Registry Artifacts. Villanova University Department of Computing Sciences D. Justin Price Spring 2014
|
|
|
- Barnard Phillips
- 6 years ago
- Views:
Transcription
1 Registry Artifacts Villanova University Department of Computing Sciences D. Justin Price Spring 2014
2 REGISTRY The registry is a central hierarchal database intended to store information that is necessary to configure the system for one or more users, applications, and hardware devices.[1] Goldmine for digital forensics. Registry Breakdown Hives (binary database files) Keys & Subkeys (analogous to a folders) Values (analogous to a file) Type (strings, binary or DWORD) Data [1]
3 REGISTRY HIVES SAM Local user accounts & groups Security Security information used by the operating system to include password policies, group memberships, etc. System Hardware and service configurations Software Application settings NTUSER.dat User settings, configuration and environment settings UsrClass.dat More widely used in Vista/7/8 Shellbag Information
4 REGISTRY HIVES System Registry Hives XP/Vista/7/8! XP/Vista/7/8! XP/Vista/7/8!! XP/Vista/7/8! User Specific Registry Hives! XP! Vista/7/8! Vista/7/8! Backup System Registry Hives C:\Windows\System32\config\SAM C:\Windows\System32\config\SECURITY C:\Windows\System32\config\SYSTEM C:\Windows\System32\config\SOFTWARE C:\Documents and Settings\<USERNAME>\NTUSER.dat C:\Users\<USERNAME>\NTUSER.dat C:\Users\<USERNAME>\AppData\Local\Microsoft\Windows\UsrClass.dat Vista/7/8 C:\Windows\System32\config\RegBack
5 REGISTRY VALUE TYPES REG_NONE REG_SZ REG_BINARY REG_DWORD REG_LINK REG_QWORD No Value Unicode or ASCII String Binary Data 32-bit Number Unicode Symbolic Link 64-bit Number
6 VIEWING REGISTRY HIVES Live System Analysis - regedit.exe
7 VIEWING REGISTRY HIVES Offline Analysis - AccessData Registry Viewer
8 VIEWING REGISTRY HIVES Offline Analysis - MiTeC Windows Registry Recovery (WRR)
9 EXTRACTING REGISTRY HIVES
10 EXTRACTING REGISTRY HIVES
11 LAST WRITE TIME Last Write Time is recorded for each key in every hive. Time is stored in UTC. Time stamp reflects when a value has been added or updated.
12 SECURITY ACCOUNTS MANAGER (SAM) Security Identifier (SID) Recycle Bin entries, file ownership and other artifacts refer to a SID and not a username. Microsoft Documented SID Accounts Administrator = 500 Guest = 501 User Account = start at 1000 Password fields can be misleading Password Required = password policies applied to user accounts do not apply to this account We will work with a much better tool to determine if a password was set for this account in the Encryption/ Password lecture!
13 SAM Hive
14 SAM Hive
15 SAM Hive
16 PROFILE LIST Details all profiles that have used the system to include local and domain users. SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
17 PROFILE LIST Details all profiles that have used the system to include local and domain users. SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
18 SYSTEM HIVE Current Control Set SYSTEM\Select\Current Answers the following questions: Which configuration files should be loaded? If an error is detected, which configuration files should be tried next? Which configuration files reported errors?
19 SYSTEM HIVE Computer Name: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName!! Time Zone: SYSTEM\CurrentControlSet\Control\TimeZoneInformation!!!! Last Access Timestamp: SYSTEM\CurrentControlSet\Control\FileSystem
20 SYSTEM HIVE Network Interfaces: SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces
21 SYSTEM HIVE User Shares Enable: SYSTEM\CurrentControlSet\Services\lanmanserver\Shares!!! System Shutdown Timestamps and Counters (XP): SYSTEM\CurrentControlSet\Control\Windows SYSTEM\CurrentControlSet\Control\Watchdog\Display
22 SOFTWARE HIVE Operating System Version: SOFTWARE\Microsoft\Windows NT\CurrentVersion
23 SOFTWARE HIVE Historical Networks (Vista/7/8): Managed by a Domain SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures \Managed DnsSuffix = Domain FirstNetwork = SSID DefaultGatewayMac = Media Access Control (MAC) Address of Gateway Last Written Time = Last time the computer connected to this network.
