SlideShare a Scribd company logo
Windows 10
Forensics
OS Evidentiary
Artefacts
Version 1.5 (Build 10240)
Brent Muir – 2015
Topics
OS Artefacts :
▫ File Systems / Partitions
▫ Registry Hives
▫ Event Logs
▫ Prefetch
▫ Shellbags
▫ LNK Shortcuts
▫ Thumbcache
▫ Recycle Bin
▫ Volume Shadow Copies
▫ Windows Indexing Service
▫ Cortana (Search)
▫ Notification Centre
▫ Picture Password
Application Artefacts:
▫ Windows Store
▫ Edge Browser (previously Spartan)
 Legacy Internet Explorer
▫ Email (Mail application)
▫ Unified Communication
 Twitter
 Skype
 OneDrive
▫ Microsoft Office Apps
 Word
 Excel
 PowerPoint
 OneNote
▫ Maps
Part 1
File Systems / Partitions
• Supported File Systems:
▫ NTFS, Fat32, ExFat
• Default Partition structure:
▫ “Windows” – core OS (NTFS)
▫ “Recovery” (NTFS)
▫ “Reserved”
▫ “System” – UEFI (Fat32)
▫ “Recovery Image” (NTFS)
Registry Hives
• Registry hives format has not changed
▫ Can be examined with numerous tools
(e.g. RegistryBrowser, RegistryViewer, X-Ways Forensics, etc.)
• Location of important registry hives:
▫ Usersuser_nameNTUSER.DAT
▫ WindowsSystem32configDEFAULT
▫ WindowsSystem32configSAM
▫ WindowsSystem32configSECURITY
▫ WindowsSystem32configSOFTWARE
▫ WindowsSystem32configSYSTEM
Event Logs
• EVTX log format has not changed
▫ Can be examined with numerous tools
(e.g. X-Ways Forensics, etc.)
• Location of EVTX logs:
▫ WindowsSystem32winevtLogs
Event Logs – Windows Store
• WindowsSystem32winevtLogsMicrosoft-
Windows-Store%4Operational.evtx
Source EventID Category Function
Microsoft-
Windows-Install-
Agent
2002 2001 Installing application
Windows-
ApplicationModel-
Store-SDK
5 5 Search query strings
(e.g. query=twitter)
Event Logs – Windows Store
• WindowsSystem32winevtLogsMicrosoft-
Windows-AppXDeploymentServer%4Operational.evtx
Source EventID Category Function
Microsoft-
Windows-
AppXDeploy
ment-Server
10002 3 Application
deployment
Prefetch
• Location of Prefetch files:
▫ WindowsPrefetch
Shellbags
• NTUSER.dat
▫ SOFTWAREMicrosoftWindowsShellBags
• UsrClass.dat
LNK Shortcuts
• LNK format has not changed
▫ Can be examined with numerous tools
(e.g. X-Ways Forensics, etc.)
• Useful fields:
▫ Hostname
▫ MAC Address
▫ Volume ID
▫ Owner SID
▫ MAC Times
Thumbcache
• Location of Thumbcache files:
▫ Usersuser_nameAppDataLocalMicrosoftW
indowsExplorer
Recycle Bin
• Recycle Bin artefacts have not changed
▫ $I
 Still provides original file name and path
▫ $R
 Original file
Volume Shadow Copies
• vssadmin tool still provides list of current VSCs
Windows Indexing Service
• Windows indexing service is an evidentiary gold mine
▫ Potentially storing emails and other binary items
 Great as dictionary list for password cracking
• Stored in an .EDB file
▫ Can be interpreted by EseDbViewer, ESEDatabaseView or X-
Ways Forensics
 If “dirty” dismount, need to use esentutl.exe
• In Windows 10 stored in the following directory:
▫ C:ProgramDataMicrosoftSearchDataApplicationsWindo
wsWindows.edb
Cortana
• Windows 10 features “Cortana”, a personal assistant, which expands upon the unified
search platform introduced in Windows 8,
▫ Search encompasses local files, Windows Store & online content
▫ Can set reminders
▫ Can initiate contact (e.g. write emails)
• Cortana Databases (EDBs):
▫ Usersuser_nameAppDataLocalPackagesMicrosoft.Windows.Cortana_xxxxAp
pDataIndexed DBIndexedDB.edb
▫ Usersuser_nameAppDataLocalPackagesMicrosoft.Windows.Cortana_xxxxLoc
alStateESEDatabase_CortanaCoreInstanceCortanaCireDb.dat
 Interesting Tables:
 LocationTriggers
▫ Latitude/Longitude and Name of place results
 Geofences
▫ Latitude/Longitude for where location based reminders are triggered
 Reminders
▫ Creation and completion time (UNIX numeric value)
Cortana
• The following databases contain a list of contacts
synched from email accounts:
▫ Usersuser_nameAppDataLocalPackagesMicrosoft.
Windows.Cortana_xxxxLocalStateContacts_xxxxx.cfg
▫ Usersuser_nameAppDataLocalPackagesMicrosoft.
Windows.Cortana_xxxxLocalStateContacts_xxxxx.cfg.tx
t
Notification Centre
• The following databases contain a list of
notifications:
▫ Usersuser_nameAppDataLocalMicrosoftW
indowsNotificationsappdb.dat
 Toast notifications are stored in embedded XML
Picture Password
• “Picture Password” is an alternate login method where
gestures on top of a picture are used as a password
• This registry key details the path to the location of the “Picture
Password” file:
▫ HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrent
VersionAuthenticationLogonUIPicturePassworduser_GUID
• Path of locally stored Picture Password file:
▫ C:ProgramDataMicrosoftWindowsSystemDatauser_GUIDRe
adOnlyPicturePasswordbackground.png
Part 2
Applications (Apps)
• Applications (Apps) that utilise the Metro Modern UI are treated
differently to programs that work in desktop mode
• Apps are installed in the following directory:
▫ Program FilesWindowsApps
• Settings and configuration DBs are located in following directories:
▫ Usersuser_nameAppDataLocalPackagespackage_nameLocalSt
ate
 Two DB formats:
 SQLite DBs (.SQL)
 Jet DBs (.EDB)
Windows Store
• Apps are purchased/installed via the Windows Store
• During the Insider Preview their was a Beta Store
which contained Windows 10 –compatible Apps
(e.g. Microsoft Office Apps)
• Registry key of installed applications:
▫ HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionApp
xAppxAllUserStoreApplications
• List of deleted applications:
▫ HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionApp
xAppxAllUserStoreDeleted
Edge Browser
• New web browser and rendering engine (Spartan)
• Same as IE10, records no longer stored in Index.DAT files, stored in EDB
• Edge settings are stored in the following file:
▫ Usersuser_nameAppDataLocalPackagesMicrosoft.MicrosoftEdge_xxxxxACMicroso
ftEdgeUserDefaultDataStoreDatanouser1xxxxxDBStorespartan.edb
• Edge cache stored in the following directory:
▫ Usersuser_nameAppDataLocalPackagesMicrosoft.MicrosoftEdge_xxxxAC#!001M
icrosoftEdgeCache
• Last active browsing session stored:
▫ Usersuser_nameAppDataLocalPackagesMicrosoft.MicrosoftEdge_xxxxACMicrosoft
EdgeUserDefaultRecoveryActive
Browser History Records
• Edge (and IE) history records stored in the following
database:
▫ Usersuser_nameAppDataLocalMicrosoftWind
owsWebCacheWebCacheV01.dat
 This is actually an .EDB file
 Can be interpreted by EseDbViewer or
ESEDatabaseView
 Might be a “dirty” dismount, need to use esentutl.exe
 Database also stores Cookies
Internet Explorer (legacy)
• Internet Cache stored in this directory:
▫ Usersuser_nameAppDataLocalMicrosoftW
indowsINetCache
• Internet Cookies stored in this directory:
▫ Usersuser_nameAppDataLocalMicrosoftW
indowsINetCookies
Email (Mail application)
• Body of emails are stored in TXT or HTML format
▫ Can be analysed by a number of tools
▫ Stored in the following directory:
 Usersuser_nameAppDataLocalCommsUnistoredata
• Metadata of emails are stored in the following DB (EDB
format):
▫ Usersuser_nameAppDataLocalCommsUnistoreDBstore.vol
 Attachments
 Email header
 Contact information
Unified Communication
• Unified Communication (UC) is a built-in Microsoft
application that brings together all of the following social
media platforms (by default):
▫ Appears to be scaled back from Windows 8.x (less
integrated as previous People App)
• UC settings are stored in the following DB:
▫ Usersuser_nameAppDataLocalPackagesmicro
soft.windowscommunicationsapps…LocalStatelivec
omm.edb
Unified Communication
• Interesting Tables:
▫ Account
 SourceID
 List of accounts (e.g WL = Windows Live, Skype, TWITR, LI = LinkedIn)
 DomainTag
 Username for each account
▫ Contact
 List of synched contacts across all account platforms
▫ Event
 Calendar entries (including birthdays of contacts if synched to Windows Live) and locations
▫ MeContact
 Further details about owner accounts
▫ Person and PersonLink
 Further details about each contact including what account they link back to (e.g Skype)
Unified Communication
• Locally cached contact entries are stored in this directory:
▫ Usersuser_nameAppDataLocalPackagesmicrosoft.windowscom
municationsapps_xxxxxLocalStateIndexedLiveCommxxxxxxxxxx
PeopleAddressBook
• Contact photos are stored in this directory (JPGs):
▫ Usersuser_nameAppDataLocalPackagesmicrosoft.windowscom
municationsapps_xxxxLocalStateLiveCommxxxxxxxxUserTiles
Twitter App
• History DB located in following file:
▫ Usersuser_nameAppDataLocalPackagesxxxx.Twitte
r_xxxxxxxLocalStatetwitter_user_idtwitter.sqlite
• SQLite3 format DB
▫ 11 Tables in DB
 Relevant tables:
 messages – holds tweets & DMs
 search_queries – holds searches conducted in Twitter app by
user
 statuses – lists latest tweets from accounts being followed
 users – lists user account and accounts being followed by user
Twitter App
• Settings located in file:
▫ Usersuser_nameAppDataLocalPackagesxx
xxx.Twitter_xxxxSettingssettings.dat
 Includes user name (@xxxxx)
 Details on profile picture URL
 Twitter ID number
Skype App (legacy)
• The Skype App was discontinued with Windows
10
▫ Windows 10 prompts you to download the desktop
Skype application
OneDrive App
• Built-in by default, API allows all programs to save
files in OneDrive
• List of Synced items located in file:
▫ Usersuser_nameAppDataLocalMicrosoftWind
owsOneDrivesettingsxxxxxxxx.dat
• Locally cached items are stored in directory:
▫ Usersuser_nameOneDrive
Microsoft Office Apps
• With the release of the Windows Insider
program Microsoft introduced the Office Mobile
Apps
▫ If you have a valid Office365 account then you can
edit and create documents
 Otherwise these Apps are read-only
Word App
• List of recent documents stored in the following file
(XML):
▫ Usersuser_nameAppDataLocalPackagesMicrosoft.
Office.Word_xxxxLocalStateAppDataLocalOffice16.0
MruServiceCachexxxx_LiveIdExcelDocuments_en-AU
• Cached files stored in this directory:
▫ Usersuser_nameAppDataLocalPackagesMicrosoft.
Office.Word_xxxxLocalStateOfficeFileCache
 Files stored as .FSD extension  actually data embedded
 Can be manually carved from FSD file
Excel App
• List of recent documents stored in the following file
(XML):
▫ Usersuser_nameAppDataLocalPackagesMicrosoft.
Office.Excel_xxxxLocalStateAppDataLocalOffice16.0
MruServiceCachexxxx_LiveIdExcelDocuments_en-AU
• Cached files stored in this directory:
▫ Usersuser_nameAppDataLocalPackagesMicrosoft.
Office.Excel_xxxxLocalStateOfficeFileCache
 Files stored as .FSD extension  actually data embedded
 Can be manually carved from FSD file
PowerPoint App
• List of recent documents stored in the following file
(XML):
▫ Usersuser_nameAppDataLocalPackagesMicrosoft.Office.
PowerPoint_xxxxLocalStateAppDataLocalOffice16.0Mru
ServiceCachexxxx_LiveIdExcelDocuments_en-AU
• Cached files stored in this directory:
▫ Usersuser_nameAppDataLocalPackagesMicrosoft.Office.
PowerPoint_xxxxLocalStateOfficeFileCache
 Files stored as .FSD extension  actually data embedded
 Can be manually carved from FSD file
OneNote App
• Cached files stored in this directory:
▫ Usersuser_nameAppDataLocalPackagesMicrosoft.Of
fice.OneNote_xxxxLocalStateAppDataLocalOneNote1
6.0
• Files stored as xxxx.bin extension
▫ Encoded binary files
▫ Embedded graphics such as PNG or JPG
Maps App
• Recent places stored in this file (XML):
▫ Usersuser_nameAppDataLocalPackagesM
icrosoft.WindowsMaps_xxxxLocalStateGraph
xxxxMe00000000.ttl
 Latitude/Longitude
 Dates modified (searched)
Part 3
Memory Acquisition
• WinPMEM (tested versions 1.6.2 & 2.0.1)
▫ Run as Administrator
 Has to extract driver to local temp location
 V1.6.2 running process ~10MB
 V2.0.1 running process ~80MB
• FTK Imager
▫ Run as Administrator
 Running process ~15MB
Live Disk Acquisition
• FTK Imager
▫ Can be used for Physical or Logical acquisition
• X-Ways Forensics
▫ Can be used for Physical or Logical acquisition
Resources
• FTK Imager
▫ http://accessdata.com/product-download?/support/product-
downloads
• Nirsoft ESEDatabaseView
▫ http://www.nirsoft.net/utils/ese_database_view.html
• RegistryBrowser
▫ https://lockandcode.com/software/registry_browser
• WinPMEM
▫ https://github.com/google/rekall/releases

