Course 36 - Windows Forensics and Tools | Episode 6: From System Hives to Forensic Analysis

About this episode

This episode covers the structure and forensic analysis of the Windows Registry, including its components and extraction tools.

In this lesson, you’ll learn about: Windows Registry structure and forensic analysis1. What is the Windows Registry? A centralized configuration database in Windows Stores system, user, and application settings 🔹 Core Idea Think of it as the brain of Windows configuration 2. Registry StructureThe registry is organized in a strict hierarchy:🔹 Components Hives Keys Subkeys Values 🔹 Analogy Hive → main database file Key → folder Value → actual data entry 3. Main Root Keys🔹 Key Windows Registry Roots HKEY_LOCAL_MACHINE (HKLM) HKEY_CURRENT_USER (HKCU) 🔹 What they represent HKLM → system-wide settings HKCU → settings for the logged-in user 4. Physical Storage of Registry Hives Stored on disk in: C:\Windows\System32\config 🔹 Why this matters Investigators can extract registry data directly from disk Even if Windows is not bootable 5. Core HKLM Sub-Hives🔹 SAM (Security Accounts Manager) Stores: User accounts Password hashes 🔹 SECURITY Hive Stores: Local security policy LSA secrets Authentication data 🔹 SOFTWARE Hive Stores: Installed applications Configuration settings 🔹 SYSTEM Hive Stores: Drivers Services Boot configuration 👉 Key Insight: These hives are critical for system…

Topics covered

• Windows Forensics
• Registry Analysis
• Forensic Tools
• System Hives
• Data Extraction

Keywords

• Windows Registry
• Forensics
• Hives
• Data Extraction
• Registry Structure
• System Configuration

Mentioned in this episode

Organizations: Windows, Windows Registry, HKEY_LOCAL_MACHINE, HKEY_CURRENT_USER, SAM, SECURITY, SOFTWARE, SYSTEM, BCD, ELAM

More episodes of CyberCode Academy

• Course 36 - Windows Forensics and Tools | Episode 14: A Guide to Steganography and OpenStego · June 12, 2026 · 18 min
• Course 36 - Windows Forensics and Tools | Episode 13: Decoding Registry Artifacts and Connection History · June 11, 2026 · 13 min
• Course 36 - Windows Forensics and Tools | Episode 12: A Forensic Guide to Windows User Artifacts · June 10, 2026 · 18 min
• Course 36 - Windows Forensics and Tools | Episode 11: Unlocking Hidden Metadata and Browser History · June 9, 2026 · 21 min
• Course 36 - Windows Forensics and Tools | Episode 10: Decoding Metadata and File Internals · June 8, 2026 · 22 min
• Course 36 - Windows Forensics and Tools | Episode 9: Uncovering Hidden Evidence · June 7, 2026 · 25 min