SOFTWARE Registry Hive

The SOFTWARE hive is the largest of the system registry hives and the single most information-dense artifact on a Windows system. It records every program ever installed, the exact OS build, every network the machine has connected to, timezone configuration, and the AppID mappings that make SRUM analysis possible.

What Is the SOFTWARE Hive?

The SOFTWARE registry hive is a system-level configuration database loaded into HKLM\SOFTWARE at boot time. It stores machine-wide application settings, operating system configuration, installed program records, network profile history, and COM class registrations. Unlike per-user hives (NTUSER.DAT, UsrClass.dat), the SOFTWARE hive captures system-level state that applies to all users and services on the machine.

Forensically, the SOFTWARE hive is indispensable for three reasons. First, it provides the installed programs inventory — the Uninstall keys record every application that registered itself with Windows, including installation dates, publisher names, and installation paths. Second, it contains the OS version and build number, which determines which artifacts are available and which parsing tools to use. Third, it stores the SRUM AppID mapping table that converts integer identifiers in SRUM.db to human-readable executable paths. Without the SOFTWARE hive, SRUM output shows meaningless numbers instead of paths like C:\Users\jdoe\AppData\Local\Temp\rc.exe.

The hive typically ranges from 30 MB to over 200 MB, making it the largest of the five system registry hives (SAM, SECURITY, SOFTWARE, SYSTEM, DEFAULT). Its size reflects the cumulative history of every application installation, update, and configuration change on the system.

Location & Format

File Paths

Hive Format

The SOFTWARE hive uses the standard Windows registry hive format (regf). It consists of bins (hbin) containing cells (key nodes, value nodes, subkey lists, and data cells). Each key node has a last-written timestamp (FILETIME format, 100-nanosecond resolution) that records the most recent modification to that key or its values. These timestamps are critical for establishing when software was installed, when settings were changed, and when network connections occurred.

What It Reveals

Forensic Use Cases

Unauthorized Software Installation

The Uninstall keys record every application that registered with Windows, including the InstallDate (YYYYMMDD string) and the key’s last-written timestamp. By correlating installation dates with the investigation timeline, investigators can identify tools installed by an attacker — remote access software (AnyDesk, TeamViewer, ScreenConnect), exfiltration tools (rclone, WinSCP, MEGASync), or hacking utilities that registered themselves during installation.

SRUM AppID Resolution

SRUM.db stores application identifiers as integers. The SOFTWARE hive contains the SRUM\Extensions key that maps these integers to executable paths. Without this mapping, SRUM output shows entries like AppId: 42 instead of C:\Users\jdoe\AppData\Local\Temp\rc.exe. Every SRUM analysis workflow requires the SOFTWARE hive as input alongside the SRUM.db file.

Network Location History

The NetworkList profiles record Wi-Fi SSIDs, VPN connection names, and wired network identifiers with first-connected and last-connected timestamps. In insider threat cases, this data can prove a laptop was connected to a competitor’s Wi-Fi network, a personal hotspot, or an unauthorized network — establishing physical location and network context that event logs alone cannot provide.

OS Profiling and Artifact Availability

The Windows NT\CurrentVersion key provides the exact OS version, build number, and Update Build Revision (UBR). This information determines which forensic artifacts are available (e.g., SRUM exists only on Windows 8+, BAM/DAM only on Windows 10 1709+), which parsing tools are compatible, and which exploit paths were viable at the time of the incident.

Acquisition Methods

Live System — Registry Save

:: Save SOFTWARE hive from live system
reg save HKLM\SOFTWARE C:\Evidence\SOFTWARE

:: Using KAPE to collect all registry hives
kape.exe --tsource C: --tdest C:\Evidence\KAPE_Output --target RegistryHives

:: Using RawCopy to bypass NTFS locks
RawCopy.exe /FileNamePath:C:\Windows\System32\config\SOFTWARE /OutputPath:C:\Evidence\

Forensic Image — Direct Extraction

# Mount forensic image read-only
mount -o ro,noexec,nodev /dev/sdb1 /mnt/evidence

# Copy SOFTWARE hive and transaction logs
cp /mnt/evidence/Windows/System32/config/SOFTWARE /analysis/registry/
cp /mnt/evidence/Windows/System32/config/SOFTWARE.LOG1 /analysis/registry/
cp /mnt/evidence/Windows/System32/config/SOFTWARE.LOG2 /analysis/registry/

# RegBack copy (may be 0 bytes on Win10 1803+)
cp /mnt/evidence/Windows/System32/config/RegBack/SOFTWARE /analysis/registry/SOFTWARE.regback 2>/dev/null

Parsing Tools & Analysis

Installed Software Enumeration

# RegRipper: extract installed programs
rip.pl -r /analysis/registry/SOFTWARE -p uninstall

# RegRipper: extract network profiles
rip.pl -r /analysis/registry/SOFTWARE -p networklist

# RegRipper: extract OS version
rip.pl -r /analysis/registry/SOFTWARE -p winver

# RECmd: batch extraction with forensic plugin set
RECmd.exe -f C:\Evidence\SOFTWARE --bn BatchExamples\RECmd_Batch_MC.reb --csv C:\Analysis\

Python Script — Network Profile Timeline

from Registry import Registry

reg = Registry.Registry('/analysis/registry/SOFTWARE')
profiles = reg.open('Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles')

for subkey in profiles.subkeys():
    name = subkey.value('ProfileName').value()
    created = subkey.value('DateCreated').value()
    last_conn = subkey.value('DateLastConnected').value()
    desc = subkey.value('Description').value()
    print(f'{name} | Created: {created} | Last: {last_conn} | {desc}')

Sample Output — Suspicious Software Timeline

DisplayName              InstallDate   Publisher            InstallLocation
AnyDesk                  20260214      AnyDesk Software     C:\Program Files (x86)\AnyDesk
rclone v1.65.0           20260214                           C:\Users\jdoe\AppData\Local\rclone
MEGAsync                 20260213      Mega Ltd             C:\Users\jdoe\AppData\Local\MEGAsync
7-Zip 23.01              20251105      Igor Pavlov          C:\Program Files\7-Zip
Microsoft Office 365     20250815      Microsoft Corp       C:\Program Files\Microsoft Office

Retention & Persistence

Anti-Forensics Resilience

The SOFTWARE hive is a locked system file that cannot be directly modified by standard cleanup tools while Windows is running.

MITRE ATT&CK Detection Mapping

The SOFTWARE hive provides evidentiary support for detecting the following MITRE ATT&CK techniques:

Related Artifacts & Cross-References

References

1. Harlan Carvey, “RegRipper — SOFTWARE plugins” — https://github.com/keydet89/RegRipper3.0
2. Eric Zimmerman, “Registry Explorer / RECmd” — https://ericzimmerman.github.io/
3. SANS Institute, “Windows Forensic Analysis Poster” — https://www.sans.org/posters/windows-forensic-analysis/
4. Microsoft, “Windows Registry Reference” — https://learn.microsoft.com
5. 13Cubed, “Registry Forensics” — https://www.13cubed.com
6. Willi Ballenthin, “python-registry” — https://github.com/williballenthin/python-registry
7. Maxim Suhanov, “yarp — Yet Another Registry Parser” — https://github.com/msuhanov/yarp
8. ForensicArtifacts.com, “Windows Registry Artifact Definitions” — https://github.com/ForensicArtifacts/artifacts