BROWSE
Detail
Conference Paper
Windows Registry and Hiding Suspects' Secret in Registry
Cited 7 time in 
Share 
Share
- Authors
- Youn Soo Kim, Do Won Hong
- Issue Date
- 2008-04
- Citation
- International Conference on Information Security and Assurance (ISA) 2008, pp.393-398
- Language
- English
- Type
- Conference Paper
- Abstract
- Windows registry, a central repository for configuration data, should be investigated for obtaining forensic evidences, since it contains lots of information that are of potential evidential value. Using some forensic tools, forensic examiners can investigate values of windows registry and get information can be forensic evidences. However, since windows registry contains huge amount of values and these values can be modified by users, suspect can hide his secret like password in registry values. In this paper, we discuss the basics of Windows XP registry and extract some registry entries related to forensic analysis. Finally, we show that some countermeasures are needed, listing up consideration items for hiding secrets in registry as suspect's viewpoint. © 2008 IEEE.