Initial Case Analysis Using Windows Registry in Computer Forensics

The Windows registry has significant information which are valuable to the forensic analyst. Especially, some information such as the timezone information, the time when the OS was installed and the system was turned off, furthermore what kinds of the storage devices were attached are necessary in the forensic analysis. Besides, the investigator must recognize them for the further investigation. In this paper, we will give details about the Windows registry and describe how to use them for the forensic analysis and the investigation.