In our work and personal lives, we use multiple operating systems (OSs) on different devices, including our desktops, laptops, and smartphones, on a daily basis. To understand more about this concept, we will cover in-depth knowledge about what an OS is and then focus on the Windows OS, which is the most popular OS by far for personal and corporate needs.

In the world of technology, Windows has become the leading OS for PCs and other devices. Thus, having a comprehensive understanding of this OS and the insights it can provide during digital forensic investigations is crucial. This chapter aims to provide an overview of the fundamental concepts of digital forensics and incident response in the context of Windows OS. Moreover, the chapter also explores the concept of Volume Shadow Copy Service (VSS) and its significance in digital forensics. VSS is a crucial feature of Windows OSs that enables the creation of shadow copies of files and folders at a particular point in time. As a result, VSS serves as an essential source of information for forensic investigators, allowing them to reconstruct events and gather evidence from a particular moment in time.

Understanding the basic concept of OSs will significantly aid in gaining knowledge of what we are investigating as forensic examiners and what value we get from these artifacts.

In this chapter, we will cover the following topics:

• What is a Microsoft OS?
• The modern Windows OS and filesystems
• Digital forensics and common terminology
• Windows VSS
• Preparing a lab environment

In this chapter, we are going to prepare our environment for labs, so we need to be able to install a trial version of VMware or Oracle VirtualBox and an ISO file for Windows 10.

VMware is available here: https://www.vmware.com/mena/products/workstation-pro/workstation-pro-evaluation.html.

VirtualBox is available here: https://www.oracle.com/sa/virtualization/technologies/vm/downloads/virtualbox-downloads.html.

The Windows OS ISO is available here: https://www.microsoft.com/en-gb/software-download/windows10.

Important note

For lab preparation, if you are proceeding with the VMware product, please use the free 30-day trial or a legitimate product key.

As a forensic examiner, understanding the concept of an OS is crucial. Microsoft announced Windows for the first time on November 10, 1983, as a graphical user interface (GUI) that provided users with a friendly interface and layer to interact with the command-line-based MS-DOS code that was released previously. This started a new era for user interfaces and made it easy for people who did not know how to interact with a disk operating system (DOS) to work and learn with computers.

According to the latest articles and research, a Windows OS is installed on almost 76% of devices across the globe (desktop and laptop). The desktop OS market share is illustrated in Figure 1.1:

Figure 1.1 – Desktop OS market share

As we can see in the preceding chart, Microsoft OSs dominate the market for desktops and laptops. Microsoft developed multiple versions of the Windows OS including Windows NT, Windows NT 3.1, and most famously, Windows XP, to name a few.

We now know that the Windows OS is one of the most widely used OSs in the world, providing an interface between the user and the computer hardware. The main components of the Windows OS are the kernel, drivers, system utilities, and user-mode components. In this part of the book, we will take a closer look at each of these components and their roles in how the Windows OS functions:

