Windows File System & Registry

The File System: Where Evidence Lives

Every file created, modified, moved, or deleted on a Windows system leaves traces in the file system. When malware drops a payload, when an attacker creates a scheduled task, when a user downloads a phishing attachment — the file system records it.

NTFS (New Technology File System) is the default file system on modern Windows. Understanding how NTFS stores data is essential for two reasons:

1. Forensic recovery: NTFS does not immediately erase data when files are deleted. The MFT entry and file content remain on disk until overwritten — giving forensic analysts a window to recover evidence.
2. Timestamp analysis: Every file has four timestamps that tell a story. Attackers who modify timestamps to cover their tracks leave artifacts that a trained analyst can detect.

The Master File Table (MFT)

The MFT is the heart of NTFS. It is a database that stores a record for every file and directory on the volume. Each record is typically 1,024 bytes and contains:

MACB Timestamps

Every file on NTFS has four timestamps (stored in both $STANDARD_INFORMATION and $FILE_NAME attributes):

Timestomping is an anti-forensic technique (T1070.006) where attackers modify timestamps to make malicious files appear old or match legitimate system files. They typically modify the $STANDARD_INFORMATION timestamps but leave $FILE_NAME timestamps untouched — because modifying $FILE_NAME requires low-level disk access.

Detection: Compare $STANDARD_INFORMATION timestamps with $FILE_NAME timestamps. If $SI shows a creation date of 2020 but $FN shows 2026, the file was timestomped.

Alternate Data Streams (ADS)

NTFS supports Alternate Data Streams — hidden data attached to a file that does not appear in file size or standard directory listings.

Normal file:            report.docx (visible, 50 KB)
Alternate Data Stream:  report.docx:hidden_payload (invisible, 100 KB)

Attackers use ADS to hide malware payloads, scripts, or exfiltrated data. The file report.docx appears normal in Explorer, but it carries a hidden payload in its alternate stream.

Detection: Use dir /r or Velociraptor's Windows.NTFS.ADS artifact to enumerate alternate data streams.

The Windows Registry

The Windows Registry is a hierarchical database that stores configuration settings for the operating system, installed software, hardware, and user preferences. For defenders, the registry is both a treasure trove of forensic artifacts and a minefield of persistence mechanisms.

Click to enlarge

The Five Root Keys

Top 10 Registry Locations for Defenders

These are the registry keys you will check in virtually every Windows investigation. Each one tells you something about what happened on the system.

Persistence Locations (Where Attackers Hide)

1. Run / RunOnce Keys — Programs that auto-execute at logon

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

ATT&CK: T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)

2. Services — Configured Windows services

HKLM\SYSTEM\CurrentControlSet\Services\{ServiceName}

ATT&CK: T1543.003 (Create or Modify System Process: Windows Service)

3. Scheduled Tasks — Task configuration in registry

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree

ATT&CK: T1053.005 (Scheduled Task/Job: Scheduled Task)

Forensic Artifact Locations (What Happened)

4. ShimCache (AppCompatCache) — Evidence of program execution

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache

Records the full path and last modification time of every executable the system has seen — even if it was not executed.

5. Amcache — Detailed execution history

C:\Windows\AppCompat\Programs\Amcache.hve

Records SHA1 hashes, file paths, publisher information, and first execution time for installed programs. Critical for proving an executable ran on the system.

6. UserAssist — Programs launched by the user via Explorer

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

Entries are ROT13-encoded. Decoding reveals program names, run count, and last execution time.

7. RecentDocs / TypedPaths — User activity tracking

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths

Shows recently opened documents and manually typed folder paths in Explorer.

Security-Critical Locations

8. SAM Database — Local user accounts and password hashes

HKLM\SAM\SAM\Domains\Account\Users

Contains NTLM password hashes for local accounts. Accessible only to SYSTEM. Attackers dump this for offline password cracking.

9. Security Policy — Audit and security settings

HKLM\SECURITY\Policy

Contains LSA secrets, cached domain credentials, and security policy settings.

10. Installed Software — What's on the system

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Click to enlarge

How the File System and Registry Work Together

In a real investigation, you rarely analyze one in isolation. They complement each other:

Key Takeaways

• NTFS MFT records every file on the volume; "deleted" files remain recoverable until their clusters are reused
• MACB timestamps (Modified, Accessed, Changed, Birth) tell the file's story; comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps detects timestomping (T1070.006)
• Alternate Data Streams allow attackers to hide payloads within normal-looking files — enumerate with dir /r or Velociraptor
• The Windows Registry is organized into five root keys backed by hive files on disk (SYSTEM, SOFTWARE, SAM, SECURITY, NTUSER.DAT)
• The top persistence locations are Run/RunOnce keys (T1547.001), Services (T1543.003), and Scheduled Tasks (T1053.005)
• Forensic artifacts in ShimCache, Amcache, and UserAssist prove program execution even when the program file has been deleted
• The SAM hive contains local password hashes — a primary target for credential attacks
• File system and registry analysis are complementary — always check both during investigations

What's Next

You now understand how Windows stores files and configuration. Lesson 3.3 dives into the Windows Event Log architecture — how Windows records security-relevant activity, the critical Event IDs every defender must know, and what Sysmon adds to close the gaps that default logging leaves open.