24 SOFTWARE HIVE Historical Networks (Vista/7/8): Not Managed by a Domain SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList \Signatures\Unmanaged
25 SOFTWARE HIVE Network Type: SOFTWARE\Microsoft\WZCSVC\Parameters\Interfaces\{GUID} (XP) SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList \Profiles (Vista/7/8)» NameType 0x47 = Wireless» NameType 0x06 = Wired» NameType 0x17 = Broadband» Date fields are recorded as 128-bit System date. use Dcode to convert.
26 AUTO-START PROGRAMS Various Registry Locations: NTUSER.dat\Software\Microsoft\Windows\CurrentVersion\Run NTUSER.dat\Software\Microsoft\Windows\CurrentVersion\RunOnce SOFTWARE\Microsoft\Windows\CurrentVersion\Run SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run SYSTEM\CurrentControlSet\Services (0x02 = start)
27 NTUSER.DAT HIVE Windows XP Search History NTUSER.DAT\Software\Microsoft\Search Assistant\ACMru Windows 7 Search History NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer \WordWheelQuery!!!!!!! Windows 8 Search History NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer \SearchHistory
28 NTUSER.DAT HIVE Internet Explorer Typed URLs NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer \TypedPaths
29 NTUSER.DAT HIVE Recently Accessed Files NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer \RecentDocs MRUList shows the order in which the files were accessed. The most recent file opened will be first.
30 NTUSER.DAT HIVE Microsoft Office Recent Documents NTUSER.DAT\Software\Microsoft\Office\14.0\Word\FileMRU NTUSER.DAT\Software\Microsoft\Office\14.0\Excel\FileMRU NTUSER.DAT\Software\Microsoft\Office\14.0\Powerpoint\FileMRU Office XP - Version 10.0 Office Version 11.0 Office Version 12.0 Office Version 14.0
31 NTUSER.DAT HIVE Common Dialogs API (ComDlg32) Open and Save As APIs NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer \ComDlg32\OpenSaveMRU (XP) NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer \ComDlg32\OpenSavePidMRU (Vista/7/8)
32 NTUSER.DAT HIVE Common Dialogs API (ComDlg32) Last Visited - records specific executable used to open the files along with the directory that was last accessed. NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer \ComDlg32\LastVisitedMRU (XP) NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer \ComDlg32\LastVisitedPidMRU (Vista/7/8)
33 NTUSER.DAT HIVE Commands Executed from the Run Box NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer \RunMRU MRU List provides the order in which the commands were executed.
34 NTUSER.DAT HIVE UserAssit Records what application(s) a user has run, when and how many times: NTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer \UserAssist\{GUID}\Count Valuable resource to determine user activity and technical knowledge. Values are encoded using a simple substation cipher (ROT13). Run count starts a 6(?). some viewers will automatically adjust this value so it is important to know what your tool is doing {CEBFF5CD-ACE2-4F4F F41749EA} = Executable File {F4E57C4B F0-A9AB-443BCFE33D9F} = Shortcut File Execution
35 NTUSER.DAT HIVE UserAssit Win XP/Vista All values begin with UEME_RUNPATH Launched from the Absolute Path UEME_RUNCPL Launched from the Control Panel Applet UEME_RUNPIDL Launched from a Shortcut UEME_UIQCUT Launched from the Quick Launch Menu UEME_UISCUT Launched from a Desktop Shortcut UEME_UITTOOLBAR Launched from the Windows Explorer Toolbar
36 UserAssit Win 7/8 NTUSER.DAT HIVE
37 NTUSER.DAT HIVE MUICache Multi-language User Interface One more location to see if a program was executed even if the program was uninstalled. Timestamps are not recorded as each program is a value. Win XP NTUSER.DAT\Software\Microsoft\Windows \ShellNoRoam\MUICache Win 7/8 USRCLASS.DAT\Local Settings\Software\Microsoft \Windows\Shell\MuiCache Consider processing Volume Shadow Copies (VSC)
38 RegRipper
39 RegRipper
40 List All Plugins rip -l RegRipper Plugins
41 RegRipper Plugins
42 USB FORENSICS USB devices are commonly used to transferring data. Determine how the user is using the system Identify other devices that may be important to the investigation Determine the first time a USB drive was connected to the system. Determine the last time a USB drive was connected to the system. Artifact Locations: XP/Vista/7/8 XP/Vista/7/8 XP Vista/7/8 XP Vista/7/8 C:\Windows\System32\config\SYSTEM C:\Windows\System32\config\SOFTWARE C:\Documents and Settings\<USERNAME>\NTUSER.dat C:\Users\<USERNAME>\NTUSER.dat C:\Windows\setupapi.log C:\Windows\inf\setupapi.dev.log
43 USB FORENSICS Device s serial number SYSTEM\CurrentControlSet\Enum\USBSTOR Vendors should manufacture USB devices with unique serial numbers. Not all devices comply with the standard Devices that do not have a unique serial number will have an & as the 2nd character. Last Written Date is the first time the device was connected to the system since the last reboot.
