WINDOWS FORENSIC ANALYSIS DVD TOOLKIT
CONTENTS CHAPTER 1 LIVE RESPONSE: COLLECTING VOLATILE DATA INTRODUCTION LIVE RESPONSE LOCARD’S EXCHANGE PRINCIPLE ORDER OF VOLATILITY WHEN TO PERFORM LIVE RESPONSE WHAT DATA TO COLLECT SYSTEM TIME LOGGED-ON USERS PSLOGGEDON NET SESSIONS LOGONSESSIONS OPEN FILES NETWORK INFORMATION (CACHED NETBIOS NAME TABLE) NETWORK CONNECTIONS NETSTAT PROCESS INFORMATION TLIST TASKLIST PSLIST LISTDLLS HANDLE PROCESS-TO-PORT MAPPING FPORT TCPVCON PROCESS MEMORY NETWORK STATUS IPCONFIG PROMISCDETECT AND PROMQRY CLIPBOARD CONTENTS SERVICE/DRIVER INFORMATION COMMAND HISTORY MAPPED DRIVES SHARES NONVOLATILE INFORMATION REGISTRY SETTINGS CLEARPAGEFILEATSHUTDOWN DISABLELASTACCESS AUTORUNS EVENT LOGS DEVICES AND OTHER INFORMATION A WORD ABOUT PICKING YOUR TOOLS LIVE-RESPONSE METHODOLOGIES LOCAL RESPONSE METHODOLOGY REMOTE RESPONSE METHODOLOGY THE HYBRID APPROACH (A K A USING THE FSP) SUMMARY SOLUTIONS FAST TRACK FREQUENTLY ASKED QUESTIONS CHAPTER 2 LIVE RESPONSE: DATA ANALYSIS DATA ANALYSIS EXAMPLE 1 EXAMPLE 2 EXAMPLE 3 AGILE ANALYSIS EXPANDING THE SCOPE REACTION PREVENTION CHAPTER 3 WINDOWS MEMORY ANALYSIS A BRIEF HISTORY COLLECTING PROCESS MEMORY DUMPING PHYSICAL MEMORY NIGILANT32 PRODISCOVER KNTDD MDD WIN32DD MEMORYZE WINEN FASTDUMP F-RESPONSE SECTION SUMMARY ALTERNATIVE APPROACHES FOR DUMPING PHYSICAL MEMORY HARDWARE DEVICES FIREWIRE CRASH DUMPS VIRTUALIZATION HIBERNATION FILE ANALYZING A PHYSICAL MEMORY DUMP DETERMINING THE OPERATING SYSTEM OF A DUMP FILE PROCESS BASICS EPROCESS STRUCTURE PROCESS CREATION MECHANISM PARSING MEMORY DUMP CONTENTS LSPROC PL LSPD PL VOLATILITY FRAMEWORK HBGARY RESPONDER PARSING PROCESS MEMORY EXTRACTING THE PROCESS IMAGE MEMORY DUMP ANALYSIS AND THE PAGE FILE POOL ALLOCATIONS CHAPTER 4 REGISTRY ANALYSIS INSIDE THE REGISTRY REGISTRY STRUCTURE WITHIN A HIVE FILE THE REGISTRY AS A LOG FILE MONITORING CHANGES TO THE REGISTRY REGISTRY ANALYSIS REGRIPPER RIP RIPXP SYSTEM INFORMATION COMPUTERNAME TIMEZONEINFORMATION NETWORK INTERFACES MAC ADDRESS AUDIT POLICY AND EVENT LOGS WIRELESS SSIDS AUTOSTART LOCATIONS SYSTEM BOOT USER LOGIN USER ACTIVITY ENUMERATING AUTOSTART REGISTRY LOCATIONS AUTORUN FUNCTIONALITY NTFSDISABLELASTACCESSUPDATE NUKEONDELETE USB REMOVABLE STORAGE DEVICES USB DEVICE ISSUES MOUNTED DEVICES PORTABLE DEVICES FINDING USERS TRACKING USER ACTIVITY THE USERASSIST KEYS MUICACHE MRU LISTS SEARCH ASSISTANT CONNECTING TO OTHER SYSTEMS CD BURNING IM AND P2P WINDOWS XP SYSTEM RESTORE POINTS REDIRECTION DELETED REGISTRY KEYS DVD CONTENTS CHAPTER 5 FILE ANALYSIS LOG FILES UNDERSTANDING EVENTS EVENT LOG FILE FORMAT EVENT LOG HEADER EVENT RECORD STRUCTURE VISTA EVENT LOGS IIS LOGS LOG PARSER WEB BROWSER HISTORY OTHER LOG FILES SETUPLOG TXT SETUPACT LOG SETUPAPI LOG NETSETUP LOG TASK SCHEDULER LOG XP FIREWALL LOGS MRT LOG DR WATSON LOGS CBS LOG CRASH DUMP FILES RECYCLE BIN VISTA RECYCLE BIN XP SYSTEM RESTORE POINTS RP LOG FILES CHANGE LOG X FILES VISTA VOLUME SHADOW COPY SERVICE PREFETCH FILES VISTA SUPERFETCH SHORTCUT FILES FILE METADATA WORD DOCUMENTS PDF DOCUMENTS IMAGE FILES FILE SIGNATURE ANALYSIS NTFS ALTERNATE DATA STREAMS CREATING ADSES ENUMERATING ADSES USING ADSES REMOVING ADSES ADS SUMMARY ALTERNATIVE METHODS OF ANALYSIS MOUNTING AN IMAGE DISCOVERING MALWARE TIMELINE ANALYSIS CHAPTER 6 EXECUTABLE FILE ANALYSIS STATIC ANALYSIS LOCATING FILES TO ANALYZE DOCUMENTING THE FILE ANALYSIS THE PE HEADER IMPORT TABLES EXPORT TABLE RESOURCES OBFUSCATION BINDERS PACKERS CRYPTORS DYNAMIC ANALYSIS TESTING ENVIRONMENT THROWAWAY SYSTEMS TOOLS PROCESS CHAPTER 7 ROOTKITS AND ROOTKIT DETECTION ROOTKITS ROOTKIT DETECTION LIVE DETECTION ROOTKITREVEALER GMER HELIOS MS STRIDER GHOSTBUSTER F-SECURE BLACKLIGHT SOPHOS ANTI-ROOTKIT ANTIROOTKIT COM POSTMORTEM DETECTION CHAPTER 8 TYING IT ALL TOGETHER CASE STUDIES CASE STUDY 1: THE DOCUMENT TRAIL CASE STUDY 2: INTRUSION CASE STUDY 3: DFRWS 2008 FORENSIC RODEO CASE STUDY 4: COPYING FILES CASE STUDY 5: NETWORK INFORMATION CASE STUDY 6: SQL INJECTION CASE STUDY 7: THE APP DID IT GETTING STARTED DOCUMENTATION GOALS CHECKLISTS NOW WHAT? EXTENDING TIMELINE ANALYSIS CHAPTER 9 PERFORMING ANALYSIS ON A BUDGET DOCUMENTING YOUR ANALYSIS ACQUIRING IMAGES FTK IMAGER IMAGE ANALYSIS THE SLEUTHKIT PYFLAG PRODISCOVER BASIC MOUNTING AN IMAGE FILE FILE ANALYSIS HASHING UTILITIES HEX EDITORS NETWORK TOOLS SCANNING PACKET CAPTURE AND ANALYSIS SEARCH UTILITIES