# Disk Analysis Introduction

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FLwDmE8zKGSYAPIQyha0W%2FScreenshot.png?alt=media&#x26;token=c8b6de81-58ba-4c02-ac65-b03bef7618a3" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F8lmMwjSyGH0qgc7nSJib%2FScreenshot(1).png?alt=media&#x26;token=5b7da58c-c2f3-421a-ad27-cff54b4501dc" alt=""><figcaption></figcaption></figure>

{% file src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FfftfBdfXbY4CPrHEt1B4%2FAnalysis-Notes-Template.docx?alt=media&token=1f8b7e75-8208-4b2b-9089-5374e333998c" %}

## Windows Registry Analysis

Let's drop the registry hives into Registry Explorer.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FGEiqLgfrcPkVL9JN1BZN%2FScreenshot(2).png?alt=media&#x26;token=a73f403b-7f3d-46f8-8170-2c2bee805ad2" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FYdbidCkiqaFBTe7ZvWFb%2FScreenshot(6).png?alt=media&#x26;token=e2324159-71c5-4fe0-b442-4b7493760634" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FuGDWSZtvq2W7OpGpNYbZ%2FScreenshot(4).png?alt=media&#x26;token=4ee04eed-9beb-43c1-a1bf-f467822e9c0c" alt=""><figcaption></figcaption></figure>

Next, let's extract some system information from these registry hives using Registry Explorer and RegRipper.

### System Information

Computername:  \
Registry: HKLM\System\CurrentControlSet\Control\Computername\\

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F3dflWpWr4uVUHKnfAvfX%2FScreenshot(5).png?alt=media&#x26;token=033227ac-4b25-467f-ae10-614a65a63363" alt=""><figcaption></figcaption></figure>

Windows Version: \
Registry: HKLM\Software\Microsoft\Windows NT\Currentversion\\

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FGXCvVRKY8J99gAqtHsEV%2FScreenshot(7).png?alt=media&#x26;token=a6717ab5-8078-4a6a-b55d-96202051574a" alt=""><figcaption></figcaption></figure>

Let's use RegRipper, but first, copy the registry hives to a separate folder.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2Fdx50TBCtW2j4FjPMPQzS%2FScreenshot(8).png?alt=media&#x26;token=b0ba77bc-f5bd-44f5-a878-b9c32c7b151e" alt=""><figcaption></figcaption></figure>

```bash
rip.exe -r c:\Cases\Analysis\Registry\SOFTWARE -p winver
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FKF8rF6I1fqB5WQCtyCPI%2FScreenshot(9).png?alt=media&#x26;token=1681a0b1-0298-4afa-8bad-41852a26c713" alt=""><figcaption></figcaption></figure>

Timezone:\
Registry: HKLM\System\CurrentControlSet\Control\TimeZoneInformation\\

```bash
rip.exe -r C:\Cases\Analysis\Registry\SYSTEM -p timezone
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FGHaeCoYz0M6BwvhLZbB0%2FScreenshot.png?alt=media&#x26;token=3ab8f152-74f3-4b79-ace9-d91e7db4934f" alt=""><figcaption></figcaption></figure>

Network Information:\
Registry: HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\\{interface-name}

```bash
rip.exe -r C:\Cases\Analysis\Registry\SYSTEM -p nic2
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FzXgdCJ97fwnee3Sf976P%2FScreenshot(1).png?alt=media&#x26;token=bc3ae5eb-0857-43b2-a77b-f8a08f9f844c" alt=""><figcaption></figcaption></figure>

```bash
rip.exe -r C:\Cases\Analysis\Registry\SOFTWARE -p networklist
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F0eCvJKftNomatrijshbY%2FScreenshot(2).png?alt=media&#x26;token=e8f3e41c-980c-4a9e-ae4b-3cf07d121b69" alt=""><figcaption></figcaption></figure>

Shutdown time:\
Registry: HKLM\System\ControlSet001\Control\Windows\ShutdownTime

```bash
rip.exe -r C:\Cases\Analysis\Registry\SYSTEM -p shutdown
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FvAIoFCME2jMdMjobaYyV%2FScreenshot(3).png?alt=media&#x26;token=24b1b6d1-f8bd-43f7-9256-7cc9380c2a36" alt=""><figcaption></figcaption></figure>

Defender settings:\
Registry: HKLM\Software\Microsoft\Windows Defender\\

```bash
rip.exe -r C:\Cases\Analysis\Registry\SOFTWARE -p defender
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FFLVwKrsC84y8g5D5vuua%2FScreenshot(4).png?alt=media&#x26;token=646623c9-dc51-40e2-8727-c5295cfc7b18" alt=""><figcaption></figcaption></figure>

### Parsing registry hives in bulk with RegRipper

```
attrib *
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2Fb5ZiYrhJXi5aYqf0fJNG%2FScreenshot.png?alt=media&#x26;token=b60e9843-80a6-4b69-a29f-8cd32d6d8504" alt=""><figcaption></figcaption></figure>

The files _UsrClass.dat_ and _NTUSER.DAT_ are hidden. Let’s display them.

```bash
attrib -h NTUSER.DAT
attrib -h UsrClass.dat
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FNX1WUmjvSpmUhfyz6ngp%2FScreenshot(1).png?alt=media&#x26;token=16340acd-642d-479e-82c6-c05c847bb8fb" alt=""><figcaption></figcaption></figure>

Let's process each hive using RegRipper.

```bash
for /r %i in (*) do (c:\Tools\RegRipper3.0-master\rip.exe -r %i -a > %i.txt)
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FEifQTXTsW8a9HFdw09Vt%2FScreenshot(2).png?alt=media&#x26;token=68d4a188-a89e-4f89-8aa9-d11232ee27c3" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F1EJIJX6xhHIyYHkHJDou%2FScreenshot(3).png?alt=media&#x26;token=d1be55ec-e33b-4609-a4e3-ed720bc58604" alt=""><figcaption></figcaption></figure>

Let's open them in Notepad.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FxdDS6NtbOZRBItndHKjh%2FScreenshot(4).png?alt=media&#x26;token=c9119453-7095-4887-97a9-8a2b383f527c" alt=""><figcaption></figcaption></figure>

Let's use **Ctrl + F** to search for the shutdown time, then select "Find All in All Opened Document."

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FhrDh3MQoGsYVeOYvuGeP%2FScreenshot(5).png?alt=media&#x26;token=846019bf-8cce-4fcb-8dc8-73a6cfb387bc" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FxPlPzjjvKPx94OBz7Z9L%2FScreenshot(6).png?alt=media&#x26;token=4b75cae3-01ad-43c7-b6cd-3705e0b6edbf" alt=""><figcaption></figcaption></figure>
