Hello and welcome back two windows registry forensics. Course three. The NT user Got Dad Hive section 10 user searches. World query Before we get started. Let's just take a quick look at what we've talked about so far and there's a point I'm trying to get across here that there are numerous MRI list throughout the registry. And these MRI list most recently used lists contain entries made due to specific actions performed by the user. For instance, recent documents tracks recently access documents back to a specific user profile and it also includes a recent documents by file extension. So each file extension has its own. M are you list most recently used and we can get an idea of which files or which programs the user is opening whether it's PDFs, Excel, spreadsheets, word documents. We look at type two RLS what that is tracking its tracking a U R L a web address that the user actually typed into the Internet Explorer address bar. Whether they did it by the auto complete function or copy and paste. It's still something that they specifically searched for. User assist maintains a list of items such as programs, shortcuts and things in the control panel Control panel Apple. It's that a user has access and it makes these programs accessible to the user from their start menu. So this is something they use often and it becomes accessible from the start menu. So that may be very important recent applications. These are applications that are used by a user and it shows some of the files that were accessed with the specific application. So that can be very important if you're looking for a specific application. Maybe it's c cleaner. Maybe it's a nefarious application. Maybe it's an application the user wasn't supposed to be using on their work computer. It can become very important. The run and run one sub key can be used for malware and these are user specific programs that is set to run its startup with no interaction from the user other than lung into Windows. So this is what this specific user has set up to run at startup. Com. Dialogue 32 tracks application usage relating to the Open save box in the Windows Explorer. This is something they opened or saved through the Windows Explorer, which most of us open or save a program through that box quite often. And it also has an M. R you list there run are you are programs or applications that are launched through the Windows run box. So the user actually brought up the run box where they ran cmd to get a control window or they ran any other program from that run box. You're going to be able to see that we looked at types paths. that's what the user actually types of path to a file or directory or an application into the Windows Explorer. So they obviously interacted with that program and knew that that program or file was on their computer. This can become very important because a lot of times we don't have to just prove that something was there. We have to prove the user knew it existed. And all of these things that I talked about would help you do that. We talked about Microsoft office applications recently use M. R. Us and this tracks the Microsoft Office applications like Word, Excel and PowerPoint. And it will give you an MRI list for each of those specific applications, which again, can become very important to your case. And it's not enough to know where this information is located within the file system. It's great that you know that and you're a step ahead of some examiners if you do know that, but it's even more important to understand how it got there. How did this information get on the computer? You need to be able to explain that. You need to know how these keys are populated and you definitely don't need to know where this information is located within the file system. We don't just want to do push button forensics. You know, it's not enough to say axiom showed me that this was here. Well, where did it come from? You need to know where it came from and you need to know how it got there. So this is what I'm trying to show you by going through all these artifacts in the end to user data. I've been explaining what they are and how they get populated where they are in the file system. Word wheel query. Windows search has changed through a little bit so we're going to have to go through a little bit of History and Windows seven We had Word Wheel query and these were searches. Keyword searches conducted by the user from the start menu. You type a search term into the start box. If you're looking for a specific file or a specific program again that's something that would show knowledge that the user knew was there. Which is important. This key did contain an M. R. You list order. It had a last a key last access date and it showed us the search terms that the user typed in there. Well that could be very important to your case. If you're doing a certain type of case where the search terms may be specific. Like if you're doing a drug case and you're looking for certain search terms, a gang related case, a child exploitation case. These all have certain key words that are used and that would be very important for you to be able to see those keywords. Now, windows changed things up a little bit in Windows eight where real query went away and they had something called the Windows file search app. And this was the path to it. Software Microsoft Windows current version Explorer, which was the same beginning as when World Real Query. But instead it went to search history. Microsoft Windows file search out this key had the same information. It had an MRI order the order that the search terms were typed in and had a key last access date. And we could see the search terms that were typed by the user. It's stored the files differently. It's stored them as a link files. So we had some file access dates and times. And we had the search terms and Windows eight point what And Windows 8.1. These searches were conducted from the charms bar what they call the charms bar instead of the start menu. And they were stored as individual link files. They had filed times and dates. And they were search terms typed by the user but they were not located within the registry. They were located out on the file system and that is the file path, the user user app data, local Microsoft, Windows Connected search