Book Image

Windows Forensics Cookbook

By : Scar de Courcier, Oleg Skulkin
Book Image

Windows Forensics Cookbook

By: Scar de Courcier, Oleg Skulkin

Overview of this book

Windows Forensics Cookbook provides recipes to overcome forensic challenges and helps you carry out effective investigations easily on a Windows platform. You will begin with a refresher on digital forensics and evidence acquisition, which will help you to understand the challenges faced while acquiring evidence from Windows systems. Next you will learn to acquire Windows memory data and analyze Windows systems with modern forensic tools. We also cover some more in-depth elements of forensic analysis, such as how to analyze data from Windows system artifacts, parse data from the most commonly-used web browsers and email services, and effectively report on digital forensic investigations. You will see how Windows 10 is different from previous versions and how you can overcome the specific challenges it brings. Finally, you will learn to troubleshoot issues that arise while performing digital forensic investigations. By the end of the book, you will be able to carry out forensics investigations efficiently.

Related Content you might be interested in

Current Title:

Small book image
Windows Forensics Cookbook
Scar de Courcier | Oleg Skulkin
Aug, 2017 | 274 pages
No titles found
Table of Contents (13 chapters)
Preface
Preface
What this book covers
What you need for this book
Who this book is for
Sections
Conventions
Customer support
Free Chapter
1
Digital Forensics and Evidence Acquisition
Digital Forensics and Evidence Acquisition
Introduction
Identifying evidence sources
Ensuring evidence is forensically sound
Writing reports
Digital forensic investigation - an international field
Challenges of acquiring digital evidence from Windows systems
2
Windows Memory Acquisition and Analysis
Windows Memory Acquisition and Analysis
Introduction
Windows memory acquisition with Belkasoft RAM Capturer
Windows memory acquisition with DumpIt
Windows memory image analysis with Belkasoft Evidence Center
Windows memory image analysis with Volatility
Variations in Windows versions
3
Windows Drive Acquisition
Windows Drive Acquisition
Introduction
Drive acquisition in E01 format with FTK Imager
Drive acquisition in RAW format with dc3dd
Mounting forensic images with Arsenal Image Mounter
4
Windows File System Analysis
Windows File System Analysis
Introduction
NTFS Analysis with The Sleuth Kit
Undeleting files from NTFS with Autopsy
Undeleting files from ReFS with ReclaiMe File Recovery
File carving with PhotoRec
5
Windows Shadow Copies Analysis
Windows Shadow Copies Analysis
Introduction
Browsing and copying files from VSCs on a live system with ShadowCopyView
Mounting VSCs from disk images with VSSADMIN and MKLINK
Processing and analyzing VSC data with Magnet AXIOM
6
Windows Registry Analysis
Windows Registry Analysis
Introduction
Extracting and viewing Windows Registry files with Magnet AXIOM
Parsing registry files with RegRipper
Recovering deleted Registry artifacts with Registry Explorer
Registry analysis with FTK Registry Viewer
7
Main Windows Operating System Artifacts
Main Windows Operating System Artifacts
Introduction
Recycle Bin content analysis with EnCase Forensic
Recycle bin content analysis with Rifiuti2
Recycle bin content analysis with Magnet AXIOM
Event log analysis with FullEventLogView
Event log analysis with Magnet AXIOM
Event log recovery with EVTXtract
LNK file analysis with EnCase forensic
LNK file analysis with LECmd
LNK file analysis with Link Parser
Prefetch file analysis with Magnet AXIOM
Prefetch file parsing with PECmd
Prefetch file recovery with Windows Prefetch Carver
8
Web Browser Forensics
Web Browser Forensics
Introduction
Mozilla Firefox analysis with BlackBag's BlackLight
Google Chrome analysis with Magnet AXIOM
Microsoft Internet Explorer and Microsoft Edge analysis with Belkasoft Evidence Center
Extracting web browser data from Pagefile.sys
9
Email and Instant Messaging Forensics
Email and Instant Messaging Forensics
Introduction
Outlook mailbox parsing with Intella
Thunderbird mailbox parsing with Autopsy
Webmail analysis with Magnet AXIOM
Skype forensics with Belkasoft Evidence Center
Skype forensics with SkypeLogView
10
Windows 10 Forensics
Windows 10 Forensics
Introduction
Parsing Windows 10 Notifications
Cortana forensics
OneDrive forensics
Dropbox forensics
Windows 10 mail app
Windows 10 Xbox App
11
Data Visualization
Data Visualization
Introduction
Data visualization with FTK
Making a timeline in Autopsy
Nuix Web Review & Analytics
12
Troubleshooting in Windows Forensic Analysis
Troubleshooting in Windows Forensic Analysis
Introduction
Troubleshooting in commercial tools
Troubleshooting in free and open source tools
Troubleshooting when processes fail
False positives during data processing with digital forensics software
Taking your first steps in digital forensics
Advanced further reading

Introduction

The Windows Registry is one of the richest sources of digital evidence. You can find lots of extremely useful pieces of information during examination of the Registry hives and keys. Computer configurations, recently visited webpages and opened documents, connected USB devices, and many other artifacts can all be acquired through Windows Registry forensic examination.

The Registry has a tree structure. Each tree consists of keys, and each key may have one or more subkeys and values.

As forensic examiners usually deal with drive images, it's very important to know where these registry files are stored. The first six files are located at C:\Windows\System32\config. These files are:

  • COMPONENTS
  • DEFAULT
  • SAM
  • SECURITY
  • SOFTWARE
  • SYSTEM

There are also two files for each user account:

  • NTUSER.DAT, located at C:\Users\%Username%\
  • UsrClass.dat, located at C:\Users\%Username...
Previous Section
End of Section 2
Next Section