Guide to Computer Forensics

and Investigations
Sixth Edition

Chapter 5
Working with Windows and CLI Systems

1
 Objectives

• Explain the purpose and structure of file systems

• Describe Microsoft file structures
• Explain the structure of NTFS disks
• List some options for decrypting drives encrypted with whole disk encryption
• Explain how the Windows Registry works
• Describe Microsoft startup tasks
• Explain the purpose of a virtual machine

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 2
2
password-protected website for classroom use.
 Understanding File Systems

• File system
• Gives OS a road map to data on a disk
• Type of file system an OS uses determines how data is stored on the disk
• When you need to access a suspect’s computer to acquire or inspect data
• You should be familiar with both the computer’s OS and file systems

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 3
3
password-protected website for classroom use.
 Understanding the Boot Sequence (1 of 3)

• Complementary Metal Oxide Semiconductor (CMOS)

• Computer stores system configuration and date and time information in the CMOS
-When power to the system is off
• Basic Input/Output System (BIOS) or Extensible Firmware Interface (EFI)
• Contains programs that perform input and output at the hardware level

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 4
4
password-protected website for classroom use.
 Understanding the Boot Sequence (2 of 3)

• Bootstrap process
• Contained in ROM, tells the computer how to proceed
• Displays the key or keys you press to open the CMOS setup screen
• CMOS should be modified to boot from a forensic floppy disk or CD
• When a subject’s computer starts, you must make sure it boots to a forensic floppy disk
or CD because booting to the hard disk overwrites and changes evidentiary data.
• To do this, you access the CMOS setup by monitoring the subject’s computer during the
initial bootstrap process to identify the correct key or keys to use.

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 5
5
password-protected website for classroom use.
Understanding the Boot Sequence (3 of 3)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 6
6
password-protected website for classroom use.
 7
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
 Understanding Disk Drives (1 of 4)

• Disk drives are made up of one or more platters coated with magnetic material
• Disk drive components
• Geometry—Geometry refers to a disk’s structure of platters, tracks, and sectors.
• Head— is the device that reads and writes data to a drive. There’s one head per
platter.
• Tracks— are concentric circles on a disk platter where data is located.
• Cylinders—A cylinder is a column of tracks on two or more disk platters. Each platter
has two surfaces: top and bottom.
• Sectors—A sector is a section on a track, usually made up of 512 bytes.

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 8
8
password-protected website for classroom use.
Understanding Disk Drives (2 of 4)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 9
9
password-protected website for classroom use.
Understanding Disk Drives (3 of 4)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 10
10
password-protected website for classroom use.
 Understanding Disk Drives (4 of 4)

• Properties handled at the drive’s hardware or firmware level

• Zone bit recording (ZBR): ZBR is how most manufacturers deal with a platter’s inner
tracks being shorter than its outer tracks. Grouping tracks by zones ensures that all
tracks hold the same amount of data.
• Track density: is the space between each track
• Areal density: the number of bits in one square inch of a disk platter.
• Head and cylinder skew: used to improve disk performance.

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 11
11
password-protected website for classroom use.
 Solid-State Storage Devices

• Flash memory storage devices used in USB drives, laptops, tablets, and cell
phones can be a challenge for digital forensics examiners because if deleted
data isn’t recovered immediately, it might be lost forever. The reason is a
feature all flash memory devices have wear-leveling.
• All flash memory devices have a feature called wear-leveling
• An internal firmware feature used in solid-state drives that ensures even wear of
read/writes for all memory cells
• When dealing with solid-state devices, making a full forensic copy as soon as
possible is crucial
• In case you need to recover data from unallocated disk space

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 12
12
password-protected website for classroom use.
 Exploring Microsoft File Structures (1 of 2)

• In Microsoft file structures, sectors are grouped to form clusters

• Storage allocation units of one or more sectors
• Clusters range from 512 bytes up to 32,000 bytes each
• Combining sectors minimizes the overhead of writing or reading files to a disk

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 13
13
password-protected website for classroom use.
 Exploring Microsoft File Structures (2 of 2)

• Clusters are numbered sequentially starting at 0 in NTFS and 2 in FAT

• First sector of all disks contains a system area, the boot record, and a file structure
database
• OS assigns these cluster numbers, called logical addresses
• Sector numbers are called physical addresses
• Clusters and their addresses are specific to a logical disk drive, which is a disk
partition

