[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-292249-105":59,"doc-detail-292249-en":131},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":124,"head_meta":126,"extra_data":128,"updated_unix":130},105,"en","windows-registry-forensics-cheatsheet-windows-registry-forensics-cheatsheet","Windows Registry Forensics Cheatsheet - Windows Registry Forensics Cheatsheet","","Windows Registry Forensics Cheatsheet compiles practical guidance for investigating Windows system artifacts, focusing on OS version, control set paths, computer name, and time zone information stored in registry keys. It outlines where to extract evidence about autostart programs via Autoruns/Run and RunOnce locations, user and SAM hive account data, and USB/External device forensic identifiers such as USBSTOR enumeration and first/last connection timestamps. It also covers recent files, Office recent history, ShellBags, dialog MRUs, Explorer typed paths and search history, execution evidence including UserAssist, ShimCache and Amcache, and BAM/DAM for activity correlation.",{"@graph":69,"@context":123},[70,84,106],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":30,"@type":76,"position":81},"https://docshare.wps.com/document/technology/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/windows-registry-forensics-cheatsheet-windows-registry-forensics-cheatsheet/292249/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/windows-registry-forensics-cheatsheet-windows-registry-forensics-cheatsheet/292249.png","ImageObject",300,407,{"name":92,"@type":93},"Terk","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-12","2026-09-17",true,{"@type":102,"interactionType":103,"userInteractionCount":105},"InteractionCounter",{"@type":104},"ViewAction",11,{"@type":107,"mainEntity":108},"FAQPage",[109,115,119],{"name":110,"@type":111,"acceptedAnswer":112},"Which registry areas store evidence about system configuration such as OS version and control sets?","Question",{"text":113,"@type":114},"The cheatsheet points to paths under SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion and SYSTEM\\CurrentControlSet\\SYSTEM\\Select, plus keys for computer name and time zone information under Control\\ComputerName and Control\\TimeZoneInformation.","Answer",{"name":116,"@type":111,"acceptedAnswer":117},"Where can USB device forensic evidence be found in the Windows registry?",{"text":118,"@type":114},"It lists USBSTOR and USB enumeration keys under SYSTEM\\CurrentControlSet\\Enum\\USBSTOR and SYSTEM\\CurrentControlSet\\Enum\\USB, including first/last connection timestamps and device identifiers.",{"name":120,"@type":111,"acceptedAnswer":121},"What execution artifacts are covered, and where are they located?",{"text":122,"@type":114},"It includes execution-related artifacts such as UserAssist counts, ShimCache (AppCompatCache), AmCache (amcache.hve), and BAM/DAM activity stored in bam/dam service user settings entries.","https://schema.org",{"og:url":83,"og:type":125,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":127,"canonical":83},"index,follow",{"doc_id":129,"site_id":62},292249,1789649396,{"code":4,"msg":5,"data":132},{"doc_id":129,"user_id":133,"nickname":92,"user_avatar":134,"doc_module":4,"category_id":29,"category_name":30,"doc_title":65,"doc_description":67,"doc_content":135,"file_id":136,"file_url":137,"file_type":138,"file_size":139,"view_count":105,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":8,"language":140,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":67,"update_tm":130,"read_time":81},1099525198933,"https://ap-avatar.wpscdn.com/davatar_155a257f0dc6eb9ab79c44ca47cae57d","System info and accounts  \nOS Version:  \nSOFTWARE\\Microsoft\\Windows NT\\CurrentVersion  \nCurrent Control set:  \nHKLM\\SYSTEM\\CurrentControlSet SYSTEM\\Select\\Current SYSTEM\\Select\\LastKnownGood  \nComputer Name:  \nSYSTEM\\CurrentControlSet\\Control\\ComputerName \\ComputerName  \nTime Zone Information:  \nSYSTEM\\CurrentControlSet\\Control \\TimeZoneInformation  \nNetwork Interfaces and Past Networks:  \nSYSTEM\\CurrentControlSet\\Services\\Tcpip \\Parameters\\Interfaces  \nAutostart Programs (Autoruns):  \nNTUSER.DAT\\Software\\Microsoft\\Windows \\CurrentVersion\\Run  \nNTUSER.DAT\\Software\\Microsoft\\Windows \\CurrentVersion\\RunOnce  \nSOFTWARE\\Microsoft\\Windows\\CurrentVersion \\RunOnce  \nSOFTWARE\\Microsoft\\Windows\\CurrentVersion \\policies\\Explorer\\Run  \nSOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run  \nSAM hive and user information:  \nSAM\\Domains\\Account\\Users  \nExternal/USB device forensics  \nDevice identification:  \nSYSTEM\\CurrentControlSet\\Enum\\USBSTOR  \nSYSTEM\\CurrentControlSet\\Enum\\USB  \nFirst/Last Times:  \nSYSTEM\\CurrentControlSet\\Enum\\USBSTOR \\Ven_Prod_Version\\USBSerial\\#\\Properties \\{83da6326-97a6-4088-9453-a19231573b29}\\\\#\\#\\#\\# Oo64=first connection  \n0066=last connection  \n0067=last removal  \nUSB device Volume Name:  \nSOFTWARE\\Microsoft\\Windows Portable Devices \\Devices  \nFile/folder usage or knowledge  \nRecent Files:  \nNTUSER.DAT\\Software\\Microsoft\\Windows \\CurrentVersion\\Explorer\\RecentDocs  \nOffice Recent Files:  \nNTUSER.DAT\\Software\\Microsoft\\Office\\VERSION  \nNTUSER.DAT\\Software\\Microsoft\\Office\\VERSION \\UserMRU\\LiveID_ \\#\\#\\#\\#\\FileMRU  \nShellBags:  \nUSRCLASS. DAT\\Local Settings\\Software\\Microsoft \\Windows\\Shell\\Bags  \nUSRCLASS. DAT\\Local Settings\\Software\\Microsoft \\Windows\\Shell\\BagMRU  \nNTUSER.DAT\\Software\\Microsoft\\Windows\\Shell\\BagMRU  \nNTUSER.DAT\\Software\\Microsoft\\Windows\\Shell\\Bags  \nOpen/Save and LastVisited Dialog MRUs:  \nNTUSER.DAT\\Software\\Microsoft\\Windows \\CurrentVersion\\Explorer\\ComDlg32\\OpenSavePIDlMRUNTUSER.DAT\\Software\\Microsoft\\Windows \\CurrentVersion\\Explorer\\ComDlg32\\LastVisitedPidlMRU  \nWindows Explorer Address/Search Bars:  \nNTUSER.DAT\\Software\\Microsoft\\Windows \\CurrentVersion\\Explorer\\TypedPaths NTUSER.DAT\\Software\\Microsoft\\Windows \\CurrentVersion\\Explorer\\WordWheelQuery  \nEvidence of execution  \nUserAssist:  \nNTUSER.DAT\\Software\\Microsoft\\Windows  \n\\Currentversion\\Explorer\\UserAssist\\{GUID}\\Count  \nShimCache:  \nSYSTEM\\CurrentControlSet\\Control\\Session Manager \\AppCompatCache  \nAmCache:  \nAmcache.hve\\Root\\File\\{Volume GUID}\\  \nBAM/DAM:  \nSYSTEM\\CurrentControlSet\\Services\\bam\\UserSettings \\{SID}  \nSYSTEM\\CurrentControlSet\\Services\\dam\\UserSettings \\{SID}  \nTo learn more about WinhdotwtspFosren:ic.lmick heer/el: tatpsr:/trhnacgkmceoroom/windowsforensics1","cbCaigsSX1toAopg","https://ap.wps.com/l/cbCaigsSX1toAopg","pdf",4399329,"English","# System info and accounts\n## OS version and control set keys\n## Autostart programs (Autoruns)\n## SAM hive and user information\n# External/USB device forensics\n## Device identification (USBSTOR, USB)\n## Connection times (first/last)\n## USB device volume name\n# File/folder usage or knowledge\n## Recent files and Office recent files\n## ShellBags and BagMRU\n## Open/Save and LastVisited dialog MRUs\n## Explorer address/search bars history\n# Evidence of execution\n## UserAssist counts\n## ShimCache and AmCache\n## BAM/DAM activity data","[{\"question\":\"Which registry areas store evidence about system configuration such as OS version and control sets?\",\"answer\":\"The cheatsheet points to paths under SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion and SYSTEM\\\\CurrentControlSet\\\\SYSTEM\\\\Select, plus keys for computer name and time zone information under Control\\\\ComputerName and Control\\\\TimeZoneInformation.\"},{\"question\":\"Where can USB device forensic evidence be found in the Windows registry?\",\"answer\":\"It lists USBSTOR and USB enumeration keys under SYSTEM\\\\CurrentControlSet\\\\Enum\\\\USBSTOR and SYSTEM\\\\CurrentControlSet\\\\Enum\\\\USB, including first/last connection timestamps and device identifiers.\"},{\"question\":\"What execution artifacts are covered, and where are they located?\",\"answer\":\"It includes execution-related artifacts such as UserAssist counts, ShimCache (AppCompatCache), AmCache (amcache.hve), and BAM/DAM activity stored in bam/dam service user settings entries.\"}]","Windows Registry Forensics Cheatsheet - Windows Registry Forensics Cheatsheet | PDF"]