[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-292252-105":59,"doc-detail-292252-en":130},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":123,"head_meta":125,"extra_data":127,"updated_unix":129},105,"en","registry-export-encase-forensic-subsection-export-windows-registry-hive-files","Registry Export - Encase® Forensic Subsection - Export Windows Registry Hive Files","","Guide for exporting Windows Registry hive-related files using Encase® Forensic. It explains which files exist on typical Windows 7 and earlier systems, including NTUSER.DAT, USRCLASS.DAT, SAM, SECURITY, SYSTEM, SOFTWARE, DEFAULT, and optional INDEX.DAT entries for IE cache. Step-by-step instructions cover opening an image or device, selecting the correct volume, tagging required instances, optionally exporting IE cache files, and copying selected folders while preserving the original directory structure.",{"@graph":69,"@context":122},[70,84,105],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":30,"@type":76,"position":81},"https://docshare.wps.com/document/technology/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/registry-export-encase-forensic-subsection-export-windows-registry-hive-files/292252/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/registry-export-encase-forensic-subsection-export-windows-registry-hive-files/292252.png","ImageObject",300,407,{"name":92,"@type":93},"Adam","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-12","2026-09-17",true,{"@type":102,"interactionType":103,"userInteractionCount":44},"InteractionCounter",{"@type":104},"ViewAction",{"@type":106,"mainEntity":107},"FAQPage",[108,114,118],{"name":109,"@type":110,"acceptedAnswer":111},"Which Registry hive files should be included when exporting with Encase® Forensic?","Question",{"text":112,"@type":113},"Include NTUSER.DAT and USRCLASS.DAT for each user, and SYSTEM, SECURITY, SOFTWARE, SAM, and DEFAULT for the machine. Add COMPONENTS and BCD-TEMPLATE for Vista/7 systems, and consider USERDIFF and optional INDEX.DAT as described.","Answer",{"name":115,"@type":110,"acceptedAnswer":116},"How do you find the correct volume for the Windows operating system in Encase® Forensic?",{"text":117,"@type":113},"Open the case, then locate the volume containing the Windows operating system. On modern machines it is typically the second logical volume shown as “D” in Encase® Forensic.",{"name":119,"@type":110,"acceptedAnswer":120},"What is the recommended export process after tagging the necessary files?",{"text":121,"@type":113},"Scroll back to the top so the “D” volume is visible, right-click the “D” volume, choose “Copy Folders”, select the export destination, ensure “Copy only selected files inside each folder” is checked, and confirm to start copying.","https://schema.org",{"og:url":83,"og:type":124,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":126,"canonical":83},"index,follow",{"doc_id":128,"site_id":62},292252,1790246589,{"code":4,"msg":5,"data":131},{"doc_id":128,"user_id":132,"nickname":92,"user_avatar":133,"doc_module":4,"category_id":29,"category_name":30,"doc_title":65,"doc_description":67,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":44,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":34,"language":139,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":140,"faqs":141,"seo_title":142,"seo_description":67,"update_tm":143,"read_time":144},1374404737137,"https://ap-avatar.wpscdn.com/davatar_155a257f0dc6eb9ab79c44ca47cae57d","Registry Export-Encase® Forensic  \nThe following section can be used as a guide to assist in exporting all the hive files which comprise the Windows Registry using Encase® Forensic. In this example, Encase® Forensic is being used to interpret a forensic image of a Windows 7 machine. The following files exist on a Windows 7 machine:  \n\n| Filename | \u003Cbr>Occurrences on a typical machine |\n| --- | --- |\n| NTUSER.DAT | One per user account |\n| USRCLASS.DAT | One per user account |\n| SECURITY | One per machine plus backup |\n| SYSTEM | One per machine plus backup |\n| SOFTWARE | One per machine plus backup |\n| SAM | One per machine plus backup |\n| USERDIFF | May or may not exist |\n| DEFAULT | One per machine plus backup |\n| COMPONENTS | One per machine plus backup – Vista/7 only |\n| BCD-TEMPLATE | One per machine plus backup – Vista/7 only |\n| INDEX. DAT ** | Many per user based on usage |\n\n** INDEX.DAT files store IE cache information and are not part of the Windows Registry. However, if included during a Windows Registry export, Registry Browser can view the IE cache files as well as the registry files, saving time.  \nThe above list of files should be kept handy when doing an export even after successfully exporting the registry many times.  \nThis guide will work with earlier versions of Windows including Windows NT, Windows 2k, Windows XP and Windows Vista. USRCLASS.DAT first appeared on Windows XP systems, whilst COMPONENTS and BCD-TEMPLATE first appeared on Windows Vista systems. Using the above list will ensure that all necessary files are included in the export.  \n1. Use Encase® Forensic to open your E01, raw image or physical device.  \n2. Locate the volume which contains the Windows Operating system. On modern machines it will be the second logical volume and will be described by Encase® Forensic as “D”.  \n3. If this is not a freshly opened case, ensure that there are no files currently tagged as they will be included in the export as well.  \n4. Click the home plate icon next to the volume containing the operating system and the home plate will become green eg.   \n5. All descendant items below the green home plate will also appear green indicating that the table view on the right will contain all the files on the entire “D” volume as pictured below.  \n6. Ensure the table view on the right is being sorted by file name. The example above indicates this with the red arrow in the top right corner of the “Name” heading in the table view.  \n7. Start with the first file on the list,“NTUSER. DAT” and locate it in the table view. There are two ways to do this. The hard way is to use the scroll bar to navigate down alphabetically until you find NTUSER.DAT. The easy way is to ensure the focus is on the table view by selecting the first row in the table and then using the keyboard to type “NTUSER.DAT”without quotes. This technique will jump straight down to the correct location.  \n8. Locate all the NTUSER.DAT files and tag them with a blue tick as illustrated below.  \n9. Next, repeat the above step with the next file “USRCLASS.DAT” as shown.  \n10. Moving on to the system side of the registry, repeat again for all the remaining files on the list. The examples below show the SECURITY and SYSTEM files. Be careful to tag all instances and note that they may appear in upper or lower case.  \n11. Before moving on, it’s a good idea to include the IE cache files named “INDEX.DAT”. This step is completely optional, however, if you were considering examining the IE cache files with a product other than Encase® Forensic, this is a perfect opportunity to export these files as well. Also note that Registry Browser will allow you to view the contents of the INDEX.DAT files. The illustration below shows the INDEX.DAT files being tagged.  \n12. Now that all the necessary files have been tagged, it’s time to export the files. Return to the left pane and scroll back to the top of the tree, so that the “D” volume is again visible. Right click on the “D” volum","cbCaif0qbQp8Kbv2","https://ap.wps.com/l/cbCaif0qbQp8Kbv2","pdf",267890,"English","# Registry Export - Encase® Forensic Subsection\n## Windows Registry hive files to include\n## Export workflow using Encase® Forensic\n## Copying and preserving directory structure","[{\"question\":\"Which Registry hive files should be included when exporting with Encase® Forensic?\",\"answer\":\"Include NTUSER.DAT and USRCLASS.DAT for each user, and SYSTEM, SECURITY, SOFTWARE, SAM, and DEFAULT for the machine. Add COMPONENTS and BCD-TEMPLATE for Vista/7 systems, and consider USERDIFF and optional INDEX.DAT as described.\"},{\"question\":\"How do you find the correct volume for the Windows operating system in Encase® Forensic?\",\"answer\":\"Open the case, then locate the volume containing the Windows operating system. On modern machines it is typically the second logical volume shown as “D” in Encase® Forensic.\"},{\"question\":\"What is the recommended export process after tagging the necessary files?\",\"answer\":\"Scroll back to the top so the “D” volume is visible, right-click the “D” volume, choose “Copy Folders”, select the export destination, ensure “Copy only selected files inside each folder” is checked, and confirm to start copying.\"}]","Registry Export - Encase® Forensic Subsection - Export Windows Registry Hive Files | PDF",1789649401,18]