• Kernel: The kernel is the core component of a Windows OS. It is responsible for managing the system’s resources, such as memory, process scheduling, and input/output operations. The kernel also provides an interface between the user-mode components and the hardware. The Windows OS uses a hybrid kernel that combines the features of a microkernel and a monolithic kernel. The microkernel approach provides a small, secure, and stable kernel that is responsible for managing the basic system resources. The monolithic kernel approach provides a single, large, and complex kernel that is responsible for managing both basic system resources and more advanced features, such as device drivers.
• Drivers: Drivers are software components that allow an OS to interact with a computer’s hardware. They act as intermediaries between the OS and the hardware, translating the requests from the OS into instructions that the hardware can understand. A Windows OS includes a wide range of drivers, including device drivers, filesystem drivers, and network drivers.
• System utilities: System utilities are software components that provide basic functionality to an OS. They are responsible for tasks such as disk defragmentation, disk cleanup, and system backup and restore. Some of the most commonly used system utilities in a Windows OS include Task Manager, Control Panel, and File Explorer.
• User-mode components: User-mode components are software components that provide a user interface to an OS. They allow users to interact with the OS and perform tasks such as creating, editing, and deleting files, launching applications, and accessing system settings. Some of the most commonly used user-mode components in the Windows OS include the Start menu, the desktop, and the taskbar.
• Security component: A Windows OS plays a critical role in protecting a user’s data and the system itself from various threats such as viruses, malware, and hacking attacks. There are several security components and functionalities in the Windows OS that work together to provide a secure environment for users, such as the following:
  • User Account Control (UAC): UAC is a feature in Windows OSs that helps prevent users from making unauthorized changes to the system by requiring them to enter their credentials beforehand. This helps prevent malicious software from making unauthorized changes to the system, such as installing malware or modifying system settings.
  • Windows Defender: Windows Defender is a built-in antivirus software that provides real-time protection against malware and other threats. It uses a combination of signature-based detection and heuristics-based detection to identify and remove malware, and it also provides regular updates to keep its threat definitions up-to-date.
  • Windows Firewall: The Windows Firewall is a network security system that helps protect a system from unauthorized access by controlling incoming and outgoing network traffic. It provides a range of configuration options, including the ability to block incoming traffic, allow outgoing traffic, and create rules to allow or block specific traffic.
  • BitLocker: BitLocker is a full-disk encryption feature that helps protect user data by encrypting an entire hard drive. It provides a secure environment for sensitive data and helps prevent unauthorized access to data if a system is lost or stolen. This is one of the challenges we face as forensic investigators; if an acquired image is encrypted, then a decryption key is needed to perform memory forensics.
  • Security Accounts Manager (SAM): SAM is a component of a Windows OS that manages user accounts and security policies. It is responsible for maintaining a database of user accounts and their associated security policies, such as password policies, account lockout policies, and access control lists.
  • Internet Explorer Security: Internet Explorer is the default web browser in a Windows OS, and it includes several security features to help protect users while browsing the web. These features include security zones, which allow users to specify the level of security for different websites, and ActiveX controls, which help prevent malicious software from being installed on the system.
  • SmartScreen Filter: SmartScreen Filter is a feature in a Windows OS that helps protect users from downloading and running malicious software by analyzing the contents of downloaded files and warning the user if the software is known to be malicious.
  • Windows Management Instrumentation (WMI): WMI is a set of tools and technologies that allow you to manage Windows-based computers. WMI can be used to automate administrative tasks, collect data about computers, and monitor computer health.

In addition to these main components, a Windows OS also includes a number of additional features and components such as the registry, the filesystem, and the security model. The registry is a database that stores information about the system configuration and the installed applications. The filesystem is responsible for organizing and managing files and directories on a computer’s hard drive. The security model is responsible for enforcing the system’s security policies and controlling access to the system’s resources.

One of the key strengths of a Windows OS is its compatibility with a wide range of hardware and software. This is achieved through the use of device drivers, which allow the OS to interact with a wide range of hardware devices such as printers, scanners, and digital cameras. The Windows OS also includes support for a wide range of filesystems, including New Technology File System (NTFS), File Allocation Table (FAT), Extensible File Allocation Table (exFAT), and Resilient File System (ReFS), making it easy for users to access their files and data on different types of storage media.

Another important feature of a Windows OS is its user-friendly interface. The OS includes a range of GUI elements such as icons, windows, and menus that make it easy for users to navigate and interact with the system. The Start menu provides a central location to access system utilities and installed applications, while the desktop provides a convenient workspace for performing tasks and accessing files and folders.

Understanding the Windows OS and its filesystem is crucial for forensic investigators. With the knowledge gained from this chapter, investigators will be able to effectively collect and analyze digital evidence.

In the next main section, we will delve into the history of the Windows OS, exploring its various versions and features and how they have evolved over time. This knowledge will provide a solid foundation for understanding the inner workings of the OS, which is essential for conducting thorough digital investigations.

In this section, we will cover multiple OSs introduced by Microsoft, as previously mentioned.

Windows XP

Windows XP is a widely used and well-known OS developed by Microsoft Corporation. It was first released on August 24, 2001, and was available in both Home and Professional editions. Windows XP was the successor to the popular Windows 98 and Windows 2000 OSs and was the first OS to feature the now-iconic Windows Start button and taskbar.

One of the most significant changes in Windows XP was its user interface. The new user interface was designed to be more user friendly and intuitive, making it easier for users to access and use their applications and files. The new interface included a Start button and taskbar that allowed users to quickly access their applications and files without having to navigate through complex menus. The Start menu was also redesigned to be more efficient and organized, with the ability to be customized by adding and removing items.

A significant additional feature of Windows XP was its improved support for hardware and software. Windows XP was designed to work well with new hardware technologies such as USB devices, digital cameras, and other multimedia devices. It also supported new software technologies such as .NET Framework, which allowed developers to create more powerful and sophisticated applications.

One more major change in Windows XP was its security features. Windows XP was designed to be more secure than previous versions of Windows, with improved support for firewalls, encryption, and other security features. It also included a built-in antivirus software called Windows Defender that helped protect users from malware and other security threats.