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 14
14
password-protected website for classroom use.
 Disk Partitions (1 of 3)

• A partition is a logical drive

• Windows OSs can have three primary partitions followed by an extended
partition that can contain one or more logical drives
• FAT16 does not recognize disks larger than 2 GB
• Large disks have to be partitioned
• Hidden partitions or voids
• Large unused gaps between partitions on a disk
• Partition gap
• Unused space between partitions

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 15
15
password-protected website for classroom use.
 Disk Partitions (2 of 3)

• The partition table is in the Master Boot Record (MBR)

• Located at sector 0 of the disk drive
• In a hexadecimal editor, such as WinHex, you can find the first partition at offset
0x1BE
• The file system’s hexadecimal code is offset 3 bytes from 0x1BE for the first partition

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 16
16
password-protected website for classroom use.
Disk Partitions (3 of 3)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 17
17
password-protected website for classroom use.
 Examining FAT Disks (1 of 7)

• File Allocation Table (FAT)

• File structure database that Microsoft originally designed for floppy disks
• FAT database is typically written to a disk’s outermost track and contains:
• Filenames, directory names, date and time stamps, the starting cluster number, and
file attributes
• Three current FAT versions
• FAT16, FAT32, and exFAT (used for mobile personal storage devices)
• Cluster sizes vary according to the hard disk size and file system

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 18
18
password-protected website for classroom use.
Examining FAT Disks (2 of 7)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 19
19
password-protected website for classroom use.
 Examining FAT Disks (3 of 7)

• Microsoft OSs allocate disk space for files by clusters

• Results in drive slack
-Unused space in a cluster between the end of an active file’s content and the end of
the cluster
• Drive slack includes:
• RAM slack and file slack
• An unintentional side effect of FAT16 allowing large clusters was that it reduced
fragmentation
• As cluster size increased
• Because of this inefficient allocation of sectors to clusters, when nearly full
FAT16 drives were converted to FAT32.

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 20
20
password-protected website for classroom use.
Examining FAT Disks (4 of 7)

a small space is left between the end of the file contents and the
end of the last cluster allocated to it. This space is called File
Slack

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 21
21
password-protected website for classroom use.
 Examining FAT Disks (5 of 7)

• When you run out of room for an allocated cluster

• OS allocates another cluster for your file
• As files grow and require more disk space, assigned clusters are chained
together
• The chain can be broken or fragmented
• Typically, chained clusters are contiguous on the disk.
• However, as some files are created and deleted and other files are expanded, the
chain can be broken or fragmented
• When the OS stores data in a FAT file system, it assigns a starting cluster
position to a file
• Data for the file is written to the first sector of the first assigned cluster

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 22
22
password-protected website for classroom use.
Examining FAT Disks (6 of 7)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 23
23
password-protected website for classroom use.
 Examining FAT Disks (7 of 7)

• When this first assigned cluster is filled and runs out of room
• FAT assigns the next available cluster to the file
• If the next available cluster isn’t contiguous to the current cluster
• File becomes fragmented

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 24
24
password-protected website for classroom use.
 Deleting FAT Files

• In Microsoft OSs, when a file is deleted

• Directory entry is marked as a deleted file
-With the HEX E5 (σ) character replacing the first letter of the filename
-FAT chain for that file is set to 0
• Data in the file remains on the disk drive
• Area of the disk where the deleted file resides becomes unallocated disk space
• Available to receive new data from newly created files or other files needing more
space

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 25
25
password-protected website for classroom use.
 Examining NTFS Disks (1 of 3)

• NT File System (NTFS)

• Introduced with Windows NT
• Primary file system for Windows 10
• Improvements over FAT file systems
• NTFS provides more information about a file
• NTFS gives more control over files and folders
• NTFS was Microsoft’s move toward a journaling file system
• It records a transaction before the system carries it out
• That way, in a power failure or other interruption, the system can complete the
transaction or go back to the last good setting.
• The system keeps track of transactions such as file deleting or saving.

