DATA STRUCTURES; REGISTRY FORENSICS; REGISTRY UNDELETE; WINDOWS REGISTRY;

COMPUTER FORENSICS;

EID: 84867694163     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (22)

1. Abexo. Abexo Registry Cleaner. Available from: http://www.abexo.com/ registry-cleaner.htm.
2. Auslogics. Auslogics Registry Defrag. Auslogics Software Pty Ltd. Available from: http://www.auslogics.com/registry-defrag.
3. Brown Keith. What Is A Security Descriptor.pluralsite.com. Available from: http://www.pluralsight.com/wiki/default.aspx/Keith.GuideBook/ WhatIsASecurityDescriptor.html; 2005 [ported 18.01.2005, accessed 09.03.08].
4. Harlan Carvey.Windowsincident response: registry articles.Available from: http://windowsir.blogspot.com/search/label/Registry.
5. Harlan Carvey. The windows registry as a forensic resource. Digital Investigation. Available from: http://authors.elsevier.com/sd/article/ S1742287605000587, September 2005;2(3): 201-5. (Pubitemid 41261446)
6. LastBit Corp. Alien Registry Viewer. Available from: http://lastbit.com/ arv/; April 2006.
7. B.D. WinReg.txt. Available from: http://home.eunet.no/pnordahl/ntpasswd/ WinReg.txt.
8. Dolan-Gavitt Brendan. Push the red button: registry articles. Available from: http://moyix.blogspot.com/search/label/registry; 2007-2008 [accessed 04.05.08].
9. Farmer Derrick. A forensic analysis of the Windows registry. Available from: http://eptuners.com/forensics/Index.htm; 2007.
10. Franchuk Igor. Miscrosoft Registry Editor 5.1/XP/2K long string key vulnerability. Available from: http://lists.grok.org.uk/pipermail/full- disclosure/2005-August/036448.html; http://seclists.org/fulldisclosure/2005/Aug/ 0801.html; August 2005.
11. Hederer Lars. NTREGOPT. Available from: http://www.larshederer.homepage. t-online.de/erunt/index.htm; September 2005.
12. iExpert Software. Free Registry Defrag/Compact. Available from: http://www.registry-clean.net/free-registry-defrag.htm.
13. Lee Paul. Registry UnDelete. Available from: http://paullee.ru/regundel; September 2001.
14. Microsoft. SECURITY-DESCRIPTOR structure. Available from: http://msdn2.microsoft.com/en-us/library/aa379561.aspx [last updated 19.02.08].
15. MiTeC. Windows registry recovery (analysis tool). Available from: http://mitec.cz/wrr.html.
16. Morgan Timothy D. RegLookup. Available from: http://projects. sentinelchicken.org/reglookup/; March 2007.
17. Morgan Timothy D. The Windows NT registry file format. Available from: http://www.sentinelchicken.com/research/registry-format/; August 2008.
18. David B. Probert. Windows kernel internals: NT registry implementation. Available from: http://www.i.u-tokyo.ac.jp/edu/training/ss/lecture/new- documents/Lectures/09-Registry/Registry.pdf.
19. Registry Tool. Available from: http://www.registrytool.com/.
20. Russinovich Mark. Inside the registry. Windows NT Magazine, Microsoft. May 1999 edition. Available from: http://www.microsoft.com/technet/archive/ winntas/tips/winntmag/inreg.mspx%3Fmfr=true May 1999.
21. Sharpe Richard. editreg.c. Available from: http://websvn.samba.org/cgi- bin/viewcvs.cgi/trunk/source/utils/editreg.c%3Frev=2&view=markup; 2002.
22. Williams Nigel. dosreg.c. Available from: http://www.wednesday.demon.co. uk/dosreg.html; 2000.