Another key feature of Windows XP was its networking capabilities. Windows XP was designed to be a more reliable and efficient network OS, making it easier for users to connect to the internet, networks, and other devices. It also included improved support for wireless networks, allowing users to easily connect to Wi-Fi networks and other wireless devices.

One of the most popular features of Windows XP was its multimedia capabilities. Windows XP was designed to be a more multimedia-friendly OS, with improved support for digital music and video, digital cameras, and other multimedia devices. It also included Windows Media Player, which allowed users to play music and videos, and Windows Movie Maker, which allowed users to create and edit their own videos.

Windows XP was also designed to be a more stable and reliable OS, with improved support for hardware and software. It included a number of performance improvements, such as faster boot times and improved system resource management, which helped make the OS more responsive and efficient.

Despite its many features and improvements, Windows XP was not without its flaws. Some users reported compatibility issues with older hardware and software, and the OS was also criticized for its security vulnerabilities, which were exploited by hackers and malware authors.

Despite these issues, Windows XP remained a popular OS for many years, with millions of users around the world relying on it for their daily computing needs. Microsoft continued to release updates and security patches for Windows XP, helping to address its security vulnerabilities and improve its performance.

We can say that Windows XP was a major milestone in the history of OSs, and its impact on the computing industry is still felt today. Its user friendly interface, improved hardware and software support, and multimedia capabilities helped make it one of the most widely used and well-loved OSs of all time. Although it has since been replaced by newer and more advanced OSs, Windows XP remains an important part of the computing world, and its legacy will continue to influence the future of OSs for years to come.

Windows Vista

Windows Vista, also known as Windows NT 6.0, was an advanced OS developed by Microsoft Corporation and released on January 30, 2007. It aimed to enhance the user experience, support newer hardware and software technologies, improve security and networking capabilities, and provide multimedia-friendly features to users.

One of the major changes in Windows Vista was its visually appealing user interface, which included the new Aero style with transparency and other visual effects. Additionally, Windows Vista improved support for new hardware and software technologies such as high-definition displays, multi-core processors, and the .NET Framework.

Moreover, Windows Vista was designed to be more secure than its predecessors, with enhanced support for firewalls, encryption, and security features such as UAC. UAC was a security feature introduced in Windows Vista. It was designed to help prevent unauthorized changes to the system by requiring user approval for any action that could potentially affect the system’s configuration or security.

It also boasted efficient networking capabilities, making it easier for users to connect to the internet, networks, and wireless devices.

Furthermore, Windows Vista was a more multimedia-friendly OS, with improved support for digital music, videos, cameras, and other multimedia devices. It included Windows Media Player and Windows Movie Maker, which enabled users to play and edit music and videos.

Despite its many features and improvements, Windows Vista was not without its flaws. Some users reported compatibility issues with older hardware and software, and the OS was also criticized for its performance and resource requirements that were often higher than those of its predecessor, Windows XP.

Despite these issues, Windows Vista remained a popular OS for many years, with millions of users around the world relying on it for their daily computing needs. Microsoft continued to release updates and security patches for Windows Vista, helping to address its performance and security issues.

It was an important milestone in the history of OSs, and its impact on the computing industry is still felt today. Its user friendly interface, improved hardware and software support, and multimedia capabilities helped make it one of the most advanced and sophisticated OSs of its time. Although it has since been replaced by newer and more advanced OSs, Windows Vista remains an important part of the computing world, and its legacy will continue to influence the future of OSs for years to come.

Windows 7, 8 and 8.1

Windows 7 was a widely used OS developed by Microsoft Corporation, and it was released to the public on October 22, 2009. Windows 7 was designed to be an improvement on its predecessor, Windows Vista, with a number of new features and improvements designed to make it easier and more efficient to use.

One of the most significant changes in Windows 7 was its improved performance. Windows 7 was designed to be faster and more responsive than Windows Vista, with a more streamlined and efficient design. This improved performance was achieved through a number of changes, including the use of a new filesystem, improved memory management, better support for hardware and software, and an improved user interface. Windows 7 was designed to be more user friendly and intuitive than Windows Vista, with a more refined and polished look and feel. The new interface included a new taskbar that made it easier to switch between applications and access frequently used files and folders. Moreover, Microsoft enhanced security on Windows 7; it was designed to be more secure than Windows Vista, with improved support for firewalls, encryption, and other security features, which helped protect users from malicious software and other security threats by requiring them to confirm any actions that could potentially harm the system.

One of the most popular features of Windows 7 was its improved networking capabilities. Windows 7 was designed to be a more reliable and efficient network OS, making it easier for users to connect to the internet, networks, and other devices. It also included improved support for wireless networks, allowing users to easily connect to Wi-Fi networks and other wireless devices.

