Focus Areas:
🔒 Data Privacy & Protection
, 🔑 Cryptography
, ⛓️ Blockchain Security
, 💻 Endpoint Security
, 🚨 Incident Response
Abstract
Microsoft Windows presents a number of avenues to the Forensic investigator to establish the most critical questions during any investigation - Who, When, Why and How? There is a wealth of information available in the Windows system which can help the investigator establish a chain of events, identify the possible cause of any untoward activity and gather non-refutable evidence to prosecute the perpetrator. Some of the evidentiary avenues that would be highlighted in this presentation are as follows:
- Windows Registry as a critical avenue of information – MRU Lists, MUI cache, UserAssist and so on
- NTFS Data structures and MFT analysis
- Understanding and Cracking EFS
- Analyzing File System Metadata – the mystery of timestamps
- Analyzing Windows Memory contents – how to conduct Live Response?
- Using Event Logs to establish a timeline of events.
- Web Usage profiling
- Analyzing Prefetch, Recycle Bin artifacts and shortcut files
- Analyzing slack space and detecting hidden/formatted partitions.
- Understanding and analyzing Thumbs.db