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 26
26
password-protected website for classroom use.
 Examining NTFS Disks (2 of 3)

• In NTFS, everything written to the disk is considered a file

• On an NTFS disk
• First data set is the Partition Boot Sector which starts at sector [0] of the disk and can
expand to 16 sectors.
• Next is Master File Table (MFT). An MFT file is created at the same time a disk
partition is formatted.
• NTFS results in much less file slack space
• Clusters are smaller for smaller disk drives
• NTFS also uses Unicode
• An international data format

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 27
27
password-protected website for classroom use.
Examining NTFS Disks (3 of 3)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 28
28
password-protected website for classroom use.
 NTFS System Files (1 of 3)

• MFT contains information about all files on the disk

• Including the system files the OS uses
• In the MFT, the first 15 records are reserved for system files
• Records in the MFT are called metadata

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 29
29
password-protected website for classroom use.
NTFS File System (2 of 3)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 30
30
password-protected website for classroom use.
NTFS File System (3 of 3)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 31
31
password-protected website for classroom use.
 MFT and File Attributes (1 of 7)

• In the NTFS MFT

• All files and folders are stored in separate records of 1024 bytes each
• Each record contains file or folder information
• This information is divided into record fields containing metadata
• A record field is referred to as an attribute ID
• File or folder information is typically stored in one of two ways in an MFT
record:
• Resident and nonresident

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 32
32
password-protected website for classroom use.
 MFT and File Attributes (2 of 7)

• Files larger than 512 bytes are stored outside the MFT
• MFT record provides cluster addresses where the file is stored on the drive’s partition
-These cluster addresses are referred to as data runs
-This type of MFT record is called nonresident because the file’s data is stored in its
own separate file outside the MFT
• Each MFT record starts with a header identifying it as a resident or nonresident
attribute

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 33
33
password-protected website for classroom use.
 MFT and File Attributes (2 of 7)

• Each MFT record starts with a header identifying it as a resident or nonresident

attribute.
• The first 4 bytes (characters) for all MFT records are FILE.
• The header information contains additional data specifying where the first
attribute ID starts, which is typically at offset 0x14 from the beginning of the
record.
• Each attribute ID has a length value in hexadecimal defining where it ends and
where the next attribute starts.
• The length value is located 4 bytes from the attribute ID.

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 34
34
password-protected website for classroom use.
MFT and File Attributes (3 of 7)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 35
35
password-protected website for classroom use.
MFT and File Attributes (4 of 7)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 36
36
password-protected website for classroom use.
MFT and File Attributes (5 of 7)

Figure 6-9 is an MFT record showing

the resident attributes of a small file
viewed in a hexadecimal editor.

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 37
37
password-protected website for classroom use.
 Figure 6-9 is an MFT record showing
the resident attributes of a small file
viewed in a hexadecimal editor.

38
38
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
MFT and File Attributes (6 of 7)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 39
39
password-protected website for classroom use.
 40
40
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
 MFT and File Attributes (7 of 7)

• When a disk is created as an NTFS file structure

• OS assigns logical clusters to the entire disk partition
• These assigned clusters are called logical cluster numbers (LCNs)
• Become the addresses that allow the MFT to link to nonresident files on the disk’s
partition
• When data is first written to nonresident files, an LCN address is assigned to the
file
• This LCN becomes the file’s virtual cluster number (VCN)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 41
41
password-protected website for classroom use.
 MFT Structures for File Data (1 of 7)

• For the header of all MFT records, the record fields of interest are as follows:
• At offset 0x00 - the MFT record identifier FILE
• At offset 0x1C to 0x1F - size of the MFT record
• At offset 0x14 - length of the header (indicates where the next attribute starts)
• At offset 0x32 and 0x33 - the update sequence array, which stores the last 2 bytes of
the first sector of the MFT record

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 42
42
password-protected website for classroom use.
MFT Structures for File Data (2 of 7)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 43
43
password-protected website for classroom use.
 MFT Structures for File Data (3 of 7)
Following the MFT header for a data file is the Standard Information attribute, 0x10,
which has the following fields (see Figure 5-14):
• At offset 0x38 from the beginning of the MFT record—The start of attribute 0x10.
• At offset 0x04 and 0x05 from the beginning of attribute 0x10—Size of the 0x10 attribu
• At offset 0x18 to 0x1F—The file’s create date and time; all dates and times are
stored in the Win32 Filetime format.
• At offset 0x20 to 0x27—The last modified date and time for the file.
• At offset 0x28 to 0x2F—The last access date and time.
• At offset 0x30 to 0x2F—The record access date and time.

