In this walk through, we will be going through the Windows Forensics 1 room from Tryhackme. This room is rated as Medium on the platform and is developed to introduce us with Windows Registry Forensics. So, let’s get started without any delay.
Table of Contents
Task 1 – Introduction to Windows Forensics
Question 1 – What is the most used Desktop Operating System right now?
Task 2 – Windows Registry and Forensics
Question 1 – What is the short form for HKEY_LOCAL_MACHINE?
Task 3 – Accessing registry hives offline
Question 1 – What is the path for the five main registry hives, DEFAULT, SAM, SECURITY, SOFTWARE, and SYSTEM?
Question 2 – What is the path for the AmCache hive?
Task 4 – Data Acquisition
Question 1 – Try collecting data on your own system or the attached VM using one of the above mentioned tools
Task 5 – Exploring Windows Registry
Question 1 – Study the above material to understand the difference between the different tools
Task 6 – System Information and System Accounts
Question 1 – What is the Current Build Number of the machine whose data is being investigated?
Question 2 – Which ControlSet contains the last known good configuration?
Question 3 – What is the Computer Name of the computer?
Question 4 – What is the value of the TimeZoneKeyName?
Pakistan Standard Time
Question 5 – What is the DHCP IP address
Question 6 – What is the RID of the Guest User account?
Task 7 – Usage or knowledge of files/folders
Question 1 – When was EZtools opened?
Question 2 – At what time was My Computer last interacted with?
Question 3 – What is the Absolute Path of the file opened using notepad.exe?
Question 4 – When was this file opened?
Task 8 – Evidence of Execution
Question 1 – How many times was the File Explorer launched?
Question 2 – What is another name for ShimCache?
Question 3 – Which of the artifacts also saves SHA1 hashes of the executed programs?
Question 4 – Which of the artifacts saves the full path of the executed programs?
Task 9 – External Devices/USB device forensics
Question 1 – What is the serial number of the device from the manufacturer ‘Kingston’?
Question 2 – What is the name of this device?
Kingston DataTraveler 2.0 USB Device
Question 3 – What is the friendly name of the device from the manufacturer ‘Kingston’?
Task 10 – Hands-on Challenge
Question 1 – How many user created accounts are present on the system?
Question 2 – How many user created accounts are present on the system?
Question 3 – What’s the password hint for the user THM-4n6?
Question 4 – When was the file ‘Changelog.txt’ accessed?
Question 5 – What is the complete path from where the python 3.8.2 installer was run?
Question 6 – When was the USB device with the friendly name ‘USB’ last connected?
Task 11 – Conclusion
Also Read: Tryhackme – Wgel CTF
So that was “Windows Forensics 1” for you. We have learned about the fundamentals of the Windows Registry Forensics. We started with the basics of Windows Registry and Forensics. Then we access registry hives offline. Post that we perform Data acquisition, and explored Windows registry. Further, we looked into system information/accounts and explored files, folders and some attached devices. At last, we solved an hands-on challenge and completed the room. On that note, i will take your leave and will see you in next one, Till then “Hack the Planet”.