UPM Institutional Repository

Forensics visualization of Windows 10 registry


Awang, Muhamad Safwan (2019) Forensics visualization of Windows 10 registry. Masters thesis, Universiti Putra Malaysia.


The increase with the volume of data created in digital devices has make the process of evidences analysis become difficult especially for forensic investigator. In addition, most of the existing forensic tools nowadays not all able to provide good visualization of registry information. Some of tools only able to provide the list of data but not the actual information that needed by forensic investigator. For example, Registry Viewer product of Forensic Toolkit (FTK) can display all the content of registry file but not all of the data can be view as it in hexadecimal. RegRipper tool also only provides the information of registry file in a textual result. The functions in these forensic tools not suitable if handling large number of data. Moreover, it will only cause mental fatigue for investigator if there is more than one computer they need to analyse. In this paper, a visualization forensics tool is proposed to help making the forensic analysis process become easy and faster. Proposed tool will cover the functions that the existing forensics tools do not have, especially in the visualization part. It is developed to cater for the Windows forensics in the analysis of registry hive files. Moreover, proposed tool trusted able to provide single representation of all registry hive files in one page.

Download File

[img] Text
FSKTM 2019 31 IR.pdf

Download (1MB)

Additional Metadata

Item Type: Thesis (Masters)
Subject: Microsoft Windows (Computer file)
Subject: Computer crimes
Subject: Computer networks
Call Number: FSKTM 2019 31
Chairman Supervisor: Mohd Taufik Abdullah, Dr.
Divisions: Faculty of Computer Science and Information Technology
Depositing User: Mas Norain Hashim
Date Deposited: 24 Jul 2020 02:31
Last Modified: 24 Jul 2020 02:31
URI: http://psasir.upm.edu.my/id/eprint/82965
Statistic Details: View Download Statistic

Actions (login required)

View Item View Item