44 USB FORENSICS Device s Volume Name (Windows 7/8) SOFTWARE\Microsoft\Windows Portable Devices\Device
45 USB FORENSICS Device s Mapped Drive Letter (Windows XP/7/8) SYSTEM\MountedDevices Windows XP uses the device s ParentIdPrefix
46 USB FORENSICS Determine which user used the USB device (Windows 7/8) SYSTEM\USBSTOR\<DEVICE>\<Serial#>\Device Parameters\Partmgr
47 USB FORENSICS Determine which user used the USB device 2 (Windows 7/8) SYSTEM\MountedDevices
48 USB FORENSICS Determine which user used the USB device (Windows 7/8) NTUSER.DAT\Software\Microsoft\Windows \CurrentVersion\Explorer\Mountpoints2
49 USB FORENSICS When was the USB device first used? (Windows 7/8) C:\Windows\inf\setupapi.dev.log
50 USB FORENSICS When was the USB device last used? (Windows 7/8) NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion \Explorer\MountPoints\{GUID} Key s Last Write Timestamp
51 USB FORENSICS - AUTOMATED USBDeviceForensics
52 USB FORENSICS - AUTOMATED
53 Store user specific preferences for Windows Explorer. Shows browsing habits and knowledge of content by a user. Uncover evidence of a deleted folder structure. Registry Location:!!!! XP/Vista/7/8 XP/Vista/7/8 XP/Vista/7/8 XP/Vista/7/8 SHELL BAGS USRCLASS.DAT\Local Settings\Software\Microsoft\Windows\Shell\Bags USRCLASS.DAT\Local Settings\Software\Microsoft\Windows\Shell\BagsMRU NTUSER.DAT\Software\Microsoft\Windows\Shell\BagMRU NTUSER.DAT\Software\Microsoft\Windows\Shell\Bag! The following changes will cause a ShellBag key to be updates: Window Size View Options Viewing File in Thumbnail Format Sorting Options
54 SHELL BAGS
55 SHELL BAGS
56 SHELL BAGS
57 SHELL BAGS
58 SHELL BAGS
59 SHELL BAGS
60 SHELL BAGS
61 SHELL BAGS
62 SHELL BAGS
63 EXTRACTING SHELLBAGS sbag.exe Download - Info - proto_id=14
64 EXTRACTING SHELLBAGS
65 EXTRACTING SHELLBAGS
Windows Artifacts as a part of Digital Investigation
Windows Artifacts as a part of Digital Investigation Divyang Rahevar, Nisarg Trivedi Institute of Forensic Science Gujarat Forensic Sciences University Gandhinagar, Gujarat India divurahevar@gmail.com,
Legal Notices. AccessData Corp.
Legal Notices AccessData Corp. makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability
Windows 10 Registry AGENDA. What is the Registry? About Dan Purcell. Copyright Dan Purcell 2014
Windows 10 Registry Copyright Dan Purcell 2014 What is the Registry? AGENDA About Dan Purcell 1 What is the Registry? AGENDA Basic Registry Terminology & Structure Physical v. Logical Date & Time Formats
Windows Registry Forensics
Windows Registry Forensics Registry Definition The Microsoft Computer Dictionary defines the registry as: A central hierarchical database used in the Microsoft Windows family of Operating Systems to store
Windows Registry. Windows Registry. A Wealth of Evidence. What is the Registry? Some Evidence that Can Be Recovered. Registry History: Windows 3.
Windows Registry Windows Registry Week 3 Part 1 A great source of evidence and headaches What is the Registry? A Wealth of Evidence Collection of files that, together, form all the settings needed by applications
Microsoft Office 2007, 2010 Registry Artifacts Dustin Hurlbut September 16, 2010
Microsoft Office 2007, 2010 Registry Artifacts Dustin Hurlbut September 16, 2010 INTRODUCTION Previous versions of Microsoft Office used application specific registry artifacts to track opened documents.