More Related Content

What's hot

Windows registry forensics
Windows registry forensicsWindows registry forensics
Windows registry forensics
Taha İslam YILMAZ
 
Windows forensic artifacts
Windows forensic artifactsWindows forensic artifacts
Windows forensic artifacts
n|u - The Open Security Community
 
Ntfs forensics
Ntfs forensicsNtfs forensics
Registry forensics
Registry forensicsRegistry forensics
Registry forensics
Prince Boonlia
 
Memory forensics
Memory forensicsMemory forensics
Memory forensics
Sunil Kumar
 
Windows 8.x Forensics 1.0
Windows 8.x Forensics 1.0Windows 8.x Forensics 1.0
Windows 8.x Forensics 1.0
Brent Muir
 
Registry Forensics
Registry ForensicsRegistry Forensics
Registry Forensics
Somesh Sawhney
 
Windows 7 forensics jump lists-rv3-public
Windows 7 forensics jump lists-rv3-publicWindows 7 forensics jump lists-rv3-public
Windows 7 forensics jump lists-rv3-public
CTIN
 
Windows Forensic 101
Windows Forensic 101Windows Forensic 101
Windows Forensic 101
Digit Oktavianto
 
03 Data Recovery - Notes
03 Data Recovery - Notes03 Data Recovery - Notes
03 Data Recovery - Notes
Kranthi
 
Windows Registry Forensics - Artifacts
Windows Registry Forensics - Artifacts Windows Registry Forensics - Artifacts
Windows Registry Forensics - Artifacts
MD SAQUIB KHAN
 
Memory Forensics for IR - Leveraging Volatility to Hunt Advanced Actors
Memory Forensics for IR - Leveraging Volatility to Hunt Advanced ActorsMemory Forensics for IR - Leveraging Volatility to Hunt Advanced Actors
Memory Forensics for IR - Leveraging Volatility to Hunt Advanced Actors
Jared Greenhill
 
