The document provides an overview of key forensic artifacts and changes in the Windows Vista operating system. In 3 sentences: Vista introduced changes to the Recycle Bin, encryption with EFS keys on smart cards, default folder organization with junction links, registry virtualization for non-admin writes, an updated thumbnail cache format, new event log format with .evtx extension, and use of volume shadow copies for restoring previous versions of files and retrieving deleted data through differential disk imaging. Analysis of Vista systems requires examining multiple registry hives and investigating artifacts like prefetch files, volume shadow copies, and the thumbnail cache for evidentiary value.

1. Vista Forensics (Before Windows 7 Changes Things) Troy Larson Microsoft Corporation

4. The New Recycle Bin

5. The New Recycle Bin Note the deleted date (in blue). $MFT FRS of $IWYOWJ2.docx

6. The New Recycle Bin $MFT FRS of $RWYOWJ2.docx

7. The New Recycle Bin First cluster of $RWYOWJ2.docx

9. Default Folder Organization The legacy folders are junction links to the new folders. To navigate, follow the links.

12. Special Folders: IE Protected Mode IE Protected Mode http://msdn.microsoft.com/en-us/library/bb250462.aspx

14. File and Folder Virtualization

16. Registry Virtualization The virtualized registry entries are stored here.

20. Transactional Registry

24. Superfetch

26. Superfetch

27. Thumbcache

32. Thumbcache

37. Setupapi.log The location of the setupapi.log file has been changed. The new location is: C:indowsNFetupapi.dev.log

40. Volume Shadow Copy

41. Volume Shadow Copy

42. Volume Shadow Copy

43. Volume Shadow Copy vssadmin list shadows /for=[volume]:

44. Volume Shadow Copy

45. Volume Shadow Copy Shadow copies can be exposed through symbolic links.

46. Volume Shadow Copy Mklink /d C:test-shadow} ?LOBALROOTevicearddiskVolumeShadowCopy3

47. Volume Shadow Copy Shadow copy is addressed as ?LOBALROOTevicearddiskVolumeShadowCopy3

48. Volume Shadow Copy

49. Volume Shadow Copy

50. Volume Shadow Copy Shadow copies can be mounted as volumes using dosdev.exe.

51. Volume Shadow Copy Dosdev y: ?LOBALROOTevicearddiskVolumeShadowCopy2

52. Volume Shadow Copy Shadow copy is addressed as ?LOBALROOTevicearddiskVolumeShadowCopy2

53. Volume Shadow Copy

57. Volume Shadow Copy

58. Volume Shadow Copy

59. Volume Shadow Copy

61. Volume Shadow Copy Shadow copies can be imaged.

62. Volume Shadow Copy dd.Exe –v if= .arddiskVolumeShadowCopy4 of=K:hadow4.dd --localwrt

63. Volume Shadow Copy Shadow copy is addressed as .arddiskVolumeShadowCopy4

64. Volume Shadow Copy Images of shadow copies can be opened in forensics tools and appear as logical volumes.

65. Volume Shadow Copy

66. Volume Shadow Copy Compare the imaged version to the mounted shadow copy.

67. Volume Shadow Copy Deleted data is captured by shadow copies, and is available for retrieval in shadow copy images.

68. Volume Shadow Copy Every shadow copy data set should approximate the size of the original volume. Thus, a conundrum: How to gather all the shadow copy data? Amount of case data=(number of shadow copies) x (size of the volume)+(size of the volume).

72. Volume Shadow Copy

74. Finally