Program Execution Analysis using UserAssist Key in Modern Windows
Bhupendra Singh and Upasna Singh Department of Computer Science and Engineering, Defence Institute of Advanced Technology (DU), 411025, Pune, Maharashtra, India Keywords: Abstract: UserAssist, Windows
Terremark WorldWide. Harlan Carvey Vice President, Secure Information Services. Registry and Timeline Analysis. SANS Forensic Summit 2010
Terremark WorldWide Harlan Carvey Vice President, Secure Information Services Registry and Timeline Analysis SANS Forensic Summit 2010 Today s Workshop Registry/Timeline Analysis What is Registry Analysis?
ACCESSDATA SUPPLEMENTAL APPENDIX
ACCESSDATA SUPPLEMENTAL APPENDIX Steps for Decrypting IntelliForms Data in Windows Vista This appendix reviews the process required to decrypt the protected information located in the IntelliForms subkey.
TZWorks ShellBag Parser (sbag) Users Guide
TZWorks ShellBag Parser (sbag) Users Guide Abstract sbag is a standalone, command-line tool used to extract Shellbag artifacts from Windows user account registry hives. It can operate on a live target
Windows Core Forensics Forensic Toolkit / Password Recovery Toolkit /
The Windows Forensics Core Training follows up the AccessData BootCamp training. This advanced AccessData training class provides the knowledge and skills necessary to use AccessData products to conduct
The introduction of Windows 8 was a big change for Microsoft s traditional operating
A Comparison Between the Windows 8 & Windows 7 Registries Matthew Brewer B.S., Dr. Terry Fenger, Corporal Robert J. Boggs, Christopher Vance B.S. Marshall University Forensic Science Center, Huntington,
Windows Registry Analysis
Windows Registry Analysis Omveer Singh Additional Director / Scientist E omveer@cert-in.org.in Cyber Forensics Lab Indian Computer Emergency Response Team (CERT-In) Department of Information Technology
Analysis Villanova University Department of Computing Sciences D. Justin Price Spring 2014
Email Analysis Villanova University Department of Computing Sciences D. Justin Price Spring 2014 EMAIL ANALYSIS With the increase in e-mail scams and fraud attempts with phishing or spoofing Investigators
Analysis Villanova University Department of Computing Sciences D. Justin Price Fall 2014
Email Analysis Villanova University Department of Computing Sciences D. Justin Price Fall 2014 EMAIL ANALYSIS With the increase in e-mail scams and fraud attempts with phishing or spoofing Investigators
RegForensicTool: Evidence Collection and Analysis of Windows Registry
RegForensicTool: Evidence Collection and Analysis of Windows Registry Dinesh N. Patil 1, Bandu B. Meshram 2 Veermata Jijabai Technological Institute Matunga, Mumbai, India dinesh9371@gmail.com 1, bbmeshram@vjti.org.in
AccessData Advanced Forensics
This advanced five-day course provides the knowledge and skills necessary to install, configure and effectively use Forensic Toolkit (FTK ), FTK Imager Password Recovery Toolkit (PRTK ) and Registry Viewer.
WEEK 2.0. Any sufficiently advanced technology is indistinguishable from magic.
WEEK 2.0 Any sufficiently advanced technology is indistinguishable from magic. Recycler A recycle bin for each user Created upon file deletion Only for RB aware programs ie Office, not command line tools
Description of the Microsoft Windows Registry
Page 1 of 5 Microsoft Knowledge Base Article - 256986 Description of the Microsoft Windows Registry The information in this article applies to: Microsoft Windows Server 2003, 64-Bit Datacenter Edition
Lesson 2: Editing the Registry
Lesson 2: Editing the Registry Lesson 2 Editing the Registry 4-15 Windows XP Professional stores hardware and software settings centrally in a hierarchical database called the Registry, which replaces
COMPUTER FORENSICS & WINDOWS REGISTRY. Aradhana Pandey Saumya Tripathi
COMPUTER FORENSICS & WINDOWS REGISTRY Aradhana Pandey Saumya Tripathi STEP 1 In initial forensics analysis, it is important to get more information about the owner and the system. So, we should confirm
Remote Device Mounting Service
HOW TO USE REMOTE DEVICE MOUNTING SERVICES The Remote Data Mounting Services (RDMS) lets you acquire live evidence from active and remote network computers. You can gather many types of active information
AccessData AD Lab Release Notes
AccessData AD Lab 6.2.1 Release Notes Document Date: 4/24/2017 2017 AccessData Group, Inc. All rights reserved Introduction This document lists the new features, fixed issues, and known issues for this
Ndaw, Maam Awa. Microsoft Office Excel 2007
Download the Project3.E01 file from Blackboard under Projects & Labs\Project 3 and verify the integrity of the image after downloading (open image in FTK Imager right-click on image - verify Drive/Image).
