Forensic Analysis of Windows Systems (From Handbook of Computer Crime Investigation: Forensic Tools and Technology, P 133-165, 2002, Eoghan Casey, ed, -- See NCJ-195111)

• NCJ Number: 195117
• Author(s): Bob Sheldon
• Date Published: 2002
• Length: 33 pages
• Sale Source: Academic Press, Inc
• Publication Format: Book (Softbound)
• Publication Type: Report (Technical)
• Language: English
• Country: United States of America

Annotation

This chapter provides an overview of forensic analysis techniques useful in the investigation of Windows systems.

Abstract

According to the author of this chapter, there are three main components to the forensic analysis of any Windows system. First, it is imperative for the investigator to have a strong working knowledge of the FAT and NT file systems. Second, the investigator must be knowledgeable concerning Windows "artefacts," including how to locate them and interpret their properties. Third, the investigator should be knowledgeable about the available computer forensic software. The author of this chapter begins with the assumption that the reader has a working knowledge of the FAT file system. The discussion is focused on the Windows NT file system, but technical examples of the FAT system are offered. Further, this chapter examines the investigative and probative usefulness of Windows artefacts, including Recycle Bin INFO Files, enhanced metafiles, and link files. Finally, this chapter gives an overview of Windows analysis techniques using EnCase and also in a tool-independent environment. Figures, references