The Registry Hives You May be MSIX-ING: Registry Redirection with MS MSIX

In Digital Forensics we use the registry hives to help paint the picture of what a threat actor may have done while in the network. These registry hives can tell us things like what documents were opened, what folders were traversed into and what files may have been opened or saved on the computer. Forensics has traditionally focused on a handful of registry hives. With the introduction of MSIX in Windows 10+, per application registry hives were introduced. These hives contain information that may not be located in the traditional hives that examiners have been looking at, and could contain valuable information not located in other places. In this presentation, I will walk through were to find these, what tools to use to work with them and why they may be relevant to your investigations.