CurrentControlSet (Windows)

Posted by:  /  Tags: , , , ,  /  Comments: 3

Author Name
Joe Garcia

Artifact Name
CurrentControlSet (Windows Registry)

A Control Set contains system configuration information for a Windows Operating System. Windows maintains two Control Sets and knowing which one to focus on during your examination is critical. Knowing the CurrentControlSet will be important to gather information of evidentiary importance such as Computer Name, Time Zone information, Shutdown Times, and even what USB Devices connected to the system.

Once you have exported out the Registry Hive of the computer that you are examining, you can use MiTeC’s Windows Registry Analyzer or AccessData’s Registry Viewer to determine what the CurrentControlSet is. Use either of those programs to open the SYSTEM Hive. You will see the following once it is open:

Now navigate to the SYSTEM\Select key. It is here you will see 4 entries. Current, Default, Failed and LastKnownGood. Current is the CurrentControlSet used last boot up the system. Default usually matches the Current. Failed denotes which control set that was unable to successfully boot into the system and LastKnownGood is the control set that last successfully booted into the system.

Going back to your registry viewer of choice, find the Select key and highlight it:

In the example above, you will see Current has a value of 0x1 or (1). This means that the CurrentControlSet is ControlSet001. That means you must focus on ControlSet001 to gather the information that you are looking for during your examination. As you can see in the above screenshots, the Default value matches the Current value. Looking at the Failed entry, it shows a value of 0x0 which means that there was no failed boot ups. Finally, the LastKnownGood value shows 0x2 or (2), meaning that ControlSet002 previously booted into the system successfully.

Registry Keys

Research Links

Forensic Programs of Use
MiTeC Windows Registry Analyzer (by Michal Mutl)- (found under Registry/INI Tools)

AccessData Registry Viewer-



[…] This post was mentioned on Twitter by sansforensics, Jose Antonio, Forensic Artifacts, Roberto Martinez, CyberCrime101 and others. CyberCrime101 said: RT @sansforensics: CurrentControlSet (Windows) (via @4n6artifacts) […]


[…] for the Windows machine you are examining.  You can follow the instructions for doing that HERE.  Once you have done that, proceed to […]

Bobby Spector

September 11, 2013



Thanks for the useful info, and please note –

Registry Viewer is here:
and still available.

Leave a Reply

Your Name: (required)

Your Email: (will not be published) (required)

Your Website:

Your Message:

submit comment