AccessData Forensic Toolkit Release Notes
AccessData Forensic Toolkit 6.2.1 Release Notes Document Date: 4/24/2017 2017 AccessData Group, Inc. All rights reserved Introduction This document lists the new features, fixed issues, and known issues
Adventures in Disk Image Processing with Open Source Tools. Elizabeth Schweinsberg
Adventures in Disk Image Processing with Open Source Tools Elizabeth Schweinsberg bethlogic@gmail.com Goals Reduce Time-to-Analysis Remove some of the Hurry Up and Wait After the drive is uploaded, metadata
PAS. Installation Guide. BG0608 Rev. A1. Copyright SATEC Ltd.
PAS Installation Guide BG0608 Rev. A1 Copyright 2011-2017 SATEC Ltd. Table of Contents Chapter 1 Installation... 3 1. Scope... 3 2. Minimal installation requirements... 3 3. Pre-installation steps... 3
AccessData Forensic Toolkit 6.2 Release Notes
AccessData Forensic Toolkit 6.2 Release Notes Document Date: 4/3/2017 2017 AccessData Group, Inc. All rights reserved Introduction This document lists the new features, fixed issues, and known issues for
Unit III: Working with Windows and Applications. Chapters 5, 7, & 8
Unit III: Working with Windows and Applications Chapters 5, 7, & 8 Learning Objectives In this unit, you will: Launch programs and navigate the Windows task bar. Perform common windows functions. Customize
AccessData Registry Quick Find Chart
AccessData Registry Quick Find Chart This document reviews common locations in the Windows and Windows Internet-related registries where you can find data of forensic interest. Important: At the time of
Security Management System SNMP Trap Interface
Security Management System software generates various alarms on events. SMS SNMP trap Interface application connects to one or more SMS Servers and receives all the alarms generated by the SMS application.
Talking to the Tech Asking the Right Questions
Talking to the Tech Asking the Right Questions Eric R. Zimmerman Senior director, Kroll Cyber Security eric.zimmerman@kroll.com 501-313-3778 @EricRZimmerman https://binaryforay.blogspot.com/ Why are we
A+ Guide to Managing & Maintaining Your PC, 8th Edition. Chapter 11 Optimizing Windows
Chapter 11 Optimizing Windows Objectives Learn about Windows utilities and tools you can use to solve problems with Windows Learn how to optimize Windows to improve performance Learn how to manually remove
Streaming Profile Recipe
Streaming Profile Recipe Package_Manufacturer_Version Streaming Profile Recipe for Package_Manufacturer_Version Submitted by: Date Submitted: 3/3/2011 11:25:00 AM
About the Presentations
About the Presentations The presentations cover the objectives found in the opening of each chapter. All chapter objectives are listed in the beginning of each presentation. You may customize the presentations
TOSHIBA GA Printing from Windows
TOSHIBA GA-1211 Printing from Windows 2008 Electronics for Imaging, Inc. The information in this publication is covered under Legal Notices for this product. 45075925 24 October 2008 CONTENTS 3 CONTENTS
Registry Analysis and Memory Forensics: Together at Last. Brendan Dolan-Gavitt Georgia Institute of Technology
Registry Analysis and Memory Forensics: Together at Last Brendan Dolan-Gavitt Georgia Institute of Technology Who I Am Developer on Volatility project Grad student and researcher at Georgia Tech Author
Full System Restore Manually Running Command Prompt Windows Xp
Full System Restore Manually Running Command Prompt Windows Xp If you can't boot into Windows XP to run chkdsk, download Easy Recovery To run CHKDSK from within Windows XP, but without Command Prompt,
Chapter 5 EVALUATION OF REGISTRY DATA REMOVAL BY SHREDDER PROGRAMS. 1. Introduction. Harry Velupillai and Pontjho Mokhonoana
Chapter 5 EVALUATION OF REGISTRY DATA REMOVAL BY SHREDDER PROGRAMS Harry Velupillai and Pontjho Mokhonoana Abstract Shredder programs attempt to overcome Window s inherent inability to erase data completely.
