IT Forensics – Windows

Forensic analysis of Windows Registry transaction logs – tracing changes to the Registry

Windows does not store changes to the registry exclusively within the registry hives themselves. In addition, there are so-called registry transaction logs (including LOG1 and LOG2), which can provide important information when reconstructing changes to the registry. Depending on the specific investigation, this can yield additional insights into system and user activities.

Enquire without obligation

As part of a professional IT forensic investigation, registry transaction logs are never analysed in isolation. Only by correlating them with registry hives, event logs, prefetch files, Amcache, ShimCache and other Windows artefacts is it possible to carry out a reliable technical assessment.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.

The examination is carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.

Our services

We analyse registry transaction logs, reconstruct registry changes and cross-check the results against other digital traces. All stages of the investigation are documented in a transparent manner and assessed from a technical perspective.

Typical areas of application

•Reconstruction of registry changes
•Analysis of malware
•Incident Response
•Investigation into possible instances of manipulation
•Employment law proceedings
•Expert reports for the courts

This is how the analysis works

Once a forensic image has been created, the registry hives and the associated transaction logs are analysed. The findings are then correlated with other Windows artefacts and placed within the overall context of the investigation.

Why are registry transaction logs important?

They can provide additional information about changes to the Windows Registry, thereby helping to reconstruct the sequence of events. However, their significance only becomes apparent once all relevant digital traces have been analysed in their entirety.

Frequently Asked Questions

What are registry transaction logs?+
Log files that can support and document changes to the Windows Registry.
Is the original system being examined?+
No. Only a forensic copy or forensic image is analysed.
Are LOG1 and LOG2 files always present?+
They form an integral part of modern Windows systems; however, their content and significance depend on the individual case.
Are transaction logs alone sufficient for an expert report?+
No. They are always analysed alongside other Windows artefacts.

LanCologne – Windows Forensics in Cologne

Do you need a professional analysis of registry transaction logs or other Windows artefacts? LanCologne can assist you with the forensic-grade preservation of digital evidence and the objective analysis of complex Windows systems.

Get in touch now