Windows Registry in Forensic Analysis: A Literature Review

Abstract

Abstract
Digital forensics is the buzzword in the present era of “the Information Age.” It deals with the acquisition, preservation, and analysis of digital evidences. The digital forensic field is very vast. It includes operating system forensics, network forensics, web forensics, client side forensics and server side forensics, etc. A pool of operating systems is available but the Windows environment is ubiquitous in many organizations. Windows operating systems store vast data in registry. The Windows registry is the heart and soul of Windows operating systems. It is a powerful and excellent source for extracting evidences which can strongly assist in forensic analysis. Albeit a lot of work has been done in this area but still it acts as a fertile area for new researchers. Moreover, there is a dearth of suitable and well-organized literature material so as to assist the researchers and practitioners in this area. Thus, this paper aims to create a data bank to facilitate the referencing needs of researchers and practitioners in this area. To this end, this paper presents the literature review pertaining to this topic. The literature review is based on the data collected from various research papers, tools and web sources that will strongly assist in easy referencing.

Keywords: digital forensics, windows operating systems, windows registry, forensic analysis