Scribd
Upload
112 views35 pages

Windows System Artifacts

This document discusses various Windows system artifacts that can be analyzed to attribute actions on a computer to specific users, including the recycle bin, metadata, thumbnail images, most recently used lists, restore points and shadow copies, prefetch and link files, and installed programs. It provides details on how each of these artifacts works in Windows and how they can be analyzed using various forensic tools.

Uploaded by

Ain Anuar
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
112 views35 pages

Windows System Artifacts

This document discusses various Windows system artifacts that can be analyzed to attribute actions on a computer to specific users, including the recycle bin, metadata, thumbnail images, most recently used lists, restore points and shadow copies, prefetch and link files, and installed programs. It provides details on how each of these artifacts works in Windows and how they can be analyzed using various forensic tools.

Uploaded by

Ain Anuar
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 35

5.

Windows System Artifacts


Part 2
Topics
• Attribution
• Recycle Bin
• Metadata
• Thumbnail Images
• Most Recently Used Lists
• Restore Points and Shadow Copies
• Prefetch and Link Files
Attribution
• Evidence of an action is easy to find
o Search terms
o images
o Web pages viewed
• Attribution is more difficult
o Who was using the computer when the action
took place?
• One machine may have multiple accounts
• Win XP starts with Administrator and Guest
o Both disabled by default in Windows 7
SID (Security Identifier)
SIDs in the Registry
Well-Known SIDs
• Link Ch 5o
External Drives
• USBSTOR shows exactly which USB devices have
been attached to a computer
• Helpful in attributing evidence found on removable
devices
Print Spooling
• When a document is printed, two files are created
o Enhanced Meta File (EMF) contains an image of
the document to be printed
o Spool File contains information about the print
job
• They are normally deleted after printing finishes, but
may be retained on some systems
Recycle Bin
Recycle Bin Operation
• Not everything
deleted goes into
the Recycle Bin
• Shift+Delete will
bypass the Recycle
Bin, so will "Delete"
from a command
prompt
• A user can disable
the Recycle bin in
Recycle Bin
Properties
NukeOnDelete
Registry Key

• Win XP
• (Link Ch 5p)

• Win 7
• (Link Ch 5q)
Metadata
Metadata
• Data about data
• File system metadata
o Timestamps (Created, Modified, Accessed)
o Permissions, owner

• Application metadata
o Author's name
o GPS coordinates
o Software owner's name
Timestamps
• WARNING: These all
depend on the
system clock, which
can be reset
• Created
• Modified
• Accessed
o Even if the file
was not opened,
but just scanned
by antivirus
MACR Times
• Sleuthkit will show these four timestamps
o Link Ch 5r
Timestamp Principles
• Be very careful
• Perform experiments on similar systems to verify
conclusions
• Use multiple tools
• Watch out for system clock changes
Demo: John McAfee's
Photo

• Exif Viewer
o Link Ch 5t
• Link Ch 5u
Removing Metadata
• Microsoft Office
Document
Inspector
o Link Ch 5v
• Other tools
o Link Ch 5w
Thumbnail
Cache
Windows XP Thumbnails
• Thumbs.db
• Hidden file in
same folder as
images
o Image from
link Ch 5x
Windows 7 Thumbnails

• To view these, see tool at link Ch 5x


Most Recently Used
• Right-click taskbar button
in Windows 7
• Click File icon In Paint
• Many, many, other places
System Restore
Restore Points
• Win 7 creates a restore
point every 7 days by
default
o XP and Vista did it
every day
• They are created by a
Shadow Copy service,
which can copy files
even when they are in
use
When Restore Points Are Created
• An application is installed with a compatible Vista
or Win 7 installer
• Windows Updates
• System Restore is performed
o A Restore Point is made first so the System Restore
can be reversed
• Windows Backup
o A Restore Point is created as part of the backup
process
Restore Settings
• Click Configure
• Choose whether to
monitor system settings
or just files
• "System Settings"
includes the Registry
and many other system
file types
System Restore Files
• In C:\System Volume Information
o You can't open this folder, or even take
ownership of it
o It's only intended for System access
Previous Versions

• Image from
microsoft.com
PreFetch
• To make a Windows machine run faster
• A shortcut to programs you commonly open is
saved in the Prefetch folder
• There are Prefetch Viewers to help read the files
• The format is different in Win XP and Win 7/Vista
o Links Ch 5y, 5z
PreFetch in Win XP
PreFetch in Win 7
Link Files
• Shortcuts to programs and other files
• They have time and date stamps
• Links in the "Recent Files" folder to network shares
even contain the MAC address of the server!
Recent Files Viewer
• Works on Win XP & Win 7
• Link Ch 5z1
Installed Programs
• Give information about the user's activities
• Recently uninstalled programs may also be
important evidence of guilt
• Traces of uninstalled programs may be found in
o Programs folder
o Links
o Prefetch files

You might also like