Windows forensic part 3

Question 1

What is spoliation?

Answer 1

Intentional acts of destruction, alteration or any other action with the purpose of preventing the retrieval of artifacts of evidential value.

Question 2

How do you know if any spoliation has taken place?

Answer 2

You have to compare deleted files SIA, permissions, link files and $Logfile.
If there is any deletion of files you should look in $Bitmap at the appropriate location if it has been modified to show if the space is occupied by the MFT record and the file itself is unallocated.

Question 3

How can you see if there have been any data destruction?

Answer 3

Some specific files and folders that have been wiped may have their names changed to something without sense like: aaaaa.aa or DELETED_DELETED_DELETED.
Sometimes the fact that a wiping tool was used is itself a an evidence

Question 4

What does Fragmentation mean?

Answer 4

Related data are “scattered” and not aligned in a sequential manner

Question 5

What does Defragmentation mean?

Answer 5

Process of gathering data structures that are spread across the disk and places them into contiguous clusters. (to improve system performance)

Question 6

How can you tell if the system recently has been defragmented?

Answer 6

• Are there artefacts related to program installaion?
• Are there presence of thirds party defragmentation tools?
• Are the files sorted by number of file fragments in forensic tools?

Question 7

Is the file data lost when the Recycle bin is empty?

Answer 7

No, it´s time stamps can still reveal useful data about when it was emptied.

Question 8

Which three categories of general Internet Explorer artifacts are there?

Answer 8

• Cookies
• Internet History
• Web Cache

Question 9

What information may you find from Internet Explorer Cookies?

Answer 9

URLs, Domain names, User names, date/time etc..

Question 10

What kind of internet history can you find?

Answer 10

• Cumulative History (lastt URL visit timestamp)
• Daily history
• Weekly history

Question 11

What are saved in the Web cache?

Answer 11

Actual files downloaded as a part of web browsing, you can find the URL from which the file was downloaded and the number of times that URL was visited.

Question 12

What can you find out from an email client?

Answer 12

information related to emails, contacts and calendars