Extracting windows registry information from physical memory

摘要：

Windows registry from physical memory contains lots of important information that are of potential evidential value in forensic analysis. In this paper, a method of extracting windows registry information from physical memory has been proposed. The algorithm for extracting the hive files from memory is presented and mainly composed of the following steps: judging the version of operating system, acquiring the current running process, locating the _HANDLE_TABLE of the process, enumerating the handles of the process, and finding the required hive files. The method is proved to be effective in extracting hive files from memory dumps imaged from Window XP, Windows Vista and Windows 7. How to make use of the registry data in memory is also given.

关键词： computer forensics memory analysis registry

作者: Shuhui Zhang Lianhai Wang Lei Zhang

作者单位: Shandong Provincial Key Laboratory of Computer Network, Shandong Computer Science Center 19 Keyuan Road, Jinan, Shandong, 250014, P.R.China

会议类型: 国际会议

会议名称: 2011 3rd IEEE International Conference on Computer Research and Development(ICCRD 2011)(2011第三届计算机研究与发展国际会议)

会议地点: 上海

会议语种:英文

页码: 85-89

在线出版日期: 2011-03-11（万方平台首次上网日期，不代表论文的发表时间）