期刊名称：International Journal of Computer Trends and Technology
电子版ISSN：2231-2803
出版年度：2014
卷号：17
期号：2
页码：101-111
DOI：10.14445/22312803/IJCTT-V17P120
出版社：Seventh Sense Research Group
摘要：The Key study in this paper is to begin the investigation process with the initial forensic analysis in the segments of the storage media which would definitely contain the digital forensic evidences. These Storage media Locations is referred as the Windows registry. Identifying the forensic evidence from windows registry may take less time than required in the case of all locations of a storage media. Our main focus in this research will be to study the registry structure of Windows 7 and identify the useful information within the registry keys of windows 7 that may be extremely useful to carry out any task of digital forensic analysis. The main aim is to describe the importance of the study on computer & digital forensics. The Idea behind the research is to implement a forensic tool which will be very useful in extracting the digital evidences and present them in usable form to a forensic investigator. The work includes identifying various events registry keys value such as machine last shut down time along with machine name, List of all the wireless networks that the computer has connected to; List of the most recently used files or applications, List of all the USB devices that have been attached to the computer and many more. This work aims to point out the importance of windows forensic analysis to extract and identify the hidden information which shall act as an evidence tool to track and gather the user activities pattern. All Research was conducted in a Windows 7 Environment.
关键词：Windows Registry; Windows 7 Forensic Analysis; Windows Registry Structure; Analysing Registry Key; Digital Forensic Identification; Forensic data Collection; Examination of Windows Registry; Decoding of Windows Registry Keys; Discovering User Activities P
