Windows Registry Forensics: An Imperative Step in Tracking Data Theft via USB Devices

Owing to the increasing pace of occurrence of crimes in digital world, cyber forensic investigation is becoming a burning topic in the field of information security. Registry is an important location in Windows system that contains footprints of user activities and other configuration data, which may be valuable for forensic investigators in collecting potential evidences from the system. This work aims to point out the significance of Registry Analysis, and attempts to answer why it should be carried as a part of digital forensic investigation by demonstrating the role played by Registry in tracking data theft from system to USB external devices. Keywords— Forensics Analysis, Registry Analysis, Tracking Data Theft, USB footprints, Windows Forensics.