Another key feature of Windows 7 was its multimedia capabilities. Windows 7 was designed to be a more multimedia-friendly OS, with improved support for digital music and video, digital cameras, and other multimedia devices. It also included Windows Media Player, which allowed users to play music and videos, and Windows Movie Maker, which allowed users to create and edit their own videos.

Windows 7 also had important implications for forensic investigations. The OS created various forensic artifacts including registry hives, system files, and event logs, which could be used by forensic investigators to uncover valuable information and evidence. By examining these artifacts, forensic investigators could gain insights into a user’s activities, identify any malicious software or security threats, and recover lost or deleted data.

The Windows 8 and 8.1 versions were released on October 26, 2012, with significant changes, including a Metro-designed user interface and optimization of touch-based devices such as tablets, also start screen that display all of the app as titles, and more.

Windows 10

Windows 10 was introduced to users on September 30, 2014. This was one of the best OSs and received positive feedback from end users, and it brought back a desktop-oriented interface. It also introduced multiple system security features such as multi-factor authentication (MFA).

This was a brief and general discussion about Windows OSs. We will not cover all aspects and features of OSs; however, you can check out Microsoft’s documentation for further details.

Important note

In this book, we will focus on Windows 10 artifacts; however, the same analysis steps can be applied to artifacts of previous Windows OS versions.

Figure 1.2 shows the start menu and apps in the GUI of Windows 10.

Figure 1.2 – Windows 10 interface and Start menu

In the upcoming section, we will delve into the world of digital forensics and explore why this field is crucial for investigating and analyzing digital evidence.

In this section, we will delve into the basics of digital forensics by discussing the common terminology, types of investigations, and the overall process involved. This will deepen your understanding of a digital forensics life cycle and offer insights into each stage of the process. We will also take a closer look at how typical casework is carried out.

What is digital forensics?

Digital forensics, also known as computer forensics, is the branch of forensic science that deals with the preservation, collection, examination, and analysis of electronic data to investigate digital-related crimes and incidents. The goal of digital forensics is to uncover and recover evidence from digital devices such as computers, smartphones, and other electronic devices, and use this evidence in criminal and civil investigations.

Digital forensics is a multidisciplinary field that draws on expertise from various areas such as computer science, information technology, and law enforcement. Digital forensics experts use a variety of tools and techniques to perform their investigations including data acquisition, data analysis, and data visualization. They must be familiar with a wide range of OSs, software applications, and file formats, and must be able to navigate the intricacies of digital data storage and retrieval.

Digital forensics is used in a variety of contexts including cybercrime investigations, intellectual property disputes, civil litigation, and other legal proceedings. Digital evidence is often critical to the outcome of these cases, and digital forensics plays a key role in uncovering and preserving this evidence. Digital forensics is also used to determine the cause of security breaches and system failures, and to identify potential vulnerabilities in digital systems. In the modern era of technology, digital forensics is an important part of analyzing suspicious cybercriminal attacks with the objective of identifying them. The mitigation and eradication of threat actors is a critical aspect of the work performed by digital forensics and incident response engineers and consultants.

There are several types of computer forensics, each of which is used for specific purposes and requires different techniques and approaches. Some of the most common types of computer forensics include the following:

• Criminal forensics: Criminal forensics is a type of computer forensics that is used in the investigation of criminal activities such as cybercrime, hacking, identity theft, and other digital-related crimes. Criminal forensics focuses on uncovering and preserving evidence that can be used to prosecute the individuals responsible for these crimes.
• Civil forensics: Civil forensics is a type of computer forensics that is used in civil litigation such as intellectual property disputes, contract disputes, and other civil proceedings. Civil forensics focuses on uncovering and preserving evidence that can be used to support or refute a party’s claims in a legal case.
• Incident response forensics: Incident response forensics is a type of computer forensics that is used to investigate and respond to security breaches and other incidents that impact the security and integrity of digital systems. Incident response forensics focuses on identifying the cause of the incident, assessing the extent of the damage, and developing a plan of action to prevent future incidents.
• Network forensics: Network forensics is a type of computer forensics that focuses on the examination of network traffic and system logs in order to uncover evidence of security breaches, cyberattacks, and other network-related incidents. Network forensics involves the use of specialized tools and techniques to capture and analyze network traffic, and to identify and track the source of the incident.
• Mobile forensics: Mobile forensics is a type of computer forensics that focuses on the preservation, collection, examination, and analysis of data stored on mobile devices such as smartphones and tablets. Mobile forensics is often used in criminal investigations but can also be used in civil and incident response forensics.
• Live forensics: Live forensics is a type of computer forensics that involves the collection and analysis of data from a live computer system while it is still running. Live forensics is often used in incident response forensics, and it is considered a critical component of the incident response process because it can provide valuable insight into the state of a system at the time of an incident.
• Memory forensics: Memory forensics is the branch of digital forensics that focuses on the examination of a computer’s volatile memory, or RAM. The goal of memory forensics is to uncover information that is stored in memory and to use this information to assist in the investigation of digital crimes and incidents. Memory forensics can be used to uncover information about system processes, network connections, and malicious activity, and is considered a critical component of the digital forensics process because it can provide valuable evidence that would otherwise be lost if a system were shut down. Memory forensics requires specialized tools and techniques to capture and analyze data stored in memory, and it is often used in conjunction with other forms of digital forensics to provide a comprehensive understanding of a digital incident.

