IT Forensics – Windows

Forensic analysis of Windows Registry transaction logs – tracing changes to the Registry

Windows speichert Änderungen an der Registry nicht ausschließlich in den Registry-Hives selbst. Ergänzend existieren sogenannte Registry Transaction Logs (unter anderem LOG1 und LOG2), die bei der Rekonstruktion von Änderungen an der Registry wichtige Hinweise liefern können. Je nach Untersuchungsfall lassen sich dadurch zusätzliche Erkenntnisse über System- und Benutzeraktivitäten gewinnen.

Enquire without obligation

Im Rahmen einer professionellen IT-forensischen Untersuchung werden Registry Transaction Logs niemals isoliert ausgewertet. Erst die Korrelation mit den Registry-Hives, Event Logs, Prefetch-Dateien, Amcache, ShimCache sowie weiteren Windows-Artefakten ermöglicht eine belastbare technische Bewertung.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.

The examination is carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.

Our services

We analyse registry transaction logs, reconstruct registry changes and cross-check the results against other digital traces. All stages of the investigation are documented in a transparent manner and assessed from a technical perspective.

Typical areas of application

•Reconstruction of registry changes
•Analysis of malware
•Incident Response
•Investigation into possible instances of manipulation
•Employment law proceedings
•Expert reports for the courts

This is how the analysis works

Once a forensic image has been created, the registry hives and the associated transaction logs are analysed. The findings are then correlated with other Windows artefacts and placed within the overall context of the investigation.

Warum sind Registry Transaction Logs wichtig?

They can provide additional information about changes to the Windows Registry, thereby helping to reconstruct the sequence of events. However, their significance only becomes apparent once all relevant digital traces have been analysed in their entirety.

Frequently Asked Questions

Was sind Registry Transaction Logs?+
Protokolldateien, die Änderungen an der Windows Registry unterstützen und dokumentieren können.
Is the original system being examined?+
No. Only a forensic copy or forensic image is analysed.
Sind LOG1- und LOG2-Dateien immer vorhanden?+
Sie sind Bestandteil moderner Windows-Systeme, ihr Inhalt und ihre Aussagekraft hängen jedoch vom Einzelfall ab.
Reichen Transaction Logs allein für ein Gutachten aus?+
No. They are always analysed alongside other Windows artefacts.

LanCologne – Windows Forensics in Cologne

Do you need a professional analysis of registry transaction logs or other Windows artefacts? LanCologne can assist you with the forensic-grade preservation of digital evidence and the objective analysis of complex Windows systems.

Get in touch now