Module 02 ftk imager
Module 02 ftk imagerModule 02 ftk imager
Module 02 ftk imager
ParminderKaurBScHons
 
Windows logging cheat sheet
Windows logging cheat sheetWindows logging cheat sheet
Windows logging cheat sheet
Michael Gough
 
Introduction to Cyber Forensics Module 1
Introduction to Cyber Forensics Module 1Introduction to Cyber Forensics Module 1
Introduction to Cyber Forensics Module 1
Anpumathews
 
Windows 7 forensics event logs-dtl-r3
Windows 7 forensics event logs-dtl-r3Windows 7 forensics event logs-dtl-r3
Windows 7 forensics event logs-dtl-r3
CTIN
 
A Threat Hunter Himself
A Threat Hunter HimselfA Threat Hunter Himself
A Threat Hunter Himself
Teymur Kheirkhabarov
 
Memory Forensics
Memory ForensicsMemory Forensics
Memory Forensics
Prince Boonlia
 
Malware Analysis Made Simple
Malware Analysis Made SimpleMalware Analysis Made Simple
Malware Analysis Made Simple
Paul Melson
 
Autopsy Digital forensics tool
Autopsy Digital forensics toolAutopsy Digital forensics tool
Autopsy Digital forensics tool
Sreekanth Narendran
 

What's hot (20)

Windows registry forensics
Windows registry forensicsWindows registry forensics
Windows registry forensics
 
Windows forensic artifacts
Windows forensic artifactsWindows forensic artifacts
Windows forensic artifacts
 
Ntfs forensics
Ntfs forensicsNtfs forensics
Ntfs forensics
 
Registry forensics
Registry forensicsRegistry forensics
Registry forensics
 
Memory forensics
Memory forensicsMemory forensics
Memory forensics
 
Windows 8.x Forensics 1.0
Windows 8.x Forensics 1.0Windows 8.x Forensics 1.0
Windows 8.x Forensics 1.0
 
Registry Forensics
Registry ForensicsRegistry Forensics
Registry Forensics
 
Windows 7 forensics jump lists-rv3-public
Windows 7 forensics jump lists-rv3-publicWindows 7 forensics jump lists-rv3-public
Windows 7 forensics jump lists-rv3-public
 
Windows Forensic 101
Windows Forensic 101Windows Forensic 101
Windows Forensic 101
 
03 Data Recovery - Notes
03 Data Recovery - Notes03 Data Recovery - Notes
03 Data Recovery - Notes
 
Windows Registry Forensics - Artifacts
Windows Registry Forensics - Artifacts Windows Registry Forensics - Artifacts
Windows Registry Forensics - Artifacts
 
Memory Forensics for IR - Leveraging Volatility to Hunt Advanced Actors
Memory Forensics for IR - Leveraging Volatility to Hunt Advanced ActorsMemory Forensics for IR - Leveraging Volatility to Hunt Advanced Actors
Memory Forensics for IR - Leveraging Volatility to Hunt Advanced Actors
 
Module 02 ftk imager
Module 02 ftk imagerModule 02 ftk imager
Module 02 ftk imager
 
Windows logging cheat sheet
Windows logging cheat sheetWindows logging cheat sheet
Windows logging cheat sheet
 
Introduction to Cyber Forensics Module 1
Introduction to Cyber Forensics Module 1Introduction to Cyber Forensics Module 1
Introduction to Cyber Forensics Module 1
 
Windows 7 forensics event logs-dtl-r3
Windows 7 forensics event logs-dtl-r3Windows 7 forensics event logs-dtl-r3
Windows 7 forensics event logs-dtl-r3
 
A Threat Hunter Himself
A Threat Hunter HimselfA Threat Hunter Himself
A Threat Hunter Himself
 
Memory Forensics
Memory ForensicsMemory Forensics
Memory Forensics
 
Malware Analysis Made Simple
Malware Analysis Made SimpleMalware Analysis Made Simple
Malware Analysis Made Simple
 
Autopsy Digital forensics tool
Autopsy Digital forensics toolAutopsy Digital forensics tool
Autopsy Digital forensics tool
 

Viewers also liked

Windows 7 forensics -overview-r3
Windows 7 forensics -overview-r3Windows 7 forensics -overview-r3
Windows 7 forensics -overview-r3
CTIN
 
Raidprep
RaidprepRaidprep
Raidprep
CTIN
 
File Management Presentation
File Management PresentationFile Management Presentation
File Management Presentation
SgtMasterGunz
 
Cheatsheet of msdos
Cheatsheet of msdosCheatsheet of msdos
Cheatsheet of msdos
Shuvradeb Barman Srijon
 
www.indonezia.net Hacking Windows Registry
www.indonezia.net Hacking Windows Registrywww.indonezia.net Hacking Windows Registry
www.indonezia.net Hacking Windows Registry
Chandra Pr. Singh
 
Computer forensic 101 - OWASP Khartoum
Computer forensic 101 - OWASP KhartoumComputer forensic 101 - OWASP Khartoum
Computer forensic 101 - OWASP Khartoum
OWASP Khartoum
 
Windows Forensics
Windows ForensicsWindows Forensics
Windows Forensics
Prince Boonlia
 
F Database
F DatabaseF Database
F Database
CTIN
 
Forensic Anaysis on Twitter
Forensic Anaysis on TwitterForensic Anaysis on Twitter
Forensic Anaysis on Twitter
Yansi Keim
 
Live Forensics
Live ForensicsLive Forensics
Live Forensics
CTIN
 
Sleuth kit by echavarro - HABEMUSHACKING
Sleuth kit by echavarro - HABEMUSHACKINGSleuth kit by echavarro - HABEMUSHACKING
Sleuth kit by echavarro - HABEMUSHACKING
Eduardo Chavarro
 
Netcat cheat sheet
Netcat cheat sheetNetcat cheat sheet
Netcat cheat sheet
Youssoufou YABRE
 
Msra 2011 windows7 forensics-troyla
Msra 2011 windows7 forensics-troylaMsra 2011 windows7 forensics-troyla
Msra 2011 windows7 forensics-troyla
CTIN
 
OSDF 2013 - Autopsy 3: Extensible Desktop Forensics by Brian Carrier
OSDF 2013 - Autopsy 3: Extensible Desktop Forensics by Brian CarrierOSDF 2013 - Autopsy 3: Extensible Desktop Forensics by Brian Carrier
OSDF 2013 - Autopsy 3: Extensible Desktop Forensics by Brian Carrier
Basis Technology
 
Autopsy 3: Free Open Source End-to-End Windows-based Digital Forensics Platform
Autopsy 3: Free Open Source End-to-End Windows-based Digital Forensics PlatformAutopsy 3: Free Open Source End-to-End Windows-based Digital Forensics Platform
Autopsy 3: Free Open Source End-to-End Windows-based Digital Forensics Platform
Basis Technology
 
Become an Internet Sleuth!
Become an Internet Sleuth!Become an Internet Sleuth!
Become an Internet Sleuth!
Nearpod
 
File system
File systemFile system
File system
Harleen Johal
 
Installation of Joomla on Windows XP
Installation of Joomla on Windows XPInstallation of Joomla on Windows XP
Installation of Joomla on Windows XP
Rupesh Kumar
 
Part6 Private Sector Concerns
Part6 Private Sector ConcernsPart6 Private Sector Concerns
Part6 Private Sector Concerns
CTIN
 
Accessioning-Based Metadata Extraction and Iterative Processing: Notes From t...
Accessioning-Based Metadata Extraction and Iterative Processing: Notes From t...Accessioning-Based Metadata Extraction and Iterative Processing: Notes From t...
Accessioning-Based Metadata Extraction and Iterative Processing: Notes From t...
Mark Matienzo
 

Viewers also liked (20)