history. So in Windows 8.1 they moved outside the registry and seven they were in the registry underworld weird query and eight they were still in the registry 8.1 they left the registry. Windows 10. We go back to world where query, word wheel query. And these again are searches conducted by the user. But it's not tracking the search is typed into the search box at the bottom by the start menu. It is tracking the searches that you conduct from within Windows Explorer. And we'll take a look at that in the second. It does contain an MRI you order. It does contain a key last access date and it will show you the search term that was typed in by the user and the path is the same as it is was in Windows seven. It's Software Microsoft, Windows current version Explorer Word where Query, You're going to see a lot of stuff out there online that says We're in Windows 10. It will track from the search box. I did a lot of testing. I tested on three different Windows 10 computers, three different versions of Windows 10 and I did not get those results in Windows 10. The search terms are tracked by katana outside of the registry in a database. The items were going to be using in this section. We're going to use registry Explorer. We're going to use ivans and to user dot dot file and we're going to use registry ripper and registry browser before we get started. I just want to show you really quickly what I'm talking about is searches conducted from this search box right here within the Windows Explorer. You can see it has attracted some of my searches that I've already done, but if you type a search term in here, say we typed in dog that would show up in my world. Will query, let's go ahead and bring up registry Explorer. Spring up registry Explorer and let's go ahead. Like we've done several times and we're going to load the Ivan anti dot dot Hive, navigate out to your computer where you have it and go ahead and load that Hive in, click the open and the Hive will load. Once the Hive is loaded, we're going to go ahead, expand, expand route software, Microsoft Windows, current version Explorer scroll all the way down to you. Get to a world where word wheel query and go ahead and click on it. Now. We can see in registry Explorer it goes ahead and displays the search terms for us. It doesn't give it to us in unicode, which is how they are stored. And we'll take a look at that and another tool and it's showing us right at the top the first one, the last search that was done. And again, I did this search myself and I did it this way. So we could say this is the most recent search done is key right now has 20 entries in it and you can see as we go down all the search terms that were used. We can also see down here in the hacks that there is what looks like to us and them are you list, it ends with the floor eFS and it is indeed an M R you list and it's stored and a D word value. It's binary data. It's displayed to us in a hex to decimal double word D word value. We c 00 01020304. All the way up to hexi decimal 014 Which translated to decimal is the number 20. We do have a key last right date in time. So you can tell when the last search was conducted by the key last right date in time. We're pretty close to one that was conducted depending on how it right but we cannot tell when the other searches were done. But this can be very valuable data. And in fact, I did use this in a case where somebody had child exploitation material on their computer and I found child exploitation terms in their world where query so they can't say they didn't know the material was there and they weren't looking for it. Now let's go ahead and take a look at registry browser. It displays it a little different. And if you haven't done so what you would do is file open registry again in this tool we need to select the Windows folder which you would select. You'd hit. Okay? It'll load. It will give you that error message, but just hit. Ok. Now, when we navigate down the world where word Wheel query, which again the path We would open up. The users Expand the user 1001 B. Software Microsoft Windows current version Explorer. Word wheel query. And we could see our MRI list here just like we saw it and register Explorer, but this is showing us hexi decimal are actually unicode values for the search terms. But if you click on them you can see the ask or unicode displayed down here in the bottom pane. But what I want you to Notice is the first search. You do get zero registry Explorer just showed it to us in a nice neat order, descending order. But this is actually the way it is stored in this particular order. So 20 would be the most recent. So we also need to be aware of our tools and what they're telling us and how they display the data and how they interpret the data so we don't get it wrong Because if you said that zero was the last search done in this case, it would not be correct. And we still have a key last write time as we can see at the top. It's giving us it in local time and in GMT time. Let's take a look at our registry ripper report. We've done the Ivan into user Hive and let's see what it says for word will query. It's a big report. Just use control F and type in the word wheel and it will take you here and you can see here it's giving us the file path where it got the information from. It's giving us our last write time and UTC. But what's weird here again and we noticed this before and registry ripper that It was giving us this January one time, which we know is not the case. So you'd want to use other tools to get the correct time and again we see Most recent is # 20. So you want to be careful that registry Explorer and make sure we know what we're talking about. If we need to testify in court and you can see the same search terms all the way down to that. Nt At the very 1st 1. And we can see the last write time and registry browser. And if we were to bring up registry Explorer, we can see the same last write time, January 16 2020. And it's giving us the time here in UTC. We need to remember that too. And we're getting our time in UTC. And when you look at the GMT time, which would be the same as the UTC time. We can see that they match 22-01-29 22-0129. And our dates are the same. This is local time. So be my local time on my computer or the local time on your computer.