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 44
44
password-protected website for classroom use.
MFT Structures for File Data (4 of 7)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 45
45
password-protected website for classroom use.
 46
46
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
 MFT Structures for File Data (5 of 7)

Depending on the Windows version, sometimes attribute 0x40 is listed in the MFT.
This attribute contains file ownership and access control information and has the
following fields:
• At offset 0x04 and 0x05 from the beginning of attribute 0x40—The size of
attribute 0x40
• At offset 0x14—Starting offset position for GUID data
• At offset 0x18 to 0x27—Starting position for GUID Object_ID data

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 47
47
password-protected website for classroom use.
 MFT Structures for File Data (6 of 7)
For a resident file’s attribute 0x80, the fields of interest are as follows (see
Figure 5-17):
• At offset 0x04 and 0x05 from the beginning of attribute 0x80—Size of the
attribute.
• At offset 0x08—The resident/nonresident flag; for resident data, it’s set to
0x00.
• At offset 0x10—Number of bytes in the data run.
• At offset 0x18—Start of the resident data run.
• At offset 0x1E and 0x1F from the beginning of the MFT header—The sector
checksum value, used to validate the first 512 bytes of the MFT record.

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 48
48
password-protected website for classroom use.
MFT Structures for File Data (7 of 7)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 49
49
password-protected website for classroom use.
 NTFS Alternate Data Streams (1 of 2)

• Alternate data streams

• Ways data can be appended to existing files
• Can obscure valuable evidentiary data, intentionally or by coincidence
• In NTFS, an alternate data stream becomes an additional file attribute
• Allows the file to be associated with different applications
• You can only tell whether a file has a data stream attached by examining that
file’s MFT entry

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 50
50
password-protected website for classroom use.
NTFS Alternate Data Streams (2 of 2)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 51
51
password-protected website for classroom use.
 NTFS Compressed Files

• NTFS provides compression similar to FAT DriveSpace 3 (a Windows 98

compression utility)
• With NTFS, files, folders, or entire volumes can be compressed
• Most computer forensics tools can uncompress and analyze compressed
Windows data

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 52
52
password-protected website for classroom use.
 NTFS Encrypting File System (EFS)

• Encrypting File System (EFS)

• Introduced with Windows 2000
• Implements a public key and private key method of encrypting files, folders, or disk
volumes
• When EFS is used in Windows 2000 and later
• A recovery certificate is generated and sent to the local Windows administrator
account
• The purpose of the recovery certificate is to provide a mechanism for recovering
encrypted files under EFS if there’s a problem with the user’s original private key
• Users can apply EFS to files stored on their local workstations or a remote
server

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 53
53
password-protected website for classroom use.
 EFS Recovery Key Agent

• Recovery Key Agent implements the recovery certificate

• Which is in the Windows administrator account
• Windows administrators can recover a key in two ways: through Windows or
from a command prompt
• Commands:
• cipher
• Copy
• To recover an encrypted EFS file, a user can e-mail it or copy the file to the
administrator.
• The administrator can then run the Recovery Key Agent function to restore the
file

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 54
54
password-protected website for classroom use.
 Deleting NTFS Files

• When a file is deleted in Windows NT and later

• The OS renames it and moves it to the Recycle Bin
• Can use the del (delete) MS-DOS command
• Eliminates the file from the MFT listing in the same way FAT does

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 55
55
password-protected website for classroom use.
 Resilient File System

• Resilient File System (ReFS) - designed to address very large data storage needs
• Such as the cloud
• Features incorporated into ReFS’s design:
• Maximized data availability
• Improved data integrity
• Designed for scalability
• ReFS uses disk structures similar to the MFT in NTFS

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 56
56
password-protected website for classroom use.
 Understanding Whole Disk Encryption (1 of
3)
• In recent years, there has been more concern about loss of
• Personal identity information (PII) and trade secrets caused by computer theft
• Of particular concern is the theft of laptop computers and handheld devices
• To help prevent loss of information, software vendors now provide whole disk
encryption

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 57
57
password-protected website for classroom use.
 Understanding Whole Disk Encryption (2 of
3)
• Current whole disk encryption tools offer the following features:
• Preboot authentication such as a single sign-on password, fingerprint scan
• Full or partial disk encryption with secure hibernation such as activating a
password-protected screen saver
• Advanced encryption algorithms
• Key management function

