The Registry Hives you may be MSIX-ing

The talk starts from a gap in typical Windows forensics: examiners tend to rely on a few registry hives, such as NTUSER.DAT and UsrClass.dat, to reconstruct what a user opened, browsed, or connected to. Apps packaged with MSIX store their state in per-application hives under the local packages folder, so those traces can sit outside the usual locations.

The speaker demonstrates this with Notepad, where open and save dialog history and folder traversal are written to a per-app user hive rather than the main one. A test using a folder on an external device showed the browsing evidence missing from the standard shellbag search but present in the app's hive. Similar behaviour appears with WinSCP session and directory history, and with the Microsoft Remote Desktop app, which keeps connection history in XML jump list files, cached session thumbnails, and ETL logs that record computer names rather than IP addresses. Practical steps cover collecting hives with KAPE, parsing them with RegRipper and Registry Explorer, and decoding thumbnails.

The main takeaway is that examiners should check package folders and per-application hives alongside the traditional locations, or evidence of data access, exfiltration, and lateral movement can be missed. Audience questions touched on overlap between apps and whether deleted keys could be recovered, which the speaker said he had not yet seen in cases.