Windows 7 forensics -overview-r3
Windows 7 forensics -overview-r3Windows 7 forensics -overview-r3
Windows 7 forensics -overview-r3
 
Raidprep
RaidprepRaidprep
Raidprep
 
File Management Presentation
File Management PresentationFile Management Presentation
File Management Presentation
 
Cheatsheet of msdos
Cheatsheet of msdosCheatsheet of msdos
Cheatsheet of msdos
 
www.indonezia.net Hacking Windows Registry
www.indonezia.net Hacking Windows Registrywww.indonezia.net Hacking Windows Registry
www.indonezia.net Hacking Windows Registry
 
Computer forensic 101 - OWASP Khartoum
Computer forensic 101 - OWASP KhartoumComputer forensic 101 - OWASP Khartoum
Computer forensic 101 - OWASP Khartoum
 
Windows Forensics
Windows ForensicsWindows Forensics
Windows Forensics
 
F Database
F DatabaseF Database
F Database
 
Forensic Anaysis on Twitter
Forensic Anaysis on TwitterForensic Anaysis on Twitter
Forensic Anaysis on Twitter
 
Live Forensics
Live ForensicsLive Forensics
Live Forensics
 
Sleuth kit by echavarro - HABEMUSHACKING
Sleuth kit by echavarro - HABEMUSHACKINGSleuth kit by echavarro - HABEMUSHACKING
Sleuth kit by echavarro - HABEMUSHACKING
 
Netcat cheat sheet
Netcat cheat sheetNetcat cheat sheet
Netcat cheat sheet
 
Msra 2011 windows7 forensics-troyla
Msra 2011 windows7 forensics-troylaMsra 2011 windows7 forensics-troyla
Msra 2011 windows7 forensics-troyla
 
OSDF 2013 - Autopsy 3: Extensible Desktop Forensics by Brian Carrier
OSDF 2013 - Autopsy 3: Extensible Desktop Forensics by Brian CarrierOSDF 2013 - Autopsy 3: Extensible Desktop Forensics by Brian Carrier
OSDF 2013 - Autopsy 3: Extensible Desktop Forensics by Brian Carrier
 
Autopsy 3: Free Open Source End-to-End Windows-based Digital Forensics Platform
Autopsy 3: Free Open Source End-to-End Windows-based Digital Forensics PlatformAutopsy 3: Free Open Source End-to-End Windows-based Digital Forensics Platform
Autopsy 3: Free Open Source End-to-End Windows-based Digital Forensics Platform
 
Become an Internet Sleuth!
Become an Internet Sleuth!Become an Internet Sleuth!
Become an Internet Sleuth!
 
File system
File systemFile system
File system
 
Installation of Joomla on Windows XP
Installation of Joomla on Windows XPInstallation of Joomla on Windows XP
Installation of Joomla on Windows XP
 
Part6 Private Sector Concerns
Part6 Private Sector ConcernsPart6 Private Sector Concerns
Part6 Private Sector Concerns
 
Accessioning-Based Metadata Extraction and Iterative Processing: Notes From t...
Accessioning-Based Metadata Extraction and Iterative Processing: Notes From t...Accessioning-Based Metadata Extraction and Iterative Processing: Notes From t...
Accessioning-Based Metadata Extraction and Iterative Processing: Notes From t...
 

Similar to Windows 10 Forensics: OS Evidentiary Artefacts

Windows RT Evidentiary Artefacts 1.0
Windows RT Evidentiary Artefacts 1.0Windows RT Evidentiary Artefacts 1.0
Windows RT Evidentiary Artefacts 1.0
Brent Muir
 
WindowsRegistry.ppt
WindowsRegistry.pptWindowsRegistry.ppt
WindowsRegistry.ppt
AliAshraf68199
 
Extracting and analyzing browser,email and IM artifacts
Extracting and analyzing browser,email and IM artifactsExtracting and analyzing browser,email and IM artifacts
Extracting and analyzing browser,email and IM artifacts
Marco Alamanni
 
Vista Forensics
Vista ForensicsVista Forensics
Vista Forensics
CTIN
 
CNIT 121: 14 Investigating Applications
CNIT 121: 14 Investigating ApplicationsCNIT 121: 14 Investigating Applications
CNIT 121: 14 Investigating Applications
Sam Bowne
 
Windows 10 Data Recovery
Windows 10 Data RecoveryWindows 10 Data Recovery
Windows 10 Data Recovery
Remo Recover
 
IIS 6 - General System Administration Overview
IIS 6 - General System Administration OverviewIIS 6 - General System Administration Overview
IIS 6 - General System Administration Overview
Information Technology
 
windows.pptx
windows.pptxwindows.pptx
windows.pptx
AdityaKumar1548
 
Scaling / optimizing search on netlog
Scaling / optimizing search on netlogScaling / optimizing search on netlog
Scaling / optimizing search on netlog
removed_8e0e1d901e47de676f36b9b89e06dc97
 
Unesco information storage and retrievals tools
Unesco information storage and retrievals toolsUnesco information storage and retrievals tools
Unesco information storage and retrievals tools
Liaquat Rahoo
 
Bri forum advanced web interface customizations
Bri forum   advanced web interface customizationsBri forum   advanced web interface customizations
Bri forum advanced web interface customizations
CCOSTAN
 
Vistaceic2007 from CEIC 2007
Vistaceic2007 from CEIC 2007Vistaceic2007 from CEIC 2007
Vistaceic2007 from CEIC 2007
KarlFrank99
 
Where to save my data, for devs!
Where to save my data, for devs!Where to save my data, for devs!
Where to save my data, for devs!
SharePoint Saturday New Jersey
 
Internet Explorer 8
Internet Explorer 8Internet Explorer 8
Internet Explorer 8
David Chou
 
CNIT 121: 13 Investigating Mac OS X Systems
CNIT 121: 13 Investigating Mac OS X SystemsCNIT 121: 13 Investigating Mac OS X Systems
CNIT 121: 13 Investigating Mac OS X Systems
Sam Bowne
 
Windows 1809 Timeline
Windows 1809 TimelineWindows 1809 Timeline
Windows 1809 Timeline
Costas Katsavounidis
 
Log Analysis using OSSEC sasoasasasas.pptx
Log Analysis using OSSEC sasoasasasas.pptxLog Analysis using OSSEC sasoasasasas.pptx
Log Analysis using OSSEC sasoasasasas.pptx
JohnnyPlasten
 
Implemeting Sencha Ext JS in Drupal
 Implemeting Sencha Ext JS in Drupal Implemeting Sencha Ext JS in Drupal
Implemeting Sencha Ext JS in Drupal
drupalsydney
 
CNIT 152 13 Investigating Mac OS X Systems
CNIT 152 13 Investigating Mac OS X SystemsCNIT 152 13 Investigating Mac OS X Systems
CNIT 152 13 Investigating Mac OS X Systems
Sam Bowne
 
Advanced Web Interface Customizations - BriForum 2010
Advanced Web Interface Customizations - BriForum 2010Advanced Web Interface Customizations - BriForum 2010
Advanced Web Interface Customizations - BriForum 2010
shoesing
 

Similar to Windows 10 Forensics: OS Evidentiary Artefacts (20)

Windows RT Evidentiary Artefacts 1.0
Windows RT Evidentiary Artefacts 1.0Windows RT Evidentiary Artefacts 1.0
Windows RT Evidentiary Artefacts 1.0
 
WindowsRegistry.ppt
WindowsRegistry.pptWindowsRegistry.ppt
WindowsRegistry.ppt
 
Extracting and analyzing browser,email and IM artifacts
Extracting and analyzing browser,email and IM artifactsExtracting and analyzing browser,email and IM artifacts
Extracting and analyzing browser,email and IM artifacts
 
Vista Forensics
Vista ForensicsVista Forensics
Vista Forensics
 
CNIT 121: 14 Investigating Applications
CNIT 121: 14 Investigating ApplicationsCNIT 121: 14 Investigating Applications
CNIT 121: 14 Investigating Applications
 
Windows 10 Data Recovery
Windows 10 Data RecoveryWindows 10 Data Recovery
Windows 10 Data Recovery
 
IIS 6 - General System Administration Overview
IIS 6 - General System Administration OverviewIIS 6 - General System Administration Overview
IIS 6 - General System Administration Overview
 
windows.pptx
windows.pptxwindows.pptx
windows.pptx
 
Scaling / optimizing search on netlog
Scaling / optimizing search on netlogScaling / optimizing search on netlog
Scaling / optimizing search on netlog
 
Unesco information storage and retrievals tools
Unesco information storage and retrievals toolsUnesco information storage and retrievals tools
Unesco information storage and retrievals tools
 
Bri forum advanced web interface customizations
Bri forum   advanced web interface customizationsBri forum   advanced web interface customizations
Bri forum advanced web interface customizations
 
Vistaceic2007 from CEIC 2007
Vistaceic2007 from CEIC 2007Vistaceic2007 from CEIC 2007
Vistaceic2007 from CEIC 2007
 
Where to save my data, for devs!
Where to save my data, for devs!Where to save my data, for devs!
Where to save my data, for devs!
 
