On the persistence of deleted windows registry data structures
Damir Kahvedžić, Tahar Kechadi · 2009
Deleted entries in the Windows Registry remain in the hives that contain them but their space is marked as free for future use. In this paper we analyse the fragmentation of these deallocated blocks and how long they persist by surveying a number of hives over a long period of time. We formalise retrieval of data and define 'consistency' with respect to deleted keys. We illustrate how uninstallation programs may inadvertently corrupt the keys they are deleting in the uninstallation process by analysing the keys during the uninstallation of a popular media software suite.