Registry of Interests

Question 1

What is HKLM\System\CurrentControlSet ?

Answer 1

It is an alias to HKLM\System\ControlSet001 and ControlSet002.
The ControlSet is dynamically generated during the boot process.

The CurrentControlSet can not be found in the registry, when loading the hive files.

Question 2

How can you verify which ControlSet was last used, without the CurrentControlSet alias key?

Answer 2

HKLM\System\Select

Question 3

Where can the Time Zone Information be found in the registry ?

Answer 3

HKLM\System\CurrentControlSet\Control\TimeZoneInformation

Question 4

Where in the registry is more system information available ?

Answer 4

HKLM\Software\Microsoft\WindowNT\CurrentVersion

Question 5

Where can the Last Shutdown time be found in the registry ?

Answer 5

HKLM\System\CurrentControlSet\Control\Windows\
Shutdowntime contain the timestamp as a 64 bit hex value.
This can be decode with the tool DCode v4.0

Question 6

Where can traces of installed program’s be found ?

Answer 6

• HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall
• HKLU\Software\

Question 7

Where can the pagefile settings be found in the registry ?

Answer 7

HKLM\System|CurrentControlSET\Control\Session Manager\MemoryManagement

Question 8

Where can be found which devices are mounted on the system ?

Answer 8

HKLM\System\MountedDevices

2 types of data:
- short = used for IDE/SCSI drives
- long = used for USB Removeable drives

Question 9

What is USBSTOR and where is it located?

Answer 9

When a USB storage device is plugged into a computer, Windows assigns it a unique identifier called a device instance ID. This ID is stored in the USBSTOR registry key along with other information about the device.

HKLM\System\CurrentControlSet\Enum\USBSTOR

Question 10

Where can the First insert date be found in the USBSTOR ?

Answer 10

The USBSTOR stores the dates in different keys called:

• 0064 = First insertion date
• 0065 = Insertion date
• 0066 = Last insertion date
• 0067 = Last removal date

Question 11

Where else can information about USB timestamps found in the registry ?

Answer 11

HKLM\System\CurrentControlSet\Enum\USB

USBSTOR manufactor product, iserial number

USB iserial number, vendor ID, product ID

Question 12

Where can the Assigned IP addresses be found on the system?

Answer 12

HKLM\System\CurrentControlSet\Service\TCPip\parameters\interfaces

Question 13

Where can the Assigned IP addresses be found on the system?

Answer 13

HKLM\System\Microsoft\WindowsNT\CurrentVersion\Networklist\Profiles

Question 14

Where can User traces be found in the registry ?

Question 15

What are User Shell folders ? And where are the located ?

Answer 15

User Shell Folders holds all the default user folders such as: Documents, Download etc …

The location of these User Shell Folder can be changed to another disk or encrypted disk.

Highest = HKCU User Shell Folders
= HKCU Shell Folder (default)
= HKLM User Shell Folders
Lowest = HKLM Shell Folder (default)

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\

Question 16

Where can the MRU list for the UserAssist be found?

Answer 16

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

Question 17

Where can the MRU list for the RecentDocs be found?

Answer 17

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Question 18

Where can the MRU list for the MS Office recently opened files be found ?

Answer 18

HKCU\Software\Microsoft\Office\14.0\Word\File

Question 19

Where can the MRU list for the TypedURLs be found?

Answer 19

HKCU\Software\Microsoft\​Microsoft\Internet Explorer\TypedURLs

Question 20

Where can the MRU list for the TypedURLsTime be found?

Answer 20

HKCU\Software\Microsoft\InternetExplorer\TypedURLsTime

Question 21

Where can the MRU list for the OpenSaveMRU be found?

Answer 21

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU

Question 22

Where can the MRU list for the CIDSizeMRU be found?

Answer 22

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\CIDSizeMRU

Question 23

Where can the MRU list for the LastVisitedPidMRU be found?

Answer 23

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU

Question 24

Where can the MRU list for the Search Assistants MRU be found?

Answer 24

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery

Question 25

Where can the MRU list for the Encrypted Storage be found?

Answer 25

HKCU\Software\Microsoft\Internet Explorer\IntelliForms\Storage2