Цифрове криміналістичне дослідження реєєстру операційної системи Windows

Abstract

The study presents the results of systematization and own research of the Windows operating system registry. The storage locations of artifacts for the registry section "HKEY_LOCAL_MACHINE", which may be of interest for forensic investigations, as well as their brief description are given. The most informative are the "\SOFTWARE" and "\SYSTEM" subsections. For these subsections, the artifacts stored in them and which can be used for forensics are analyzed in detail.