unprotected-CHFI v3 Module 10 Windows Forensics.pdf

(1795 KB) Pobierz
Computer Hacking
Forensic Investigator
Module X
Windows Forensics
Module Objective
This module familiarizes you with the following:
Locating evidence on Windows systems.
Gathering volatile evidence.
Helix.
Investigating Windows file slack.
Examining file systems
systems.
Checking Registry.
Importance of Memory dump.
Virtual memory.
Investigating Internet traces.
Investigating ADS S
i i A S Streams.
EC-Council
Copyright © by
EC-Council
All Rights reserved. Reproduction is strictly prohibited
Module Flow
Locating evidence on
Windows system
Wi d
t
Gathering volatile evidence
Investigating Windows file
slack
Helix
Examining File systems
Checking Registry
Virtual memory
y
Importance of memory dump
Investigating Internet traces
g
g
Investigating ADS Streams
g
g
EC-Council
Copyright © by
EC-Council
All Rights reserved. Reproduction is strictly prohibited
Locating Evidence on Windows Systems
Hidden files
Assessing file attributes to find file signature
The registry
Searching Index.dat files
Areas to look for evidence
Files
Slack
Sl k space
Swap file
Metadata
Hidden ADS streams
Pagingfile
Unallocated clusters
Unused partitions
Hidden partitions
EC-Council
Copyright © by
EC-Council
All Rights reserved. Reproduction is strictly prohibited
Gathering Volatile Evidence
Collecting volatile data using command prompt in Windows
NT/2000:
/
System date and time:
•
C:/>date ; C:/>time
Currently running processes:
•
Tool - pslist
Currently open sockets:
•
C:/>netstat
Applications listening on open sockets:
•
Tool - fport
p
Current users logged on:
•
Tool - psloggedon
Systems currently recentl connected:
S stems c rrentl or recently connected
•
C:/>nbstat
EC-Council
Copyright © by
EC-Council
All Rights reserved. Reproduction is strictly prohibited

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin