Lab Activity -The Windows Registry-Lab 1 Worksheet Digital Forensics Technology and Practices
Table of Contents
Screenshot 1 – Creating Your First Name Account 3
Screenshot 2 – Create a YOURNAME User account 4
Screenshot 3 – Create a YOURNAME Service 5
Screenshot 4 – Add Yourname.EXE to the Starup Folder for Administrator 6
Screenshot 5 – Your First Folder with the Registry Files with Date Modified 7
Screenshot 6– Windows Computer Name Date Pulled from the Registry 8
Screenshot 8– Yourname Service Pulled from the Registry 9
Screenshot 8 – SAM (Security Accounts Manager) with Yourname 10
Screenshot 9 – Access the Startup Folder 11
Screenshot 10 – Autoruns with Yourname. EXE running at Startup 12
Students: In the box below, please explain the purpose of using the Windows Registry and explain how it is relevant to Digital Forensics Technology and Practices
Screenshot 1 – Your First Name Computer Name
- Your First Name in the Computer Name Box. The Name of the computer should be your first name. The use of anyone else’s name may result in an academic integrity review by your professor. Please label your screenshot to receive full credit.
Take a screenshot of the Yourname being used in the computer name.
Screenshot 2 – Create a YOURNAME User account
- The Name of the User created should match your first name. The use of anyone else’s name may result in an academic integrity review by your professor. Please label your screenshot to receive full credit.
Take a screenshot of the Yourname user account being create at the command line.
Screenshot 3 – Create a YOURNAME Service
- The Name of the Service created should match your first name. The use of anyone else’s name may result in an academic integrity review by your professor. Please label your screenshot to receive full credit.
Take a screenshot of the Yourname being used in the Service being Created on Windows.
Screenshot 4 – Add Yourname.EXE to the Startup Folder for Administrator
- The Name of the file should be your first name. The use of anyone else’s name may result in an academic integrity review by your professor. Please label your screenshot to receive full credit.
Take a screenshot of the Yourname being used in the startup folder for the administrator
Screenshot 5 – Your First Folder with the Registry Files with Date Modified
- The Name of the Folder should match your first and last name. The use of anyone else’s name may result in an academic integrity review by your professor. Timestamps from a previous semester may also result in an academic integrity review by your professor. Please label your screenshot to receive full credit.
Take a screenshot of the Yourname folder with the collected registry files.
Screenshot 6– Windows Computer Name Date Pulled from the Registry
- Show the system hive of the registry with the Computer Name of your Windows operating system. Label your screenshot.
Take a screenshot of Yourname in the system registry under machine name.
Screenshot 7– Yourname Service Pulled from the Registry
- Show the system hive of the registry with the Yourname Service. Label your screenshot.
Take a screenshot of the Yourname Service in the system registry under servicesScreenshot 8 – SAM (Security Accounts Manager) with Yourname
- The Name of the User listed in the SAM file created during should match your first name. The use of anyone else’s name may result in an academic integrity review by your professor. Please label your screenshot to receive full credit
Take a screenshot of the Yourname user in the SAM file from the Windows Registry.
Screenshot 9 – Autoruns with Yourname. EXE running at Startup
- The Name of the executable file should match your first name. The use of anyone else’s name may result in an academic integrity review by your professor. Please label your screenshot to receive full credit.
Take a screenshot of the Yourname file in Startup within the Autoruns program.
Screenshot 10 – Autoruns with Yourname Service Running
- The Name of the Service listed in Autoruns should match your first name. The use of anyone else’s name may result in an academic integrity review by your professor. Please label your screenshot to receive full credit
Take a screenshot of the Yourname Service Running within the Autoruns program
Conclusion
Students: In the box below, please explain the purpose of doing this lab below and explain how in is relevant to Digital Forensics Technology and Practices. Highlight any new learning that occurred while doing this lab.
Hint: Discuss tools and commands used in the lab.
Students: Please list at least 5 relevant APA References.
Answer Preview-Lab Activity -The Windows Registry-CST 640
