detections
- ID: DT164
- Created: 31st August 2026
- Updated: 31st August 2026
- Platform: Windows
- Contributor: The ITM Team
Deleted Windows Registry Record Recovery
Windows Registry hive files may retain deleted Registry keys and values after they are no longer present within the active Registry structure. Investigators can examine acquired hive files using forensic Registry parsing tools capable of identifying and recovering data from unallocated hive cells.
Tools such as Registry Explorer can identify deleted Registry records and categorize recovered artifacts as associated deleted records, unassociated deleted records, and unassociated values. Associated deleted records are artifacts where sufficient structural information remains to associate the recovered object with its former Registry location. Unassociated records or values may retain useful names, data, timestamps, or other attributes, but cannot be reliably linked to their original parent key.
The absence of recoverable deleted Registry records does not establish that Registry deletion did not occur. Deleted cells may be reused or overwritten through subsequent Registry activity, and sufficient structural information may no longer remain to recover or reassociate the deleted object.
Sections
| ID | Name | Description |
|---|---|---|
| AF007 | Modify Windows Registry | A subject may modify keys or key values within the Windows Registry to conceal actions they have conducted related to an infringement. |
| AF007.001 | Delete or Modify Registry Key | The subject deletes or modifies Windows Registry keys to hinder an investigation by removing information that can be used by investigators. Many actions and configurations on a Windows system are logged or stored in the registry. Deleting these keys can make it harder for investigators to trace the attacker's steps and understand what changes were made to the system. |
| AF007.002 | Delete or Modify Registry Key Value | The subject deletes or modifies Windows Registry key values to hinder an investigation by removing information that can be used by investigators. Many actions and configurations on a Windows system are logged or stored in the registry. Deleting key values can make it harder for investigators to trace the attacker's steps and understand what changes were made to the system. |