Book Overview & Buying
Table Of Contents
Feedback & Rating

Windows Forensics Cookbook

By : de Courcier, Oleg Skulkin

5 (2)

Buy this Book

Windows Forensics Cookbook

5 (2)

By: de Courcier, Oleg Skulkin

Buy this Book

Overview of this book

Windows Forensics Cookbook provides recipes to overcome forensic challenges and helps you carry out effective investigations easily on a Windows platform. You will begin with a refresher on digital forensics and evidence acquisition, which will help you to understand the challenges faced while acquiring evidence from Windows systems. Next you will learn to acquire Windows memory data and analyze Windows systems with modern forensic tools. We also cover some more in-depth elements of forensic analysis, such as how to analyze data from Windows system artifacts, parse data from the most commonly-used web browsers and email services, and effectively report on digital forensic investigations. You will see how Windows 10 is different from previous versions and how you can overcome the specific challenges it brings. Finally, you will learn to troubleshoot issues that arise while performing digital forensic investigations. By the end of the book, you will be able to carry out forensics investigations efficiently.

Preface

What this book covers

What you need for this book

Who this book is for

Sections

Conventions

Customer support

Free Chapter

Digital Forensics and Evidence Acquisition

Introduction

Identifying evidence sources

Ensuring evidence is forensically sound

Writing reports

Digital forensic investigation - an international field

Challenges of acquiring digital evidence from Windows systems

Windows Memory Acquisition and Analysis

Introduction

Windows memory acquisition with Belkasoft RAM Capturer

Windows memory acquisition with DumpIt

Windows memory image analysis with Belkasoft Evidence Center

Windows memory image analysis with Volatility

Variations in Windows versions

Windows Drive Acquisition

Introduction

Drive acquisition in E01 format with FTK Imager

Drive acquisition in RAW format with dc3dd

Mounting forensic images with Arsenal Image Mounter

Windows File System Analysis

Introduction

NTFS Analysis with The Sleuth Kit

Undeleting files from NTFS with Autopsy

Undeleting files from ReFS with ReclaiMe File Recovery

File carving with PhotoRec

Windows Shadow Copies Analysis

Introduction

Browsing and copying files from VSCs on a live system with ShadowCopyView

Mounting VSCs from disk images with VSSADMIN and MKLINK

Processing and analyzing VSC data with Magnet AXIOM

Windows Registry Analysis

Introduction

Extracting and viewing Windows Registry files with Magnet AXIOM

Parsing registry files with RegRipper

Recovering deleted Registry artifacts with Registry Explorer

Registry analysis with FTK Registry Viewer

Main Windows Operating System Artifacts

Introduction

Recycle Bin content analysis with EnCase Forensic

Recycle bin content analysis with Rifiuti2

Recycle bin content analysis with Magnet AXIOM

Event log analysis with FullEventLogView

Event log analysis with Magnet AXIOM

Event log recovery with EVTXtract

LNK file analysis with EnCase forensic

LNK file analysis with LECmd

LNK file analysis with Link Parser

Prefetch file analysis with Magnet AXIOM

Prefetch file parsing with PECmd

Prefetch file recovery with Windows Prefetch Carver

Web Browser Forensics

Introduction

Mozilla Firefox analysis with BlackBag's BlackLight

Google Chrome analysis with Magnet AXIOM

Microsoft Internet Explorer and Microsoft Edge analysis with Belkasoft Evidence Center

Extracting web browser data from Pagefile.sys

Email and Instant Messaging Forensics

Introduction

Outlook mailbox parsing with Intella

Thunderbird mailbox parsing with Autopsy

Webmail analysis with Magnet AXIOM

Skype forensics with Belkasoft Evidence Center

Skype forensics with SkypeLogView

Windows 10 Forensics

Introduction

Parsing Windows 10 Notifications

Cortana forensics

OneDrive forensics

Dropbox forensics

Windows 10 mail app

Windows 10 Xbox App

Data Visualization

Introduction

Data visualization with FTK

Making a timeline in Autopsy

Nuix Web Review & Analytics

Troubleshooting in Windows Forensic Analysis

Introduction

Troubleshooting in commercial tools

Troubleshooting in free and open source tools

Troubleshooting when processes fail

False positives during data processing with digital forensics software

Taking your first steps in digital forensics

Advanced further reading

Customer Reviews

5 (2)

5 star

100%

4 star

3 star

2 star

1 star

Introduction

The Windows Registry is one of the richest sources of digital evidence. You can find lots of extremely useful pieces of information during examination of the Registry hives and keys. Computer configurations, recently visited webpages and opened documents, connected USB devices, and many other artifacts can all be acquired through Windows Registry forensic examination.

The Registry has a tree structure. Each tree consists of keys, and each key may have one or more subkeys and values.

As forensic examiners usually deal with drive images, it's very important to know where these registry files are stored. The first six files are located at C:\Windows\System32\config. These files are: