Windows registry artifactSystem Info (Current)

Name of computer used by the user

System Info
24 keys
NTUSERSYSTEMSOFTWARE

Registry keys

24 keys that RECmd reads for this artifact

NTUSERComputerName
Software\Microsoft\Windows Media\WMSDK\General
Name of computer used by the user
SYSTEMComputerName
ControlSet00*\Control\ComputerName\ComputerName
Name of computer used by the user
SOFTWARESystemRoot
Microsoft\Windows NT\CurrentVersion
Current location of %SystemRoot% Environment Variable
SOFTWARERegisteredOwner
Microsoft\Windows NT\CurrentVersion
Current registered owner
SOFTWARERegisteredOrganization
Microsoft\Windows NT\CurrentVersion
Current registered organization
SOFTWAREDisplayVersion
Microsoft\Windows NT\CurrentVersion
Current milestone update version
SOFTWAREInstallTime
Microsoft\Windows NT\CurrentVersion
Current OS install time
SOFTWAREProductName
Microsoft\Windows NT\CurrentVersion
Current OS name
SOFTWAREInstallDate
Microsoft\Windows NT\CurrentVersion
Current OS install date
SOFTWAREInstallationType
Microsoft\Windows NT\CurrentVersion
Current OS installation type
SOFTWAREEditionID
Microsoft\Windows NT\CurrentVersion
Current OS version and install info
SOFTWARECurrentMajorVersionNumber
Microsoft\Windows NT\CurrentVersion
Current OS version and install info
SOFTWARECurrentBuildNumber
Microsoft\Windows NT\CurrentVersion
Current OS version and install info
SOFTWARECurrentBuild
Microsoft\Windows NT\CurrentVersion
Current OS build information
SOFTWARECompositionEditionID
Microsoft\Windows NT\CurrentVersion
Current OS license type
SOFTWAREBuildLab
Microsoft\Windows NT\CurrentVersion
Current OS build information
SOFTWAREBuildLabEx
Microsoft\Windows NT\CurrentVersion
Current OS extended build information
SOFTWAREReleaseID
Microsoft\Windows NT\CurrentVersion
Current OS Release ID - Deprecated in Windows 10 21H1 and Newer (Shows 2009)
SOFTWARECSDVersion
Microsoft\Windows NT\CurrentVersion
Current OS Service Pack Number
SOFTWAREUBR
Microsoft\Windows NT\CurrentVersion
Current OS Update Build Revision Number
SYSTEMProductType
CurrentControlSet\Control\ProductOptions
Indicates Type of System - WinNT = Workstation, LanmanNT = Domain Controller (DC - Primary or Backup), ServerNT = Server
SYSTEMProductType
ControlSet00*\Control\ProductOptions
Indicates Type of System - WinNT = Workstation, LanmanNT = Domain Controller (DC - Primary or Backup), ServerNT = Server
SYSTEMProductSuite
CurrentControlSet\Control\ProductOptions
Indicates Product Licence on System
SYSTEMProductSuite
ControlSet00*\Control\ProductOptions
Indicates Product Licence on System

References

3 links

Parse it

Run the DFIRBatch.reb batch file on collected hives

RECmd

RECmd.exe -d "D:\Evidence" --bn BatchExamples\DFIRBatch.reb --csv "D:\Parsed"

KAPE module

kape.exe --msource D:\Evidence --mdest D:\Parsed --module RECmd_DFIRBatch

Collect the hives

KAPE targets that copy these hives

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)