Book Overview & Buying
Table Of Contents
Feedback & Rating

Windows Forensics Cookbook

By : de Courcier, Oleg Skulkin

5 (2)

Buy this Book

Windows Forensics Cookbook

5 (2)

By: de Courcier, Oleg Skulkin

Buy this Book

Overview of this book

Windows Forensics Cookbook provides recipes to overcome forensic challenges and helps you carry out effective investigations easily on a Windows platform. You will begin with a refresher on digital forensics and evidence acquisition, which will help you to understand the challenges faced while acquiring evidence from Windows systems. Next you will learn to acquire Windows memory data and analyze Windows systems with modern forensic tools. We also cover some more in-depth elements of forensic analysis, such as how to analyze data from Windows system artifacts, parse data from the most commonly-used web browsers and email services, and effectively report on digital forensic investigations. You will see how Windows 10 is different from previous versions and how you can overcome the specific challenges it brings. Finally, you will learn to troubleshoot issues that arise while performing digital forensic investigations. By the end of the book, you will be able to carry out forensics investigations efficiently.

Preface

What this book covers

What you need for this book

Who this book is for

Sections

Conventions

Customer support

Free Chapter

Digital Forensics and Evidence Acquisition

Introduction

Identifying evidence sources

Ensuring evidence is forensically sound

Writing reports

Digital forensic investigation - an international field

Challenges of acquiring digital evidence from Windows systems

Windows Memory Acquisition and Analysis

Introduction

Windows memory acquisition with Belkasoft RAM Capturer

Windows memory acquisition with DumpIt

Windows memory image analysis with Belkasoft Evidence Center

Windows memory image analysis with Volatility

Variations in Windows versions

Windows Drive Acquisition

Introduction

Drive acquisition in E01 format with FTK Imager

Drive acquisition in RAW format with dc3dd

Mounting forensic images with Arsenal Image Mounter

Windows File System Analysis

Introduction

NTFS Analysis with The Sleuth Kit

Undeleting files from NTFS with Autopsy

Undeleting files from ReFS with ReclaiMe File Recovery

File carving with PhotoRec

Windows Shadow Copies Analysis

Introduction

Browsing and copying files from VSCs on a live system with ShadowCopyView

Mounting VSCs from disk images with VSSADMIN and MKLINK

Processing and analyzing VSC data with Magnet AXIOM

Windows Registry Analysis

Introduction

Extracting and viewing Windows Registry files with Magnet AXIOM

Parsing registry files with RegRipper

Recovering deleted Registry artifacts with Registry Explorer

Registry analysis with FTK Registry Viewer

Main Windows Operating System Artifacts

Introduction

Recycle Bin content analysis with EnCase Forensic

Recycle bin content analysis with Rifiuti2

Recycle bin content analysis with Magnet AXIOM

Event log analysis with FullEventLogView

Event log analysis with Magnet AXIOM

Event log recovery with EVTXtract

LNK file analysis with EnCase forensic

LNK file analysis with LECmd

LNK file analysis with Link Parser

Prefetch file analysis with Magnet AXIOM

Prefetch file parsing with PECmd

Prefetch file recovery with Windows Prefetch Carver

Web Browser Forensics

Introduction

Mozilla Firefox analysis with BlackBag's BlackLight

Google Chrome analysis with Magnet AXIOM

Microsoft Internet Explorer and Microsoft Edge analysis with Belkasoft Evidence Center

Extracting web browser data from Pagefile.sys

Email and Instant Messaging Forensics

Introduction

Outlook mailbox parsing with Intella

Thunderbird mailbox parsing with Autopsy

Webmail analysis with Magnet AXIOM

Skype forensics with Belkasoft Evidence Center

Skype forensics with SkypeLogView

Windows 10 Forensics

Introduction

Parsing Windows 10 Notifications

Cortana forensics

OneDrive forensics

Dropbox forensics

Windows 10 mail app

Windows 10 Xbox App

Data Visualization

Introduction

Data visualization with FTK

Making a timeline in Autopsy

Nuix Web Review & Analytics

Troubleshooting in Windows Forensic Analysis

Introduction

Troubleshooting in commercial tools

Troubleshooting in free and open source tools

Troubleshooting when processes fail

False positives during data processing with digital forensics software

Taking your first steps in digital forensics

Advanced further reading

Customer Reviews

5 (2)

5 star

100%

4 star

3 star

2 star

1 star

Introduction

Before you can begin analysing evidence from a source, it first of all needs to be imaged. This describes a forensic process in which an exact copy of a drive is made. This is an important step, especially if evidence needs to be taken to court, because forensic investigators must be able to demonstrate that they have not altered the evidence in any way.

The term forensic image can refer to either a physical or a logical image. Physical images are precise replicas of the drives they reference, whereas a logical image is a copy of a certain volume within that drive. In general, logical images show what the machine’s user will have seen and dealt with, whereas physical images give a more comprehensive overview of how the device works at a higher level.

A hash value is generated to verify the authenticity of the acquired image. Hash values are essentially cryptographic...