Book Image

Windows Forensics Cookbook

By : Scar de Courcier, Oleg Skulkin
Book Image

Windows Forensics Cookbook

By: Scar de Courcier, Oleg Skulkin

Overview of this book

Windows Forensics Cookbook provides recipes to overcome forensic challenges and helps you carry out effective investigations easily on a Windows platform. You will begin with a refresher on digital forensics and evidence acquisition, which will help you to understand the challenges faced while acquiring evidence from Windows systems. Next you will learn to acquire Windows memory data and analyze Windows systems with modern forensic tools. We also cover some more in-depth elements of forensic analysis, such as how to analyze data from Windows system artifacts, parse data from the most commonly-used web browsers and email services, and effectively report on digital forensic investigations. You will see how Windows 10 is different from previous versions and how you can overcome the specific challenges it brings. Finally, you will learn to troubleshoot issues that arise while performing digital forensic investigations. By the end of the book, you will be able to carry out forensics investigations efficiently.

Related Content you might be interested in

Current Title:

Small book image
Windows Forensics Cookbook
Scar de Courcier | Oleg Skulkin
Aug, 2017 | 274 pages
No titles found
Table of Contents (13 chapters)
Preface
Preface
What this book covers
What you need for this book
Who this book is for
Sections
Conventions
Customer support
Free Chapter
1
Digital Forensics and Evidence Acquisition
Digital Forensics and Evidence Acquisition
Introduction
Identifying evidence sources
Ensuring evidence is forensically sound
Writing reports
Digital forensic investigation - an international field
Challenges of acquiring digital evidence from Windows systems
2
Windows Memory Acquisition and Analysis
Windows Memory Acquisition and Analysis
Introduction
Windows memory acquisition with Belkasoft RAM Capturer
Windows memory acquisition with DumpIt
Windows memory image analysis with Belkasoft Evidence Center
Windows memory image analysis with Volatility
Variations in Windows versions
3
Windows Drive Acquisition
Windows Drive Acquisition
Introduction
Drive acquisition in E01 format with FTK Imager
Drive acquisition in RAW format with dc3dd
Mounting forensic images with Arsenal Image Mounter
4
Windows File System Analysis
Windows File System Analysis
Introduction
NTFS Analysis with The Sleuth Kit
Undeleting files from NTFS with Autopsy
Undeleting files from ReFS with ReclaiMe File Recovery
File carving with PhotoRec
5
Windows Shadow Copies Analysis
Windows Shadow Copies Analysis
Introduction
Browsing and copying files from VSCs on a live system with ShadowCopyView
Mounting VSCs from disk images with VSSADMIN and MKLINK
Processing and analyzing VSC data with Magnet AXIOM
6
Windows Registry Analysis
Windows Registry Analysis
Introduction
Extracting and viewing Windows Registry files with Magnet AXIOM
Parsing registry files with RegRipper
Recovering deleted Registry artifacts with Registry Explorer
Registry analysis with FTK Registry Viewer
7
Main Windows Operating System Artifacts
Main Windows Operating System Artifacts
Introduction
Recycle Bin content analysis with EnCase Forensic
Recycle bin content analysis with Rifiuti2
Recycle bin content analysis with Magnet AXIOM
Event log analysis with FullEventLogView
Event log analysis with Magnet AXIOM
Event log recovery with EVTXtract
LNK file analysis with EnCase forensic
LNK file analysis with LECmd
LNK file analysis with Link Parser
Prefetch file analysis with Magnet AXIOM
Prefetch file parsing with PECmd
Prefetch file recovery with Windows Prefetch Carver
8
Web Browser Forensics
Web Browser Forensics
Introduction
Mozilla Firefox analysis with BlackBag's BlackLight
Google Chrome analysis with Magnet AXIOM
Microsoft Internet Explorer and Microsoft Edge analysis with Belkasoft Evidence Center
Extracting web browser data from Pagefile.sys
9
Email and Instant Messaging Forensics
Email and Instant Messaging Forensics
Introduction
Outlook mailbox parsing with Intella
Thunderbird mailbox parsing with Autopsy
Webmail analysis with Magnet AXIOM
Skype forensics with Belkasoft Evidence Center
Skype forensics with SkypeLogView
10
Windows 10 Forensics
Windows 10 Forensics
Introduction
Parsing Windows 10 Notifications
Cortana forensics
OneDrive forensics
Dropbox forensics
Windows 10 mail app
Windows 10 Xbox App
11
Data Visualization
Data Visualization
Introduction
Data visualization with FTK
Making a timeline in Autopsy
Nuix Web Review & Analytics
12
Troubleshooting in Windows Forensic Analysis
Troubleshooting in Windows Forensic Analysis
Introduction
Troubleshooting in commercial tools
Troubleshooting in free and open source tools
Troubleshooting when processes fail
False positives during data processing with digital forensics software
Taking your first steps in digital forensics
Advanced further reading

Customer support

Now that you are the proud owner of a Packt book, we have a number of things to help you to get the most from your purchase.

Downloading the color images of this book

Errata

Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you find a mistake in one of our books-maybe a mistake in the text or the code-we would be grateful if you could report this to us. By doing so, you can save other readers from frustration and help us improve subsequent versions of this book. If you find any errata, please report them by visiting http://www.packtpub.com/submit-errata, selecting your book, clicking on the Errata Submission Form link, and entering the details of your errata. Once your errata are verified, your submission will be accepted and the errata will be uploaded to our website or added to any list of existing errata under the Errata section of that title.

To view the previously submitted errata, go to https://www.packtpub.com/books/content/support and enter the name of the book in the search field. The required information will appear under the Errata section.

Piracy

Piracy of copyrighted material on the Internet is an ongoing problem across all media. At Packt, we take the protection of our copyright and licenses very seriously. If you come across any illegal copies of our works in any form on the Internet, please provide us with the location address or website name immediately so that we can pursue a remedy.

Please contact us at [email protected] with a link to the suspected pirated material.

We appreciate your help in protecting our authors and our ability to bring you valuable content.

Questions

If you have a problem with any aspect of this book, you can contact us at [email protected], and we will do our best to address the problem.

Previous Section
Next Chapter