Regardless of the type of computer forensics, the process typically involves several key phases, including the following:

1. Preservation: The preservation phase involves the collection and preservation of evidence in a manner that ensures its authenticity and integrity. This often involves making a forensic image of the evidence and storing it in a secure location.
2. Collection: The collection phase involves the acquisition of evidence, which may involve the use of specialized tools and techniques to capture data from the source. The collection phase is critical to the success of the investigation, as it is important to collect as much evidence as possible in order to ensure a comprehensive examination.
3. Examination: The examination phase involves the analysis of evidence to uncover relevant information and identify potential sources.

The future of digital forensics is promising. The increasing reliance on digital technology in all aspects of our lives will continue to drive the need for forensics experts who can investigate and resolve digital crimes and incidents.

As technology continues to evolve, digital forensics will also need to adapt to new and emerging technologies. For example, cloud computing, the Internet of Things (IoT), and blockchain will all present new challenges and opportunities for digital forensics experts.

Artificial intelligence and machine learning are also expected to play a major role in the future of digital forensics. These technologies can be used to automate the process of data collection and analysis, making it faster, more efficient, and more effective.

With the increasing number of digital crimes and incidents, the demand for digital forensics experts is expected to continue to grow in the coming years. This provides a bright outlook for those interested in pursuing a career in this field.

A forensic analyst/examiner should have a great detailed understanding of the operating system to be able to identify the proper evidence related to incident or case he is working on, and document his finding based on analyzed evidence.

While we are conducting an examination of forensic artifacts, the main goal is to investigate digital crime, which is an illegal activity committed using a digital device such as a PC or mobile device, and extract the evidence via a proper forensic process to present it. Also, the evidence extracted needs to be preserved with integrity; in some cases, the examiner might need to recover evidence such as deleted files to justify an action or point to a suspected criminal.

As a forensic examiner or analyst, it is important to have a comprehensive understanding of various aspects of digital forensics, including the following:

• Technical knowledge: A strong understanding of computer systems, software, and hardware is essential for a forensic examiner or analyst. This includes knowledge of OSs, filesystems, data storage, and networking concepts.
• Legal knowledge: Forensic examiners need to be familiar with the laws and regulations that govern digital forensics, including privacy laws, data protection laws, and intellectual property laws. They also need to understand how to preserve the chain of custody of digital evidence and how to present evidence in a court of law.
• Investigative techniques: Digital forensics is an investigative process, so it is important for forensic examiners to have a thorough understanding of the methods and techniques used in conducting a digital investigation. This includes knowledge of data collection, analysis, and preservation techniques, as well as the use of specialized tools and software.
• Communication skills: Digital forensics is a complex and technical field, so it is important for forensic examiners to have strong communication skills in order to effectively explain their findings to others. This includes the ability to translate complex technical information into layman’s terms and to present findings clearly and concisely.
• Professional ethics: Digital forensics involves access to sensitive and confidential information, so it is important for forensic examiners to understand and adhere to professional ethics and standards. This includes being impartial and unbiased in their analysis, maintaining confidentiality, and protecting the privacy of individuals.
• Continuing education: Technology is constantly evolving, so it is important for forensic examiners to stay up-to-date with the latest developments and techniques in the field. This requires a commitment to ongoing learning and professional development.

By developing a deep understanding of these key areas, forensic examiners and analysts can become effective and professional in their work, contributing to the advancement of the field of digital forensics and providing valuable support to law enforcement and organizations in the fight against cybercrime.

Cybercriminals

Cybercriminals are individuals or groups who engage in illegal activities using digital technology. They use the internet, computer systems, and other digital technologies to carry out a variety of crimes including hacking, identity theft, fraud, extortion, and intellectual property theft. These individuals often operate in secret, making it difficult to detect and prevent their criminal activities. They can target individuals, organizations, and even entire governments, and can cause significant harm by stealing sensitive information, disrupting critical systems, or causing financial losses.

Digital forensic terminology

When working as a forensic examiner, you will, on a daily basis, encounter people talking about certain terms when it comes to investigation. Understanding the terminology helps us as examiners to communicate properly – for example, when we talk about a forensic image, what do we mean? Do we need a full image or a triage image? What are SSD and HDD?

In this section of the book, we will cover most of these terms. The following table lists some useful keywords for a digital forensic analyst:

Table 1.1 – Terminologies for digital forensics

Important note

We will cover forensic artifacts of Windows separately in upcoming chapters. Each artifact will be explained and analyzed, so be prepared to be amazed by how rich Windows is when it comes to artifacts.

To become a great digital forensics examiner, you need to have a strong foundation in informatics and computer science. Many people, like me, started their careers on helpdesks, as computer technicians, or in IT security, where they gained familiarity with some of the tools needed to recover data. If you have similar experience, this book will help you prepare for your dream career as a digital forensics investigator.

The process of digital forensics

Like any other science branch, digital forensics has its own processes and procedures to follow. The following is a brief explanation of each step:

1. Identification: This is the first step in the digital forensics process and involves identifying the need for a digital forensics investigation. This may be the result of cybercrime, such as hacking or data theft, or it may be part of a larger investigation, such as an internal audit or compliance review.
2. Preparation and preservation: Before conducting any type of digital forensics investigation, it is important to prepare and plan for the process. This includes identifying the goals of the investigation, determining the scope of the investigation, and obtaining the necessary resources and equipment. It is also important to preserve evidence in its original form. This includes making copies of data and storing it in a secure and tamper-proof manner.
3. Collection and evidence seizure: This is the first step in the actual investigation process. The goal of this phase is to preserve the evidence and prevent any potential modification or destruction of data. This can involve seizing physical devices, such as computers and storage media, or collecting data from a remote source, such as a cloud service.
4. Examination and analysis: In this phase, the forensic examiner will examine the collected data in detail in order to identify relevant information and evidence. This may involve the use of various tools and techniques, including file carving, data extraction, and data analysis.
5. Documentation and presentation: In some cases, a forensic examiner may be required to present their findings in a court of law or other legal proceedings. This requires clear and concise communication skills and the ability to explain complex technical information in a way that is easily understandable to non-technical audiences.

When conducting an investigation using the aforementioned process, taking detailed notes of each step and action is critical to ensuring that the evidence is not tampered with. Additionally, if another examiner is collaborating with you during the investigation, having detailed notes can facilitate effective communication and ensure that everyone is on the same page.

The five key steps of this process are illustrated in Figure 1.3:

Figure 1.3 – Digital forensics process steps

Digital evidence

Digital evidence can be any form or type of digitalized file or media from an electronic source, including logs, files, social media posts, and much more.

Conducting a forensic examination requires knowledge of the technical concepts of digital evidence, such as computers. You need to know the main components and how they are structured, as well as the type of digital media to handle the evidence. In this book, we will cover some technical theory before jumping into practical analysis for each evidence type.

Some of the digital evidence types are as follows:

• User activity generated in an endpoint
• Documents and text files
• Audio and video files, including CCTV
• Digitalized images
• Security control logs, such as IDS and PCAP
• Digital file metadata

For example, let’s take metadata, which is data about data. Most digital files hold valuable information that adds forensic value to an investigation, such as who created a file, owner information, and creation time, as we can see in the following screenshot, which illustrates the use of ExifTool, which displays metadata for a file:

Figure 1.4 – ExifTool output for an executable Kroll Artifact Parser and Extractor (KAPE)

With the fast growth in technology and types of digital evidence, when dealing with different types of incidents and cases, we need to focus on the most important type of evidence. When collecting digital evidence, an examiner needs to know that they can lose data once a system is shut down – in the case of a computer, for example. When responding to an incident, the most immediate priority should be collecting volatile data.

Volatile data refers to information that is stored in temporary memory and lost when a system is powered off. This includes data stored in a system’s random-access memory (RAM) and any data that is being processed or temporarily stored in a cache.

Figure 1.5 – RAM sample image

Volatile data can include active system processes, network connections, and open files and applications. In a digital forensics investigation, capturing volatile data can provide valuable information about the state of a system at a specific point in time.