Internet Explorer 8
Internet Explorer 8Internet Explorer 8
Internet Explorer 8
 
CNIT 121: 13 Investigating Mac OS X Systems
CNIT 121: 13 Investigating Mac OS X SystemsCNIT 121: 13 Investigating Mac OS X Systems
CNIT 121: 13 Investigating Mac OS X Systems
 
Windows 1809 Timeline
Windows 1809 TimelineWindows 1809 Timeline
Windows 1809 Timeline
 
Log Analysis using OSSEC sasoasasasas.pptx
Log Analysis using OSSEC sasoasasasas.pptxLog Analysis using OSSEC sasoasasasas.pptx
Log Analysis using OSSEC sasoasasasas.pptx
 
Implemeting Sencha Ext JS in Drupal
 Implemeting Sencha Ext JS in Drupal Implemeting Sencha Ext JS in Drupal
Implemeting Sencha Ext JS in Drupal
 
CNIT 152 13 Investigating Mac OS X Systems
CNIT 152 13 Investigating Mac OS X SystemsCNIT 152 13 Investigating Mac OS X Systems
CNIT 152 13 Investigating Mac OS X Systems
 
Advanced Web Interface Customizations - BriForum 2010
Advanced Web Interface Customizations - BriForum 2010Advanced Web Interface Customizations - BriForum 2010
Advanced Web Interface Customizations - BriForum 2010
 

More from Brent Muir

Defending Against the Dark Arts of LOLBINS
Defending Against the Dark Arts of LOLBINS Defending Against the Dark Arts of LOLBINS
Defending Against the Dark Arts of LOLBINS
Brent Muir
 
Mobile Forensics on a Shoestring Budget
Mobile Forensics on a Shoestring BudgetMobile Forensics on a Shoestring Budget
Mobile Forensics on a Shoestring Budget
Brent Muir
 
SanDisk SecureAccess Encryption 1.5
SanDisk SecureAccess Encryption 1.5SanDisk SecureAccess Encryption 1.5
SanDisk SecureAccess Encryption 1.5
Brent Muir
 
Ducky USB - Indicators of Compromise (IOCs)
Ducky USB - Indicators of Compromise (IOCs)Ducky USB - Indicators of Compromise (IOCs)
Ducky USB - Indicators of Compromise (IOCs)
Brent Muir
 
SanDisk SecureAccess Encryption - Forensic Processing & USB Flashing
SanDisk SecureAccess Encryption - Forensic Processing & USB FlashingSanDisk SecureAccess Encryption - Forensic Processing & USB Flashing
SanDisk SecureAccess Encryption - Forensic Processing & USB Flashing
Brent Muir
 
WinFE: The (Almost) Perfect Triage Tool
WinFE: The (Almost) Perfect Triage ToolWinFE: The (Almost) Perfect Triage Tool
WinFE: The (Almost) Perfect Triage Tool
Brent Muir
 
Denial of Service Attacks
Denial of Service AttacksDenial of Service Attacks
Denial of Service Attacks
Brent Muir
 
RFID Privacy & Security Issues
RFID Privacy & Security IssuesRFID Privacy & Security Issues
RFID Privacy & Security Issues
Brent Muir
 
TOR Packet Analysis - Locating Identifying Markers
TOR Packet Analysis - Locating Identifying MarkersTOR Packet Analysis - Locating Identifying Markers
TOR Packet Analysis - Locating Identifying Markers
Brent Muir
 
Malware SPAM - March 2013
Malware SPAM - March 2013Malware SPAM - March 2013
Malware SPAM - March 2013
Brent Muir
 
Malware Spam February 2013
Malware Spam February 2013Malware Spam February 2013
Malware Spam February 2013
Brent Muir
 
Booting an image as a forensically sound vm in virtual box
Booting an image as a forensically sound vm in virtual boxBooting an image as a forensically sound vm in virtual box
Booting an image as a forensically sound vm in virtual box
Brent Muir
 
Malware SPAM - January 2013
Malware SPAM - January 2013Malware SPAM - January 2013
Malware SPAM - January 2013
Brent Muir
 
Trying to bottle the cloud forensic challenges with cloud computing
Trying to bottle the cloud   forensic challenges with cloud computingTrying to bottle the cloud   forensic challenges with cloud computing
Trying to bottle the cloud forensic challenges with cloud computing
Brent Muir
 

More from Brent Muir (14)

Defending Against the Dark Arts of LOLBINS
Defending Against the Dark Arts of LOLBINS Defending Against the Dark Arts of LOLBINS
Defending Against the Dark Arts of LOLBINS
 
Mobile Forensics on a Shoestring Budget
Mobile Forensics on a Shoestring BudgetMobile Forensics on a Shoestring Budget
Mobile Forensics on a Shoestring Budget
 
SanDisk SecureAccess Encryption 1.5
SanDisk SecureAccess Encryption 1.5SanDisk SecureAccess Encryption 1.5
SanDisk SecureAccess Encryption 1.5
 
Ducky USB - Indicators of Compromise (IOCs)
Ducky USB - Indicators of Compromise (IOCs)Ducky USB - Indicators of Compromise (IOCs)
Ducky USB - Indicators of Compromise (IOCs)
 
SanDisk SecureAccess Encryption - Forensic Processing & USB Flashing
SanDisk SecureAccess Encryption - Forensic Processing & USB FlashingSanDisk SecureAccess Encryption - Forensic Processing & USB Flashing
SanDisk SecureAccess Encryption - Forensic Processing & USB Flashing
 
WinFE: The (Almost) Perfect Triage Tool
WinFE: The (Almost) Perfect Triage ToolWinFE: The (Almost) Perfect Triage Tool
WinFE: The (Almost) Perfect Triage Tool
 
Denial of Service Attacks
Denial of Service AttacksDenial of Service Attacks
Denial of Service Attacks
 
RFID Privacy & Security Issues
RFID Privacy & Security IssuesRFID Privacy & Security Issues
RFID Privacy & Security Issues
 
TOR Packet Analysis - Locating Identifying Markers
TOR Packet Analysis - Locating Identifying MarkersTOR Packet Analysis - Locating Identifying Markers
TOR Packet Analysis - Locating Identifying Markers
 
Malware SPAM - March 2013
Malware SPAM - March 2013Malware SPAM - March 2013
Malware SPAM - March 2013
 
Malware Spam February 2013
Malware Spam February 2013Malware Spam February 2013
Malware Spam February 2013
 
Booting an image as a forensically sound vm in virtual box
Booting an image as a forensically sound vm in virtual boxBooting an image as a forensically sound vm in virtual box
Booting an image as a forensically sound vm in virtual box
 
Malware SPAM - January 2013
Malware SPAM - January 2013Malware SPAM - January 2013
Malware SPAM - January 2013
 
