Member Avatar for rayvirgo

Hi

Please allow me to introduce myself. Currently I am employed with a local firm specialising in Network and Software Support for other local firms. I form part of a CERT team (Computer Emergency Response Team) whereas one of my duties include cyber investigations for our Information Security and Risk Management Department.
I would like to know whether there are utilities which might help me out in reading the registries or at least the MRU list from Hard disks which have been confiscated due to a suspected PC misuse.

Your assistance is mostly appreciated. You can contact me on my hotmail account at .

Thanks

  • 2 Contributors
  • 2 Replies
  • 192 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by rayvirgo

Dani AI

Generated

Good move cloning the drive and working from the copy — that keeps the original intact and supports a defensible chain of custody. For formal evidence handling keep a written log of who had the media, which tools were used, and always verify your image with cryptographic hashes (don’t rely on a casual copy). (csrc.nist.gov)

A concise, repeatable workflow that works well for NT/2000/XP targets:

  1. Acquire a forensically sound image (E01/raw) and record examiner, date/time, tool and hash.
  2. Work from the image only (or a write-blocked mounting) and compute/record hashes for any working copies.
  3. Extract the registry hive files from the image: the system hives live under the OS path (e.g. SYSTEM, SOFTWARE, SAM, SECURITY, DEFAULT in %SystemRoot%\System32\Config) and each user’s profile contains an NTUSER.DAT (XP: C:\Documents and Settings\<user>\NTUSER.DAT). (learn.microsoft.com)

Key MRU/artifact locations to parse (use these to build timelines and corroborate activity): RunMRU and RecentDocs (user-run commands and recently opened files), TypedURLs (browser address typing), UserAssist and MUICache (GUI-launched programs and friendly names), ShimCache/AppCompatCache and AmCache (evidence of executed files), plus LNK/jump-list and Prefetch/USN/MFT entries for corroboration. Don’t treat a single registry value as proof of execution — correlate with file-system artifacts and timestamps. (magnetforensics.com)

Recommended tools and practical tips: use an offline parser to avoid accidental changes — automated parsers like RegRipper speed extraction of MRU, Run keys, UserAssist, etc., and platforms like Autopsy can ingest images and parse registry output into artifacts. If a hive is “dirty” (transaction logs present) consider merging/processing logs (RegRipper docs point to yarp/registryFlush or tools like rla.exe) before final interpretation. Example commands (run against copies, not originals):

sha256sum case-image.E01
rip -r /case/NTUSER.DAT -a > ntuser_report.txt

Document every step and cross-check registry hits with LNKs, MFT records, and event logs for reliable findings. (github.com)

Recommended Answers

All 2 Replies

Member Avatar for Comatose

There are a lot of possibilities when it comes to this.... first though, since more and more programs are becoming "intelligent", a whole lot of them remember recent files used, so are you looking for a specific MRU (such as for internet explorer, or for the "run" option on the start button)?

Two major solutions are
Pretty Easy:
Just boot the system normally (naturally, if you are concerned that there may be some kind of fail-safe in place or self-destruct code, use the more complicated method, but if you are fairly certain that the system is safe, then you could download something like an MRUViewer [[url][/url]]) which allows you to see the IE History, cookies, cache, along with the run MRU.


Complicated:
If you are afraid that the PC which has been taken is equipped to clean up it's mess, or to "self-destruct" when you boot it, then you might want to take this approach.
Assuming that the NTFS drive isn't encrypted, you could boot the PC with a secondary OS from a liveCD (something like Knoppix, , or STD). With this in mind, you'll need to be a little bit comfortable using a Unix System, in which you would mount the NTFS hard-drive, and copy the registry files to a portable device, like a floppy, or thumb drive....

If you give me a bit more detail on what you are looking at specifically, I'm sure I could help you further your search....

Member Avatar for rayvirgo

Thanks for your reply. I will try and use MRUViewer for now. We cloned the HD as we do not want to accidentally erase something or include new datestamps on the original. We are currently using the cloned HD externally. Cheers

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.