Registry Hive
A persistent Windows Registry database file that stores system, software, user, or security configuration in a structured binary format.
Digital-Forensics Context
Windows Registry hives such as SYSTEM, SOFTWARE, SAM, SECURITY, and per-user hives store structured configuration and state. Their keys and values can reveal system configuration, execution artifacts, account information, and traces of user or application activity.
Evidence Boundary
The presence of a registry value is not automatic proof that a named user performed a specific action at a specific time. The semantics, update behavior, and source of the artifact must be established before drawing that conclusion.
Related Digital-Forensics Concepts
- Forensic Timeline
- Memory Forensics
- Chain of Custody
- Windows Artifact