상세정보
학술대회
Windows Registry and Hiding Suspects' Secret in Registry
- 발행일
- 200804
- 출처
- International Conference on Information Security and Assurance (ISA) 2008, pp.393-398
- 초록
- Windows registry, a central repository for configuration data, should be investigated for obtaining forensic evidences, since it contains lots of information that are of potential evidential value. Using some forensic tools, forensic examiners can investigate values of windows registry and get information can be forensic evidences. However, since windows registry contains huge amount of values and these values can be modified by users, suspect can hide his secret like password in registry values. In this paper, we discuss the basics of Windows XP registry and extract some registry entries related to forensic analysis. Finally, we show that some countermeasures are needed, listing up consideration items for hiding secrets in registry as suspect's viewpoint. © 2008 IEEE.
- KSP 제안 키워드
- Configuration data, Forensic Analysis, Windows registry, forensic tool