期刊名称：International Journal of Network Security & Its Applications
印刷版ISSN：0975-2307
电子版ISSN：0974-9330
出版年度：2012
卷号：4
期号：2
DOI：10.5121/ijnsa.2012.4209121
出版社：Academy & Industry Research Collaboration Center (AIRCC)
摘要：Windows Registry forensics is an important branch of computer and network forensics. Windows Registry is often considered as the heart of Windows Operating Systems because it contains all of the configuration setting of specific users, groups, hardware, software, and networks. Therefore, Windows Registry can be viewed as a gold mine of forensic evidences which could be used in courts. This paper introduces the basics of Windows Registry, describes its structure and its keys and subkeys that have forensic values. This paper also discusses how the Windows Registry forensic keys can be applied in intrusion detection
关键词：Forensics; Information Security; Windows Registry
