XML Conversion of the Windows Registry for Forensic Processing and Distribution

Abstract : The Windows Registry often contains key data that help determine the activities performed on a computer. While some forensic tools format Registry data for common questions that are required to be answered in digital investigations, their output is geared for standalone use, not for indexable content.This paper describes RegXML, an XML syntax designed to represent Windows Registry hive files. RegXML captures the logical structure of a hive and notes the locations of found data within hive files. The paper also describes a Python library designed to be used with RegXML and the results obtained upon applying the library to analyze two forensic corpora. Experimental results are presented based on hundreds of disk images, thousands of hive files and tens of millions of Registry cells.
Type de document :
Communication dans un congrès
Gilbert Peterson; Sujeet Shenoi. 8th International Conference on Digital Forensics (DF), Jan 2012, Pretoria, South Africa. Springer, IFIP Advances in Information and Communication Technology, AICT-383, pp.51-65, 2012, Advances in Digital Forensics VIII. 〈10.1007/978-3-642-33962-2_4〉
Liste complète des métadonnées

https://hal.inria.fr/hal-01523700
Contributeur : Hal Ifip <>
Soumis le : mardi 16 mai 2017 - 17:10:09
Dernière modification le : vendredi 1 décembre 2017 - 01:17:04
Document(s) archivé(s) le : vendredi 18 août 2017 - 00:52:42

Fichier

978-3-642-33962-2_4_Chapter.pd...
Fichiers produits par l'(les) auteur(s)

Licence


Distributed under a Creative Commons Paternité 4.0 International License

Identifiants

Citation

Alex Nelson. XML Conversion of the Windows Registry for Forensic Processing and Distribution. Gilbert Peterson; Sujeet Shenoi. 8th International Conference on Digital Forensics (DF), Jan 2012, Pretoria, South Africa. Springer, IFIP Advances in Information and Communication Technology, AICT-383, pp.51-65, 2012, Advances in Digital Forensics VIII. 〈10.1007/978-3-642-33962-2_4〉. 〈hal-01523700〉

Partager

Métriques

Consultations de la notice

162

Téléchargements de fichiers

52