Lab Activity -The Windows Registry-Lab 1 Worksheet Digital Forensics Technology and Practices

Table of Contents

Introduction 2

Screenshot 1 – Creating Your First Name Account 3

Screenshot 2 – Create a YOURNAME User account 4

Screenshot 3 – Create a YOURNAME Service 5

Screenshot 4 – Add Yourname.EXE to the Starup Folder for Administrator 6

Screenshot 5 – Your First Folder with the Registry Files with Date Modified 7

Screenshot 6– Windows Computer Name Date Pulled from the Registry 8

Screenshot 8– Yourname Service Pulled from the Registry 9

Screenshot 8 – SAM (Security Accounts Manager) with Yourname 10

Screenshot 9 – Access the Startup Folder 11

Screenshot 10 – Autoruns with Yourname. EXE running at Startup 12

Conclusion 13

APA References 14

Introduction

Students: In the box below, please explain the purpose of using the Windows Registry and explain how it is relevant to Digital Forensics Technology and Practices

Screenshot 1 – Your First Name Computer Name

1. Your First Name in the Computer Name Box. The Name of the computer should be your first name. The use of anyone else’s name may result in an academic integrity review by your professor. Please label your screenshot to receive full credit.

Take a screenshot of the Yourname being used in the computer name.

Screenshot 2 – Create a YOURNAME User account

1. The Name of the User created should match your first name. The use of anyone else’s name may result in an academic integrity review by your professor. Please label your screenshot to receive full credit.

Take a screenshot of the Yourname user account being create at the command line.

Screenshot 3 – Create a YOURNAME Service

1. The Name of the Service created should match your first name. The use of anyone else’s name may result in an academic integrity review by your professor. Please label your screenshot to receive full credit.

Take a screenshot of the Yourname being used in the Service being Created on Windows.

Screenshot 4 – Add Yourname.EXE to the Startup Folder for Administrator

1. The Name of the file should be your first name. The use of anyone else’s name may result in an academic integrity review by your professor. Please label your screenshot to receive full credit.

Take a screenshot of the Yourname being used in the startup folder for the administrator

Screenshot 5 – Your First Folder with the Registry Files with Date Modified

1. The Name of the Folder should match your first and last name. The use of anyone else’s name may result in an academic integrity review by your professor. Timestamps from a previous semester may also result in an academic integrity review by your professor. Please label your screenshot to receive full credit.

Take a screenshot of the Yourname folder with the collected registry files.

Screenshot 6– Windows Computer Name Date Pulled from the Registry

1. Show the system hive of the registry with the Computer Name of your Windows operating system. Label your screenshot.

Take a screenshot of Yourname in the system registry under machine name.

Screenshot 7– Yourname Service Pulled from the Registry

1. Show the system hive of the registry with the Yourname Service. Label your screenshot.

Take a screenshot of the Yourname Service in the system registry under servicesScreenshot 8 – SAM (Security Accounts Manager) with Yourname

1. The Name of the User listed in the SAM file created during should match your first name. The use of anyone else’s name may result in an academic integrity review by your professor. Please label your screenshot to receive full credit

Take a screenshot of the Yourname user in the SAM file from the Windows Registry.

Screenshot 9 – Autoruns with Yourname. EXE running at Startup

1. The Name of the executable file should match your first name. The use of anyone else’s name may result in an academic integrity review by your professor. Please label your screenshot to receive full credit.

Take a screenshot of the Yourname file in Startup within the Autoruns program.

Screenshot 10 – Autoruns with Yourname Service Running

1. The Name of the Service listed in Autoruns should match your first name. The use of anyone else’s name may result in an academic integrity review by your professor. Please label your screenshot to receive full credit

Take a screenshot of the Yourname Service Running within the Autoruns program

Conclusion

Students: In the box below, please explain the purpose of doing this lab below and explain how in is relevant to Digital Forensics Technology and Practices. Highlight any new learning that occurred while doing this lab.

Hint: Discuss tools and commands used in the lab.

APA References

Students: Please list at least 5 relevant APA References.

Answer Preview-Lab Activity -The Windows Registry-CST 640