On the other hand, non-volatile data refers to information that is stored on a persistent storage device, such as a hard drive, which remains intact even when a system is powered off. Non-volatile data can include files, documents, images, and system configurations. In a digital forensics investigation, non-volatile data can provide a more comprehensive view of the system’s history and activity.

It is important to note that while volatile data can be lost when a system is powered off, it can still be captured and analyzed through a process known as live analysis. This involves collecting data directly from a live system, without first creating a forensic image of the data. Live analysis is typically used in time-sensitive investigations or when it is not possible to obtain a forensic image of the data.

In digital forensics, it is critical to preserve and analyze both volatile and non-volatile data in order to obtain a complete picture of a system’s activity and state. Volatile data can provide insight into the current state of the system, while non-volatile data can provide a historical view of the system’s activity. By combining these two types of data, forensic examiners can build a more comprehensive and accurate picture of the system’s behavior and any potential digital evidence.

In the upcoming chapters, we will talk about the acquisition of a memory image and how to perform analysis of a memory image.

In the next section, we will explore the concept of Windows Shadow Copy and its significance in digital forensics and incident response.

VSS is a feature of Windows OSs that allows users to take snapshots of the state of their hard drive at a specific point in time. These snapshots, known as shadow copies, can be used to restore previous versions of files and directories in the event of data loss or corruption.

From a digital forensics perspective, volume shadow copies can be a valuable source of evidence. They provide a historical record of the state of the hard drive, including deleted and altered files. This information can be used to reconstruct the chain of events that occurred on the system and to identify any suspicious activity.

Volume shadow copies are stored as part of the VSS, which is a component of Windows that provides the functionality to create and manage shadow copies. VSS maintains a list of all shadow copies on a particular volume, allowing a user to select and restore the desired shadow copy.

One of the key benefits of volume shadow copies is that they are created automatically in the background, without the user’s intervention. This means that even if a user is unaware of the feature, it can still contain valuable evidence. In addition, the shadow copies are stored in a hidden and protected area of the hard drive, making it difficult for attackers to tamper with or destroy them.

When conducting a digital forensics examination, it is important to capture and preserve shadow copies to ensure that evidence remains intact. This can be done by creating a forensic image of a hard drive, which can then be analyzed for the presence of shadow copies. Once the shadow copies have been identified, the forensic examiner can extract and analyze the contents to identify any relevant information.

By using VSS, we can track changes in an New Technology File System (NTFS) filesystem. However, it does not store data every time a user changes a file; instead, it typically stores data once a week or as configured by a user on the machine.

When conducting a digital forensic investigation and searching for any suspicious or malicious activity, such as file deletion, we can utilize the VSS to obtain valuable forensic evidence. By comparing the original content of the hard drive with that stored in VSS, we can determine whether any changes or tampering have occurred.

To check VSS on your local machine, you can run CMD.exe with admin privileges and use the following command to list the shadow copies:

Vssadmin list shadows

The following screenshot shows the output of the preceding command:

Figure 1.6 – Vssadmin command output

Another useful trick is mounting a shadow copy using a Windows command line. On a live machine, we can manually mount and browse VSS data using the following mklink command, which creates a symbolic link to VSS. To do this, we need to invoke cmd.exe to use the mklink utility, as powershell.exe will not work:

mklink /d C:\shadow_copy_test \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\

Create a symbolic link to VSS by using the following command line:

Figure 1.7 – Mounting a volume shadow using mklink

Now, in the C drive, we can see a new symbolic link has been created and linked to the shadow copy, and we can browse it as a normal file:

Figure 1.8 – Mapped shadow copy in the C drive

There are other utilities and tools that help to mount VSS, such as Arsenal Image Mounter and VSCMount; however, we will leave the option to you to explore more tools and test them within the labs.

In the next section, we will discuss and prepare the lab environment for digital forensic investigations.

To prepare for this book’s exercises, we will work now on deploying a forensics lab with tools that we will utilize during our investigation of each artifact. In this section, we will show you how to install a VMware workstation to deploy our Windows OS (Windows 10).

Note that to prepare labs for this book, I will proceed and deploy a lab virtual machine on a VMware product; if you prefer to use VirtualBox, you can apply the same steps when installing Windows OS.

