Week 5 Flashcards

Question

File Time Stamps in Windows - Three Categories

Answer 1

Creation, Modification & Access times

Answer 2

The file system in use (i.e., FAT-32 vs. NTFS) ▪ The manner in which the file was created on the system ▪ “Original” creation vs. copy ▪ The manner in which the file was copied to the system Click & drag vs. cut & past vs. right-click/copy ▪ If creation time post-dates modification time, copy was generally at play

Answer 3

Encryption and Cloud Based Data Sources

Answer 4

 Most Windows versions come with Bitlocker built-in, but NOT turned on ▪ Bitlocker is FULL-DISK encryption ▪ Drive must be formatted in NTFS ▪ Encrypts everything on the PHYSICAL drive ▪ Usually put in place from the start, but can be initiated or removed at any time (carpet/furniture analogy) ▪ Most often used in work/enterprise environments ▪ Requires Bitlocker key or physical USB key ▪ What happens if you lose the key?  Other tools can utilized FILE-BASED encryption, which can be equally challenging

Answer 5

Beginning (carpet-furniture analogy)

Answer 6

You would have to do a logical, LIVE collection. If the file is/drive is still open, then you wouldn't need the key.

Answer 7

Windows now utilizes Microsoft One Drive by default ▪ Allows for syncing of data across devices ▪ Allows for cloud-based storage of files, documents, etc.  Collection of cloud-based data presents a challenge for digital forensic analysts  What is required to access cloud-based data? ▪ Legal Authority/Permission ▪ Two-factor authentication

Answer 8

generally logical

Answer 9

The Windows Registry contains information, settings, options, and other values for programs and hardware installed on all versions of Microsoft Windows operating systems. It is like the central nervous system.

Answer 10

System info like Time zone setting information ▪ Software installed (if opted in) ▪ Boot dates/times & password information ▪ Connected devices & partition information ▪ Network connection information IP address AND USER DATA LIKE ▪ User accounts on the system including… ▪ User SIDs ▪ User “familiar” names ▪ Last logon & password entrance info ▪ Passwords themselves are usually obfuscated ▪ Most recently used (MRU) programs & files ▪ Prior existing user accounts (deleted but still in registry)

Answer 11

NO - it is a very sensitive intertwined system.

Answer 12

Main files (or keys/hives) of interest in the Windows registry. There are 5.

Answer 13

(Security Accounts Manager) key: Stores all account information across the system

Answer 14

Maintains database of all permissions & access across the system

Answer 15

Tracks the settings on the system, including the time zone settings, installation and boot information, Windows version and upgrade information, etc

Answer 16

Tracks all of the installed and used software that opts-into the use of the registry

Answer 17

One is created/updated for each user on the system ▪ Activity here is tracked in the registry and on the system by SID ▪ Just because a user is removed, doesn’t mean their NTUser file is removed

Answer 18

Shows external memory devices with device-specific serial numbers Shows MRU Shows user account information and frequently used account

Answer 19

User/system interaction – “proof of life”, intent  Interaction with other systems/devices Absence of evidence is not evidence of absence…

Answer 20

 Impression left by contact of a “tool” on a “surface”  Tool – user/actor behavior, use of program/application  Surface – operating system, applications  Impression – Registry keys, values (or lack thereof) The use of a computer system can leave toolmarks inside the system.

Answer 21

Available artifacts have increased with Windows versions/builds Historical data may be available  Persists beyond the removal of files/programs  VSCs, hibernation file/memory dump  Transaction logs, deleted data (within the hive file)  Artifact constellations Counter-Forensics  Deleted data  *Advanced topic How far can you go back? depends on how long it's been deleted. eventually stuff gets overwritten.

Answer 22

Time stamps within the Registry  Dates and time are recorded in a number of different ways within the Registry – binary, strings, etc.  Time stamped data applies to both “proof of life” and intent, in that the timing, the “when” is often more telling than the action itself  When something occurred, in relation to other events, can often be extremely important and provide significant insight CAN SEE IF A PERSON TOOK A CERTAIN ACTION

Answer 23

Windows Version  NT 4.0, Win2000, XP -> Win10, beyond Configuration “Database” Devices, Applications (MSOffice, Adobe, etc.) System/application functionality Persistence User Information (can be persistent) Tracking preferences and activity Artifacts will persist beyond removal of an application Persistence9 Volatile portions of the Registry (this can be purged)

Answer 24

A structure where it just looks like the folders are structured so we can understand it. It doesn't actually look like that on the computer. Structures: keys vs values vs data "File System" KIND OF Registry structure can be thought of as a file system Keys = folders Values = files Data = file contents Deleted Data

Answer 25

Civil dispute over theft of company data found a USB plug-in in the Windows Registry

Answer 26

Wife incidentally discovered videos of 20 year-old Au Paire on husband’s computer Go.zip Yes.rar These were the files that were archived and became main files of interest. They found deleted files and metadata in the Windows Registry hits. Also were able to see that the files were copied on different media (this has less metadata). NEED TO LOOK AT ALL PARTS TO UNDERSTAND THE WHOLE STORY