Question

A. Briefly explain the purpose of the Windows Registry and its security implications, you discussion here should show an understanding of regedit and the overall structure of the registry. B. Demonstrate how the Windows Registry may be analysed and monitoring using RegShot. For this aspect of the exercise, you are required to do each of the following; i. Install RegShot on a Windows machine. You are strongly advised to use a virtual machine (VM) as you may not be able to undo any registry changes you make. You can use a university provided VM or one on your personal PC. ii. Take a snapshot of the system’s registry. iii. Perform some system changes or install a new software. That is, carry out any activity that will cause some registry entries. iv. Take a second snapshot of the registry. This must be done after (c) above. v. Compare the two snapshots and briefly discuss your findings. Use screenshots to document this exercise.

Answer 1

The Windows Registry is a vital database in the Windows operating system that stores configurations and settings. It has security implications due to containing sensitive data. RegShot is a tool used to analyze and monitor changes made to the Windows Registry.

Step-by-step explanation:

A. Purpose of the Windows Registry

The Windows Registry is a central database in the Windows operating system that stores settings and configurations for the system, applications, and user preferences. It serves as a repository of information that allows the operating system and applications to function properly.

As for its security implications, the Windows Registry contains sensitive information, including user passwords, encryption keys, and system configurations. Unauthorized access or modifications to the registry can lead to system instability, data loss, or compromise of personal information.

The regedit utility in Windows allows users to interact with and make changes to the registry. It provides a graphical user interface for navigating through the registry's hierarchical structure and modifying key values and data.

B. Analyzing and Monitoring the Windows Registry with RegShot

RegShot is a tool used to take snapshots of the Windows Registry before and after making changes or installing software, and then compare the two snapshots to identify the differences. Here are the steps to demonstrate how to use RegShot:

Install RegShot on a Windows machine, preferably a virtual machine to avoid permanent changes to the registry.

Take the first snapshot of the system's registry using RegShot.

Perform system changes or install a new software that will modify the registry.

Take a second snapshot of the registry using RegShot.

Compare the two snapshots with RegShot and analyze the differences, which may include new or modified registry entries related to the changes made.

By using RegShot, you can track the changes made to the registry and gain insights into the impact of those changes on the system.