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 58
58
password-protected website for classroom use.
 Understanding Whole Disk Encryption (3 of
3)
• Whole disk encryption tools encrypt each sector of a drive separately
• Many of these tools encrypt the drive’s boot sector
• To prevent any efforts to bypass the secured drive’s partition
• To examine an encrypted drive, decrypt it first
• Run a vendor-specific program to decrypt the drive
• Many vendors use a bootable CD or USB drive that prompts for a one-time
passphrase

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 59
59
password-protected website for classroom use.
 Examining Microsoft BitLocker

• Microsoft’s utility for protecting drive data is called BitLocker (Encryption

feature)
• Available Vista Enterprise/Ultimate, Windows 7, 8, and 10
Professional/Enterprise, and Server 2008 and later
• Hardware and software requirements
• A computer capable of running Windows Vista or later
• The TPM microchip, version 1.2 or newer
• A computer BIOS compliant with Trusted Computing Group (TCG)
• Two NTFS partitions
• The BIOS configured so that the hard drive boots first before checking other bootable
peripherals

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 60
60
password-protected website for classroom use.
 Examining Third-Party Disk Encryption
Tools
• Several vendors offer third-party WDE utilities that have more features than
BitLocker.
-For example, BitLocker can encrypt only NTFS drives. If you want to encrypt a FAT
drive, you need a third-party solution.
• Some available third-party WDE utilities:
• Endpoint Encryption
• Voltage SecureFile
• Jetico BestCrypt Volume Encryption

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 61
61
password-protected website for classroom use.
 Understanding the Windows Registry

• Registry
• A database that stores hardware and software configuration information, network
connections, user preferences, and setup information
• For investigative purposes, the Registry can contain valuable evidence
• To view the Registry, you can use:
• Regedit (Registry Editor) program for Windows 9x systems
• Regedt32 for Windows 2000, XP, and Vista
• Both utilities can be used for Windows 7 and 8

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 62
62
password-protected website for classroom use.
 Exploring the Organization of the Windows
Registry (1 of 5)
• Registry terminology:
• Registry
• Registry Editor
• HKEY
• Key
• Subkey
• Branch
• Value
• Default value
• Hives

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 63
63
password-protected website for classroom use.
 Exploring the Organization of the Windows
Registry
• Registry—A collection of files containing system and user information.
• Registry Editor—A Windows utility for viewing and modifying data in the Registry.
• HKEY—Windows splits the Registry into categories with the prefix HKEY_.
• Windows 9x systems have six HKEY categories and Windows 2000 and later have five.
• Windows programmers refer to the “H” as the handle for the key.
• Key—Each HKEY contains folders referred to as keys. Keys can contain other key folders
or values.
• Subkey—A key displayed under another key is a subkey, similar to a subfolder in
Windows Explorer.
• Branch—A key and its contents, including subkeys, make up a branch in the Registry.
• Value—A name and value in a key; it’s similar to a file and its data content.
• Default value—All keys have a default value that may or may not contain data.
• Hives—Hives are specific branches in HKEY_USER and HKEY_LOCAL_MACHINE.
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 64
password-protected website for classroom use.
Exploring the Organization of the Windows
Registry (2 of 5)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 65
65
password-protected website for classroom use.
Exploring the Organization of the Windows
Registry (3 of 5)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 66
66
password-protected website for classroom use.
Exploring the Organization of the Windows
Registry (4 of 5)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 67
67
password-protected website for classroom use.
Exploring the Organization of the Windows
Registry (5 of 5)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 68
68
password-protected website for classroom use.
 Examining the Windows Registry (1 of 2)

• Tools with built-in or add-on Registry viewers:

• X-Ways Forensics
• OSForensics
• Forensic Explorer
• FTK

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 69
password-protected website for classroom use.
Examining the Windows Registry (2 of 2)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 70
password-protected website for classroom use.
 Understanding Microsoft Startup Tasks

• Learn what files are accessed when Windows starts

• This information helps you determine when a suspect’s computer was last
accessed
• Important with computers that might have been used after an incident was reported

