Exploring Windows Forensic Artifacts Recipes - Part I

The following recipes will be covered in this chapter:

• One man's trash is a forensic examiner's treasure
• A sticky situation
• Reading the registry
• Gathering user activity
• The missing link
• Searching high and low

Introduction

Windows has long reigned supreme as the operating system of choice in the PC market. In fact, Windows makes up approximately 47 percent of the users visiting government websites, with the second most popular PC operating system, macOS, making up only 8.5 percentage. There is no reason to suspect that this will be changing anytime soon, especially with the warm reception that Windows 10 has received. Therefore, it is exceedingly likely that future investigations will continue to require the analysis of Windows artifacts.

This chapter covers many types of artifacts and how to interpret them with Python, using various first and third-party libraries, directly from forensic evidence containers. We will leverage the framework we developed in Chapter 8, Working with Forensic Evidence Container Recipes to process these artifacts directly from forensic acquisitions. In this...

One man's trash is a forensic examiner's treasure

Recipe difficulty: Medium

Python version: 2.7

Operating system: Linux

While that may not be the exact saying, forensic examination of deleted files residing in the Recycle Bin is an important step in most investigations. The non-technical custodian likely does not understand that these files sent to the Recycle Bin are still present and that we can learn a good deal about the original file, such as its original file path and the time that it was sent to the Recycle Bin. While the specific artifacts vary between versions of Windows, this recipe focuses on the Windows 7 version of the Recycle Bin's $I and $R files.

Getting started

This recipe requires the installation...

A sticky situation

Recipe difficulty: Medium

Python version: 2.7

Operating system: Linux

Computers have replaced pen and paper. We have transferred many processes and habits, one relegated solely to the confines of paper, to these machines, including taking notes and making lists. One feature that replicates a real-world habit is Windows Sticky Notes. These sticky notes allow persistent notes to float on the desktop, with options for color, fonts, and more. This recipe will allow us to explore these sticky notes and add them to our investigative workflow.

Getting started

This recipe requires the installation of four third-party modules to function: olefile, pytsk3, pyewf, and unicodecsv. Refer to Chapter 8, Working with Forensic...

Reading the registry

Recipe Difficulty: Medium

Python Version: 2.7

Operating System: Linux

The Windows registry contains many important details related to the operating system configuration, user activity, software installation and usage, and so much more. These files are often heavily scrutinized and researched due to the number of artifacts they contain and their relevance to Windows systems. Parsing registry files gives us access to the keys and values that can reveal basic operating system information, access to folders and files, application usage, USB devices, and more. In this recipe, we focus on accessing common baseline information from the SYSTEM and SOFTWARE hives.

Getting started

This recipe requires the installation...

Gathering user activity

Recipe Difficulty: Medium

Python Version: 2.7

Operating System: Linux

Windows stores a plethora of information about user activity, and like other registry hives, the NTUSER.DAT file is a great resource to be relied upon during an investigation. This hive lives within each user's profile and stores information and configurations as they relate to the specific user's on the system.

In this recipe, we cover multiple keys within NTUSER.DAT that throw light on the actions of a user on a system. This includes the prior searches run in Windows Explorer, paths typed into Explorer's navigation bar, and the recently used statements in the Windows run command. These artifacts better illustrate how the user interacted with the system and may give insight into what normal, or abnormal, usage of the system looked like for the user.

...

The missing link

Recipe Difficulty: Medium

Python Version: 2.7

Operating System: Linux

Shortcut files, also known as link files, are common across operating system platforms. They enable the user to use one file to reference another, located elsewhere on the system. On the Windows platform, these link files also record historical access to the files they reference. Generally, the creation time of a link file represents the first access time of a file with that name, and the modification time represents the most recent access time of the file with that name. Using this, we can extrapolate a window of activity and learn about how, and where, these files were accessed.

Getting started

This recipe requires the installation of...

Searching high and low

Recipe difficulty: Hard

Python version: 2.7

Operating system: Linux

Most modern operating systems maintain an index of files and other data content stored on the system. These indexes allow for more efficient searches across file formats, emails, and other content found on the system's volumes. On Windows, such an index is found in the Windows.edb file. This database is stored in the Extensible Storage Engine (ESE) file format and found within the ProgramData directory. We will leverage another library from the libyal project to parse this file to extract information about the indexed content on the system.

Getting started

This recipe requires the installation of four third-party modules to function...