CS4920: Automated Document and Media Exploitation

Mon Nov 17, 2008

Windows Registry

Seminar 13 <<                     Seminar 14                    >> Seminar 15

Readings

• Recovering Deleted Data From the Windows Registry. Timothy Morgan, DFRWS 2008 [paper] [slides]

Optional Readings

• Forensic Analysis of the Windows Registry in Memory, Brendan Dolan-Gavitt, DFRWS 2008 [slides]
• Forensic Analysis of the Windows Registry, Peter Davies, Computer Forensics: Coursework 2 (student paper)
• A Windows Registry Quick-Reference, Derrick Farmer, Burlington, VT.