international journal of network security its applications：国际网络安全杂志及其应用.pdfVIP

International Journal of Network Security Its Applications (IJNSA), Vol.4, No.2, March 2012 FORENSIC ANALYSIS OF WINDOWS REGISTRY AGAINST INTRUSION 1 1 2 3 Haoyang Xie , Keyu Jiang , Xiaohong Yuan and Hongbiao Zeng 1Department of Informatics, Fort Hays State University, Hays, KS, US kjiang@ 2Computer Science Department, North Carolina AT State University, Greensboro, NC, US xhyuan@ 3Department of Math and Computer Science, Fort Hays State University, Hays, KS, US hzeng@ ABSTRACT Windows Registry forensics is an important branch of computer and network forensics. Windows Registry is often considered as the heart of Windows Operating Systems because it contains all of the configuration setting of specific users, groups, hardware, software, and networks. Therefore, Windows Registry can be viewed as a gold mine of forensic evidences which could be used in courts. This paper introduces the basics of Windows Registry, de scribes its structure and its keys and subkeys that have forensic values. This paper also discusses how the Windows Registry forensic keys can be applied in intrusion detection. KEYWORDS Forensics, Information Security, Windows Registry 1. INTRODUCTION In a digital age, information has become an important resource that people depend on in every aspect of their lives. With the development of computers and networks, the communication of information becomes faster and faster. Fast internet access makes it possible to create social networks and share news and events across the world quickly. However, as people enjoy the convenience of information access a