Archives For April 2010

Note: This post originally appeared on the SANS Forensics blog

Talking with a colleague the other day reminded me of just how nuanced many of the forensic artifacts are that we rely upon.  Nowhere is this more true than in the Windows Registry.  With no specification and even Microsoft products not following any data storage methodology, it is about as haphazard and irregular as they come.  As an example, let’s look at the OpenSaveMRU and LastVisitedMRU Registry keys.  Both have been documented for years and are frequently cited in examinations.  That being said, I would bet many examiners have not investigated the keys deeply enough to understand everything they are telling us.  Here is a quick rundown on what we can glean from these keys.

Continue Reading…