Let’s start with installing Workstation 17 Pro:

1. Visit the following link to download the trial version of Workstation 17 Pro for Windows (this is the latest version available as of December 2022):

   https://www.vmware.com/mena/products/workstation-pro/workstation-pro-evaluation.html

2. Click on DOWNLOAD NOW; it will prompt you to save the executable file, as shown here:

Figure 1.9 – VMware Workstation download page

3. Now, double-click on the executable file and then click Next:

Figure 1.10 – VMware Workstation installation process – part 1

4. Once prompted for an end user license, accept it by checking the free trial option and then click Next. It will prompt you to select the path to install Workstation 17 Pro; click on Next once you have selected it:

Figure 1.11 – VMware Workstation installation process – part 2

5. Select the Desktop and Start Menu Programs Folder options to create a shortcut or add a VMware workstation application to the Start menu:

Figure 1.12 – VMware Workstation installation process – part 3

6. Now, once we click on Next, it will start installing the application. The process might take a couple of minutes, depending on your system specifications:

Figure 1.13 – VMware Workstation installation process – part 4

7. The last step for this process is to either select the I want to try VMware Workstation 17 for 30 days option or use a legitimate key to activate your product, and then click on Continue:

Figure 1.14 – VMware Workstation installation process – part 5

Once Workstation 17 Pro is installed, you can see the Library pane and the Home tab, which shows your virtual machines:

Figure 1.15 – VMware Workstation interface

For the next exercise, let’s start making a Windows ISO file to install on a virtual machine:

1. Visit the following link and click on Download Now; it will download media creation tools for us to use:

   https://www.microsoft.com/en-us/software-download/windows10

2. Double-click on the Windows 10 Setup executable and accept the license (the tools will take some time to download, depending on your network speed):

Figure 1.16 – Preparing Windows 10 ISO – part 1

3. Select the Create installation media (USB flash drive, DVD, or ISO file) for another PC option:

Figure 1.17 – Preparing Windows 10 ISO – part 2

4. Select the architecture that you want (in our case, we will proceed with 64-bit (x64)):

Figure 1.18 – Preparing Windows 10 ISO – part 3

5. Now, we will select the ISO file option and the saving path on your local machine to download and create a Windows 10 image:

Figure 1.19 – Preparing Windows 10 ISO – part 4

The next exercise is to install Windows 10 as a virtual machine on Workstation 17 Pro:

1. Click on Click Virtual Machines > Create VM and select the Typical installation option:

Figure 1.20 – Windows 10 installation process – part 1

2. Click on the Installer disc image file (iso) option, as shown in the following screenshot, and select the path for the Windows 10 ISO file:

Figure 1.21 – Windows 10 installation process – part 2

3. Click Next and name the virtual machine DFIR Labs, assign 60 GB as the virtual HDD, and select a minimum of 4 GB of RAM:

Figure 1.22 – Virtual machine settings

4. The last step is to follow the Windows installation guide and run the virtual machine, for which we are all set up now.

During the exercises in the next chapters, we will start downloading and setting up the tools to use for our investigation and artifact analysis each tool will be presented with link to download.

Now we have completed setting up our virtual machine. Let’s take a snapshot of it just in case we need to revert and avoid re-installing it.

Figure 1.23 – Windows 10 ready for a lab

In conclusion, setting up a forensic lab is a critical step toward conducting effective digital forensics investigations. A properly configured forensic lab can help ensure the integrity of evidence, streamline the investigation process, and increase the chances of successful investigations. By following the guidelines and best practices outlined in this chapter, forensic analysts can establish a reliable and efficient forensic lab that can meet the demands of modern digital investigations.

In this chapter, we covered the fundamental concepts and principles of digital forensics, including the importance of a chain of custody, the authenticity and reliability of evidence, and the need for a thorough and systematic approach to the examination of digital evidence. We also discussed the ethical considerations involved in digital forensics and the importance of following established legal and professional standards.

We learned how to set up a virtual environment that simulates a real-world scenario. This allows us to safely and securely test and practice digital forensic techniques without risking damage to real systems. We also learned how to take snapshots of virtual machines and revert to previous states, which is an essential tool for creating controlled testing environments and preserving evidence.

This chapter also provided an overview of the tools and techniques used in digital forensics, including forensic imaging, data recovery, and analysis tools. The goal of this fundamental chapter on digital forensics was to provide a comprehensive understanding of the field and its various components, as well as to provide a foundation for further study and specialization.

In the upcoming chapter, we will be covering the important topic of memory forensics and acquisition. We will explore the significance of memory analysis in digital forensics and how it can help in identifying and investigating potential security breaches. Additionally, we will discuss the different methods of acquiring memory images and their importance in conducting effective digital investigations. Stay tuned for an in-depth discussion on this critical aspect of digital forensics.

Before ending this chapter, I would encourage you to answer the following questions based on your understanding and research:

1. What is operating system forensics?
2. What type of evidence can we collect?
3. Why did digital forensics become an important science?
4. What are the investigative procedures involved in computer forensics?
5. What is VSS?