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 71
71
password-protected website for classroom use.
 Startup in Windows 7, Windows 8 and
Windows 10
• Windows 8 and 10 are multiplatform OSs
• Can run on desktops, laptops, tablets, and smartphones
• The boot process uses a boot configuration data (BCD) store
• The BCD contains the boot loader that initiates the system’s bootstrap process
• Press F8 or F12 when the system starts to access the Advanced Boot Options

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 72
72
password-protected website for classroom use.
 Startup in Windows NT and Later (1 of 5)

• All NTFS computers perform the following steps when the computer is turned
on:
• Power-on self test (POST)
• Initial startup
• Boot loader
• Hardware detection and configuration
• Kernel loading
• User logon

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 73
73
password-protected website for classroom use.
 Startup in Windows NT and Later (2 of 5)

• Startup Files for Windows Vista:

• The Ntldr program in Windows XP used to load the OS has been replaced with these
three boot utilities:
-Bootmgr.exe
-Winload.exe
-Winresume.exe
• Windows Vista includes the BCD editor for modifying boot options and updating the
BCD registry file
• The BCD store replaces the Windows XP boot.ini file

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 74
74
password-protected website for classroom use.
 Startup in Windows NT and Later (3 of 5)

• Startup Files for Windows XP:

• NT Loader (NTLDR)
• Boot.ini
• Ntoskrnl.exe
• Bootvid.dll
• Hal.dll
• BootSect.dos
• NTDetect.com
• NTBootdd.sys
• Pagefile.sys
• Device drivers
• Contain instructions for the OS for hardware devices

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 75
75
password-protected website for classroom use.
Startup in Windows NT and Later (4 of 5)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 76
76
password-protected website for classroom use.
 Startup in Windows NT and Later (5 of 5)

• Contamination Concerns with Windows XP

• When you start a Windows XP NTFS workstation, several files are accessed
immediately
-The last access date and time stamp for the files change to the current date and
time
• Destroys any potential evidence
-That shows when a Windows XP workstation was last used

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 77
77
password-protected website for classroom use.
 Understanding Virtual Machines (1 of 3)

• Virtual machines
• Enable you to run another OS on an existing physical computer (known as the host
computer) by emulating a computer’s hardware environment
• A virtual machine is just a few files on your hard drive
• Must allocate space to it
• A virtual machine recognizes components of the physical machine it’s loaded on
• Virtual OS is limited by the physical machine’s OS

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 78
78
password-protected website for classroom use.
Understanding Virtual Machines (2 of 3)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 79
79
password-protected website for classroom use.
 Understanding Virtual Machines (3 of 3)

• In digital forensics
• Virtual machines make it possible to restore a suspect drive on your virtual machine
-And run nonstandard software the suspect might have loaded
• From a network forensics standpoint, you need to be aware of some potential
issues, such as:
• A virtual machine used to attack another system or network

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 80
80
password-protected website for classroom use.
 Creating a Virtual Machine

• Common applications for creating virtual machines

• VMware Server, VMware Player and VMware Workstation, Oracle VM VirtualBox,
Microsoft Virtual PC, and Hyper-V
• Using VirtualBox
• An open-source program (download)
• Consult with your instructor before doing the activities using VirtualBox

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 81
81
password-protected website for classroom use.
 Summary (1 of 3)

• When starting a suspect’s computer, using boot media, such as forensic boot
CDs or USB drives, you must ensure that disk evidence isn’t altered
• The Master Boot Record (MBR) stores information about partitions on a disk
• Microsoft used FAT12 and FAT16 on older operating systems
• To find a hard disk’s capacity, use the cylinders, heads, and sectors (CHS)
calculation

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 82
82
password-protected website for classroom use.
 Summary (2 of 3)

• When files are deleted in a FAT file system, the hexadecimal value 0x05 is
inserted in the first character of the filename in the directory
• NTFS is more versatile because it uses the Master File Table (MFT) to track file
information
• Records in the MFT contain attribute IDs that store metadata about files
• In NTFS, alternate data streams can obscure information that might be of
evidentiary value

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 83
83
password-protected website for classroom use.
 Summary (3 of 3)

• File slack, RAM slack, and drive slack are areas in which valuable information
can reside on a drive
• NTFS can encrypt data with EFS and BitLocker
• NTFS can compress files, folders, or volumes
• Windows Registry keeps a record of attached hardware, user preferences,
network connections, and installed software
• Virtualization software enables you to run other OSs on a host computer

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a 84
84
password-protected website for classroom use.