Trying to bottle the cloud forensic challenges with cloud computing
Trying to bottle the cloud   forensic challenges with cloud computingTrying to bottle the cloud   forensic challenges with cloud computing
Trying to bottle the cloud forensic challenges with cloud computing
 

Recently uploaded

[OReilly Superstream] Occupy the Space: A grassroots guide to engineering (an...
[OReilly Superstream] Occupy the Space: A grassroots guide to engineering (an...[OReilly Superstream] Occupy the Space: A grassroots guide to engineering (an...
[OReilly Superstream] Occupy the Space: A grassroots guide to engineering (an...
Jason Yip
 
Christine's Product Research Presentation.pptx
Christine's Product Research Presentation.pptxChristine's Product Research Presentation.pptx
Christine's Product Research Presentation.pptx
christinelarrosa
 
Biomedical Knowledge Graphs for Data Scientists and Bioinformaticians
Biomedical Knowledge Graphs for Data Scientists and BioinformaticiansBiomedical Knowledge Graphs for Data Scientists and Bioinformaticians
Biomedical Knowledge Graphs for Data Scientists and Bioinformaticians
Neo4j
 
Leveraging the Graph for Clinical Trials and Standards
Leveraging the Graph for Clinical Trials and StandardsLeveraging the Graph for Clinical Trials and Standards
Leveraging the Graph for Clinical Trials and Standards
Neo4j
 
High performance Serverless Java on AWS- GoTo Amsterdam 2024
High performance Serverless Java on AWS- GoTo Amsterdam 2024High performance Serverless Java on AWS- GoTo Amsterdam 2024
High performance Serverless Java on AWS- GoTo Amsterdam 2024
Vadym Kazulkin
 
What is an RPA CoE? Session 1 – CoE Vision
What is an RPA CoE?  Session 1 – CoE VisionWhat is an RPA CoE?  Session 1 – CoE Vision
What is an RPA CoE? Session 1 – CoE Vision
DianaGray10
 
Mutation Testing for Task-Oriented Chatbots
Mutation Testing for Task-Oriented ChatbotsMutation Testing for Task-Oriented Chatbots
Mutation Testing for Task-Oriented Chatbots
Pablo Gómez Abajo
 
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdfHow to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
Chart Kalyan
 
ScyllaDB Tablets: Rethinking Replication
ScyllaDB Tablets: Rethinking ReplicationScyllaDB Tablets: Rethinking Replication
ScyllaDB Tablets: Rethinking Replication
ScyllaDB
 
GNSS spoofing via SDR (Criptored Talks 2024)
GNSS spoofing via SDR (Criptored Talks 2024)GNSS spoofing via SDR (Criptored Talks 2024)
GNSS spoofing via SDR (Criptored Talks 2024)
Javier Junquera
 
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
Alex Pruden
 
QA or the Highway - Component Testing: Bridging the gap between frontend appl...
QA or the Highway - Component Testing: Bridging the gap between frontend appl...QA or the Highway - Component Testing: Bridging the gap between frontend appl...
QA or the Highway - Component Testing: Bridging the gap between frontend appl...
zjhamm304
 
The Microsoft 365 Migration Tutorial For Beginner.pptx
The Microsoft 365 Migration Tutorial For Beginner.pptxThe Microsoft 365 Migration Tutorial For Beginner.pptx
The Microsoft 365 Migration Tutorial For Beginner.pptx
operationspcvita
 
Y-Combinator seed pitch deck template PP
Y-Combinator seed pitch deck template PPY-Combinator seed pitch deck template PP
Y-Combinator seed pitch deck template PP
c5vrf27qcz
 
Apps Break Data
Apps Break DataApps Break Data
Apps Break Data
Ivo Velitchkov
 
Northern Engraving | Modern Metal Trim, Nameplates and Appliance Panels
Northern Engraving | Modern Metal Trim, Nameplates and Appliance PanelsNorthern Engraving | Modern Metal Trim, Nameplates and Appliance Panels
Northern Engraving | Modern Metal Trim, Nameplates and Appliance Panels
Northern Engraving
 
Day 2 - Intro to UiPath Studio Fundamentals
Day 2 - Intro to UiPath Studio FundamentalsDay 2 - Intro to UiPath Studio Fundamentals
Day 2 - Intro to UiPath Studio Fundamentals
UiPathCommunity
 
"Choosing proper type of scaling", Olena Syrota
"Choosing proper type of scaling", Olena Syrota"Choosing proper type of scaling", Olena Syrota
"Choosing proper type of scaling", Olena Syrota
Fwdays
 
Christine's Supplier Sourcing Presentaion.pptx
Christine's Supplier Sourcing Presentaion.pptxChristine's Supplier Sourcing Presentaion.pptx
Christine's Supplier Sourcing Presentaion.pptx
christinelarrosa
 
Main news related to the CCS TSI 2023 (2023/1695)
Main news related to the CCS TSI 2023 (2023/1695)Main news related to the CCS TSI 2023 (2023/1695)
Main news related to the CCS TSI 2023 (2023/1695)
Jakub Marek
 

Recently uploaded (20)

[OReilly Superstream] Occupy the Space: A grassroots guide to engineering (an...
[OReilly Superstream] Occupy the Space: A grassroots guide to engineering (an...[OReilly Superstream] Occupy the Space: A grassroots guide to engineering (an...
[OReilly Superstream] Occupy the Space: A grassroots guide to engineering (an...
 
Christine's Product Research Presentation.pptx
Christine's Product Research Presentation.pptxChristine's Product Research Presentation.pptx
Christine's Product Research Presentation.pptx
 
Biomedical Knowledge Graphs for Data Scientists and Bioinformaticians
Biomedical Knowledge Graphs for Data Scientists and BioinformaticiansBiomedical Knowledge Graphs for Data Scientists and Bioinformaticians
Biomedical Knowledge Graphs for Data Scientists and Bioinformaticians
 
Leveraging the Graph for Clinical Trials and Standards
Leveraging the Graph for Clinical Trials and StandardsLeveraging the Graph for Clinical Trials and Standards
Leveraging the Graph for Clinical Trials and Standards
 
High performance Serverless Java on AWS- GoTo Amsterdam 2024
High performance Serverless Java on AWS- GoTo Amsterdam 2024High performance Serverless Java on AWS- GoTo Amsterdam 2024
High performance Serverless Java on AWS- GoTo Amsterdam 2024
 
What is an RPA CoE? Session 1 – CoE Vision
What is an RPA CoE?  Session 1 – CoE VisionWhat is an RPA CoE?  Session 1 – CoE Vision
What is an RPA CoE? Session 1 – CoE Vision
 
Mutation Testing for Task-Oriented Chatbots
Mutation Testing for Task-Oriented ChatbotsMutation Testing for Task-Oriented Chatbots
Mutation Testing for Task-Oriented Chatbots
 
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdfHow to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
 
ScyllaDB Tablets: Rethinking Replication
ScyllaDB Tablets: Rethinking ReplicationScyllaDB Tablets: Rethinking Replication
ScyllaDB Tablets: Rethinking Replication
 
GNSS spoofing via SDR (Criptored Talks 2024)
GNSS spoofing via SDR (Criptored Talks 2024)GNSS spoofing via SDR (Criptored Talks 2024)
GNSS spoofing via SDR (Criptored Talks 2024)
 
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
 
QA or the Highway - Component Testing: Bridging the gap between frontend appl...
QA or the Highway - Component Testing: Bridging the gap between frontend appl...QA or the Highway - Component Testing: Bridging the gap between frontend appl...
QA or the Highway - Component Testing: Bridging the gap between frontend appl...
 
The Microsoft 365 Migration Tutorial For Beginner.pptx
The Microsoft 365 Migration Tutorial For Beginner.pptxThe Microsoft 365 Migration Tutorial For Beginner.pptx
The Microsoft 365 Migration Tutorial For Beginner.pptx
 
Y-Combinator seed pitch deck template PP
Y-Combinator seed pitch deck template PPY-Combinator seed pitch deck template PP
Y-Combinator seed pitch deck template PP
 
Apps Break Data
Apps Break DataApps Break Data
Apps Break Data
 
Northern Engraving | Modern Metal Trim, Nameplates and Appliance Panels
Northern Engraving | Modern Metal Trim, Nameplates and Appliance PanelsNorthern Engraving | Modern Metal Trim, Nameplates and Appliance Panels
Northern Engraving | Modern Metal Trim, Nameplates and Appliance Panels
 
Day 2 - Intro to UiPath Studio Fundamentals
Day 2 - Intro to UiPath Studio FundamentalsDay 2 - Intro to UiPath Studio Fundamentals
Day 2 - Intro to UiPath Studio Fundamentals
 
"Choosing proper type of scaling", Olena Syrota
"Choosing proper type of scaling", Olena Syrota"Choosing proper type of scaling", Olena Syrota
"Choosing proper type of scaling", Olena Syrota
 
Christine's Supplier Sourcing Presentaion.pptx
Christine's Supplier Sourcing Presentaion.pptxChristine's Supplier Sourcing Presentaion.pptx
Christine's Supplier Sourcing Presentaion.pptx
 
Main news related to the CCS TSI 2023 (2023/1695)
Main news related to the CCS TSI 2023 (2023/1695)Main news related to the CCS TSI 2023 (2023/1695)
Main news related to the CCS TSI 2023 (2023/1695)
 

Windows 10 Forensics: OS Evidentiary Artefacts

  • 1. Windows 10 Forensics OS Evidentiary Artefacts Version 1.5 (Build 10240) Brent Muir – 2015
  • 2. Topics OS Artefacts : ▫ File Systems / Partitions ▫ Registry Hives ▫ Event Logs ▫ Prefetch ▫ Shellbags ▫ LNK Shortcuts ▫ Thumbcache ▫ Recycle Bin ▫ Volume Shadow Copies ▫ Windows Indexing Service ▫ Cortana (Search) ▫ Notification Centre ▫ Picture Password Application Artefacts: ▫ Windows Store ▫ Edge Browser (previously Spartan)  Legacy Internet Explorer ▫ Email (Mail application) ▫ Unified Communication  Twitter  Skype  OneDrive ▫ Microsoft Office Apps  Word  Excel  PowerPoint  OneNote ▫ Maps
  • 4. File Systems / Partitions • Supported File Systems: ▫ NTFS, Fat32, ExFat • Default Partition structure: ▫ “Windows” – core OS (NTFS) ▫ “Recovery” (NTFS) ▫ “Reserved” ▫ “System” – UEFI (Fat32) ▫ “Recovery Image” (NTFS)
  • 5. Registry Hives • Registry hives format has not changed ▫ Can be examined with numerous tools (e.g. RegistryBrowser, RegistryViewer, X-Ways Forensics, etc.) • Location of important registry hives: ▫ Usersuser_nameNTUSER.DAT ▫ WindowsSystem32configDEFAULT ▫ WindowsSystem32configSAM ▫ WindowsSystem32configSECURITY ▫ WindowsSystem32configSOFTWARE ▫ WindowsSystem32configSYSTEM
  • 6. Event Logs • EVTX log format has not changed ▫ Can be examined with numerous tools (e.g. X-Ways Forensics, etc.) • Location of EVTX logs: ▫ WindowsSystem32winevtLogs
  • 7. Event Logs – Windows Store • WindowsSystem32winevtLogsMicrosoft- Windows-Store%4Operational.evtx Source EventID Category Function Microsoft- Windows-Install- Agent 2002 2001 Installing application Windows- ApplicationModel- Store-SDK 5 5 Search query strings (e.g. query=twitter)
  • 8. Event Logs – Windows Store • WindowsSystem32winevtLogsMicrosoft- Windows-AppXDeploymentServer%4Operational.evtx Source EventID Category Function Microsoft- Windows- AppXDeploy ment-Server 10002 3 Application deployment
  • 9. Prefetch • Location of Prefetch files: ▫ WindowsPrefetch
  • 11. LNK Shortcuts • LNK format has not changed ▫ Can be examined with numerous tools (e.g. X-Ways Forensics, etc.) • Useful fields: ▫ Hostname ▫ MAC Address ▫ Volume ID ▫ Owner SID ▫ MAC Times
  • 12. Thumbcache • Location of Thumbcache files: ▫ Usersuser_nameAppDataLocalMicrosoftW indowsExplorer
  • 13. Recycle Bin • Recycle Bin artefacts have not changed ▫ $I  Still provides original file name and path ▫ $R  Original file
  • 14. Volume Shadow Copies • vssadmin tool still provides list of current VSCs
  • 15. Windows Indexing Service • Windows indexing service is an evidentiary gold mine ▫ Potentially storing emails and other binary items  Great as dictionary list for password cracking • Stored in an .EDB file ▫ Can be interpreted by EseDbViewer, ESEDatabaseView or X- Ways Forensics  If “dirty” dismount, need to use esentutl.exe • In Windows 10 stored in the following directory: ▫ C:ProgramDataMicrosoftSearchDataApplicationsWindo wsWindows.edb
  • 16. Cortana • Windows 10 features “Cortana”, a personal assistant, which expands upon the unified search platform introduced in Windows 8, ▫ Search encompasses local files, Windows Store & online content ▫ Can set reminders ▫ Can initiate contact (e.g. write emails) • Cortana Databases (EDBs): ▫ Usersuser_nameAppDataLocalPackagesMicrosoft.Windows.Cortana_xxxxAp pDataIndexed DBIndexedDB.edb ▫ Usersuser_nameAppDataLocalPackagesMicrosoft.Windows.Cortana_xxxxLoc alStateESEDatabase_CortanaCoreInstanceCortanaCireDb.dat  Interesting Tables:  LocationTriggers ▫ Latitude/Longitude and Name of place results  Geofences ▫ Latitude/Longitude for where location based reminders are triggered  Reminders ▫ Creation and completion time (UNIX numeric value)
  • 17. Cortana • The following databases contain a list of contacts synched from email accounts: ▫ Usersuser_nameAppDataLocalPackagesMicrosoft. Windows.Cortana_xxxxLocalStateContacts_xxxxx.cfg ▫ Usersuser_nameAppDataLocalPackagesMicrosoft. Windows.Cortana_xxxxLocalStateContacts_xxxxx.cfg.tx t
  • 18. Notification Centre • The following databases contain a list of notifications: ▫ Usersuser_nameAppDataLocalMicrosoftW indowsNotificationsappdb.dat  Toast notifications are stored in embedded XML
  • 19. Picture Password • “Picture Password” is an alternate login method where gestures on top of a picture are used as a password • This registry key details the path to the location of the “Picture Password” file: ▫ HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrent VersionAuthenticationLogonUIPicturePassworduser_GUID • Path of locally stored Picture Password file: ▫ C:ProgramDataMicrosoftWindowsSystemDatauser_GUIDRe adOnlyPicturePasswordbackground.png
  • 21. Applications (Apps) • Applications (Apps) that utilise the Metro Modern UI are treated differently to programs that work in desktop mode • Apps are installed in the following directory: ▫ Program FilesWindowsApps • Settings and configuration DBs are located in following directories: ▫ Usersuser_nameAppDataLocalPackagespackage_nameLocalSt ate  Two DB formats:  SQLite DBs (.SQL)  Jet DBs (.EDB)
  • 22. Windows Store • Apps are purchased/installed via the Windows Store • During the Insider Preview their was a Beta Store which contained Windows 10 –compatible Apps (e.g. Microsoft Office Apps) • Registry key of installed applications: ▫ HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionApp xAppxAllUserStoreApplications • List of deleted applications: ▫ HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionApp xAppxAllUserStoreDeleted
  • 23. Edge Browser • New web browser and rendering engine (Spartan) • Same as IE10, records no longer stored in Index.DAT files, stored in EDB • Edge settings are stored in the following file: ▫ Usersuser_nameAppDataLocalPackagesMicrosoft.MicrosoftEdge_xxxxxACMicroso ftEdgeUserDefaultDataStoreDatanouser1xxxxxDBStorespartan.edb • Edge cache stored in the following directory: ▫ Usersuser_nameAppDataLocalPackagesMicrosoft.MicrosoftEdge_xxxxAC#!001M icrosoftEdgeCache • Last active browsing session stored: ▫ Usersuser_nameAppDataLocalPackagesMicrosoft.MicrosoftEdge_xxxxACMicrosoft EdgeUserDefaultRecoveryActive
  • 24. Browser History Records • Edge (and IE) history records stored in the following database: ▫ Usersuser_nameAppDataLocalMicrosoftWind owsWebCacheWebCacheV01.dat  This is actually an .EDB file  Can be interpreted by EseDbViewer or ESEDatabaseView  Might be a “dirty” dismount, need to use esentutl.exe  Database also stores Cookies
  • 25. Internet Explorer (legacy) • Internet Cache stored in this directory: ▫ Usersuser_nameAppDataLocalMicrosoftW indowsINetCache • Internet Cookies stored in this directory: ▫ Usersuser_nameAppDataLocalMicrosoftW indowsINetCookies
  • 26. Email (Mail application) • Body of emails are stored in TXT or HTML format ▫ Can be analysed by a number of tools ▫ Stored in the following directory:  Usersuser_nameAppDataLocalCommsUnistoredata • Metadata of emails are stored in the following DB (EDB format): ▫ Usersuser_nameAppDataLocalCommsUnistoreDBstore.vol  Attachments  Email header  Contact information
  • 27. Unified Communication • Unified Communication (UC) is a built-in Microsoft application that brings together all of the following social media platforms (by default): ▫ Appears to be scaled back from Windows 8.x (less integrated as previous People App) • UC settings are stored in the following DB: ▫ Usersuser_nameAppDataLocalPackagesmicro soft.windowscommunicationsapps…LocalStatelivec omm.edb
  • 28. Unified Communication • Interesting Tables: ▫ Account  SourceID  List of accounts (e.g WL = Windows Live, Skype, TWITR, LI = LinkedIn)  DomainTag  Username for each account ▫ Contact  List of synched contacts across all account platforms ▫ Event  Calendar entries (including birthdays of contacts if synched to Windows Live) and locations ▫ MeContact  Further details about owner accounts ▫ Person and PersonLink  Further details about each contact including what account they link back to (e.g Skype)
  • 29. Unified Communication • Locally cached contact entries are stored in this directory: ▫ Usersuser_nameAppDataLocalPackagesmicrosoft.windowscom municationsapps_xxxxxLocalStateIndexedLiveCommxxxxxxxxxx PeopleAddressBook • Contact photos are stored in this directory (JPGs): ▫ Usersuser_nameAppDataLocalPackagesmicrosoft.windowscom municationsapps_xxxxLocalStateLiveCommxxxxxxxxUserTiles
  • 30. Twitter App • History DB located in following file: ▫ Usersuser_nameAppDataLocalPackagesxxxx.Twitte r_xxxxxxxLocalStatetwitter_user_idtwitter.sqlite • SQLite3 format DB ▫ 11 Tables in DB  Relevant tables:  messages – holds tweets & DMs  search_queries – holds searches conducted in Twitter app by user  statuses – lists latest tweets from accounts being followed  users – lists user account and accounts being followed by user
  • 31. Twitter App • Settings located in file: ▫ Usersuser_nameAppDataLocalPackagesxx xxx.Twitter_xxxxSettingssettings.dat  Includes user name (@xxxxx)  Details on profile picture URL  Twitter ID number
  • 32. Skype App (legacy) • The Skype App was discontinued with Windows 10 ▫ Windows 10 prompts you to download the desktop Skype application
  • 33. OneDrive App • Built-in by default, API allows all programs to save files in OneDrive • List of Synced items located in file: ▫ Usersuser_nameAppDataLocalMicrosoftWind owsOneDrivesettingsxxxxxxxx.dat • Locally cached items are stored in directory: ▫ Usersuser_nameOneDrive
  • 34. Microsoft Office Apps • With the release of the Windows Insider program Microsoft introduced the Office Mobile Apps ▫ If you have a valid Office365 account then you can edit and create documents  Otherwise these Apps are read-only
  • 35. Word App • List of recent documents stored in the following file (XML): ▫ Usersuser_nameAppDataLocalPackagesMicrosoft. Office.Word_xxxxLocalStateAppDataLocalOffice16.0 MruServiceCachexxxx_LiveIdExcelDocuments_en-AU • Cached files stored in this directory: ▫ Usersuser_nameAppDataLocalPackagesMicrosoft. Office.Word_xxxxLocalStateOfficeFileCache  Files stored as .FSD extension  actually data embedded  Can be manually carved from FSD file
  • 36. Excel App • List of recent documents stored in the following file (XML): ▫ Usersuser_nameAppDataLocalPackagesMicrosoft. Office.Excel_xxxxLocalStateAppDataLocalOffice16.0 MruServiceCachexxxx_LiveIdExcelDocuments_en-AU • Cached files stored in this directory: ▫ Usersuser_nameAppDataLocalPackagesMicrosoft. Office.Excel_xxxxLocalStateOfficeFileCache  Files stored as .FSD extension  actually data embedded  Can be manually carved from FSD file
  • 37. PowerPoint App • List of recent documents stored in the following file (XML): ▫ Usersuser_nameAppDataLocalPackagesMicrosoft.Office. PowerPoint_xxxxLocalStateAppDataLocalOffice16.0Mru ServiceCachexxxx_LiveIdExcelDocuments_en-AU • Cached files stored in this directory: ▫ Usersuser_nameAppDataLocalPackagesMicrosoft.Office. PowerPoint_xxxxLocalStateOfficeFileCache  Files stored as .FSD extension  actually data embedded  Can be manually carved from FSD file
  • 38. OneNote App • Cached files stored in this directory: ▫ Usersuser_nameAppDataLocalPackagesMicrosoft.Of fice.OneNote_xxxxLocalStateAppDataLocalOneNote1 6.0 • Files stored as xxxx.bin extension ▫ Encoded binary files ▫ Embedded graphics such as PNG or JPG
  • 39. Maps App • Recent places stored in this file (XML): ▫ Usersuser_nameAppDataLocalPackagesM icrosoft.WindowsMaps_xxxxLocalStateGraph xxxxMe00000000.ttl  Latitude/Longitude  Dates modified (searched)
  • 41. Memory Acquisition • WinPMEM (tested versions 1.6.2 & 2.0.1) ▫ Run as Administrator  Has to extract driver to local temp location  V1.6.2 running process ~10MB  V2.0.1 running process ~80MB • FTK Imager ▫ Run as Administrator  Running process ~15MB
  • 42. Live Disk Acquisition • FTK Imager ▫ Can be used for Physical or Logical acquisition • X-Ways Forensics ▫ Can be used for Physical or Logical acquisition
  • 43. Resources • FTK Imager ▫ http://accessdata.com/product-download?/support/product- downloads • Nirsoft ESEDatabaseView ▫ http://www.nirsoft.net/utils/ese_database_view.html • RegistryBrowser ▫ https://lockandcode.com/software/registry_browser • WinPMEM ▫ https://github.com/google/rekall/releases

Editor's Notes

  1. Virtualising a stored image
  2. Connected WiFi networks   HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\ \ProgramData\Microsoft\Wlansvc\Profiles\Interfaces\{5352E92B-EE0A-4E57-B761-A775DDE0A317}\
  3. Windows 10 shipped with IE11 (and Edge) - Legacy mode X-Ways can also interpret EDB
  4. Windows 8 shipped with IE10, now able to get IE11 X-Ways can also interpret EDB
  5. Cheat sheet