Recent Operating System Class notes 04 Managing Users on Windows XP March 22, 2004
Recent Operating System Class notes 04 Managing Users on Windows XP March 22, 2004 You log into a system to notify the system who you are. When you log off, any files you have opened are cleaned up, and
Detecting Computer Intrusions: Are You Pwned? Steve Anson HITB 8 Oct 2009
Detecting Computer Intrusions: Are You Pwned? Steve Anson HITB 8 Oct 2009 Steve Anson Former computer agent for the U.S. Department of Defense and Federal Bureau of Investigation (FBI) Cybercrime Task
Mini-102MG ( MFP Server) Quick Installation Guide. User's Manual Version : Mini-102MG_QIG_EU-A_V1
Mini-102MG ( MFP Server) Quick Installation Guide User's Manual Version : Mini-102MG_QIG_EU-A_V1 1. Product Introduction Thank you for purchasing and using our 802.11b/802.11g Wireless LAN MFP server.
VI-CENTER EXTENDED ENTERPRISE EDITION GETTING STARTED GUIDE. Version: 4.5
VI-CENTER EXTENDED ENTERPRISE EDITION GETTING STARTED GUIDE This manual provides a quick introduction to Virtual Iron software, and explains how to use Virtual Iron VI-Center to configure and manage virtual
Comodo Online Storage Software Version 2.0
Comodo Online Storage Software Version 2.0 Guide Version 2.0.101211 Comodo Security Solutions 525 Washington Blvd. Jersey City, NJ 07310 Table of Contents 1. Introduction... 4 1.1.System Requirements...
Network License Installation Instructions Revised: 04/04/2018
Network License Installation Instructions Revised: 04/04/2018 1 Table of Contents Installation & Activation... 3 Troubleshooting... 5 Nalpeiron Windows Service... 5 Abandoned Client Licenses... 5 LAN Diagnostic
AccessData Forensic Toolkit Release Notes
AccessData Forensic Toolkit 5.6.4 Release Notes Document Date: 9/8/2015 2015 AccessData Group, Inc. All rights reserved Introduction This document lists the new features, fixed issues, and known issues
AccessData. Forensic Toolkit. Upgrading, Migrating, and Moving Cases. Version: 5.x
AccessData Forensic Toolkit Upgrading, Migrating, and Moving Cases Version: 5.x 1 AccessData Legal and Contact Information Document date: March 27, 2014 Legal Information 2014 AccessData Group, Inc. All
Steps to View Online Lectures
Steps to View Online Lectures Panopto recordings can be viewed on a multitude of operating systems such as Windows XP, Windows Vista, and Mac OS X (Intel Only) Panopto is also compatible with most major
USMTGUI - User guide for backup and restore of local and Domain user profiles
USMTGUI - User guide for backup and restore of local and Domain user profiles Easy transfer of User Profiles from one PC to another. Save data to USB hard disk or network and restore to the new PC In this
Password Changer User Guide
Active@ Password Changer User Guide Copyright 1999-2017, LSOFT TECHNOLOGIES INC. All rights reserved. No part of this documentation may be reproduced in any form or by any means or used to make any derivative
User Manual PDUTracker
User Manual PDUTracker Management Software for PDU Table of Contents 1. Overview... 1 1.1. Introduction... 1 1.2. Features... 1 2. Install and Uninstall... 1 2.1. System Requirement... 1 2.2. Software
User Profile Manager 2.0
User Profile Manager 2.0 User Guide ForensiT Limited, 75 Riverside III, Sir Thomas Longley Road, Rochester, Kent, ME2 4BH England. Tel: US 1-877-224-1721 (Toll Free) Intl. +44 (0) 845 838 7122 Fax: +44
AccessData. Forensic Toolkit. Upgrading, Migrating, and Moving Cases. Version: 5.x
AccessData Forensic Toolkit Upgrading, Migrating, and Moving Cases Version: 5.x 1 AccessData Legal and Contact Information Document date: February 11, 2015 Legal Information 2015 AccessData Group, Inc.
Wireless Presentation Adaptor User s Manual
Wireless Presentation Adaptor User s Manual (Model Name: WPS-Speedy) Version: 1.5 Date: Sep. 24, 2010 1 Table of Contents 1. Overview... 4 2. Quick Start... 6 3. Windows Client Utility... 10 3.1 Starting
Computer Forensics CCIC Training
Computer Forensics CCIC Training Chapter 5: Starting Phase 2 Lauren Pixley and Cassidy Elwell May 2017 (Version 1) This work by California Cyber Training Complex is licensed under a Creative Commons Attribution-NonCommercial
A+ Guide to Managing and Maintaining Your PC, 7e. Chapter 14 Optimizing Windows
A+ Guide to Managing and Maintaining Your PC, 7e Chapter 14 Optimizing Windows Objectives Learn about Windows utilities and tools you can use to solve problems with Windows Learn how to optimize Windows
LiveNX Upgrade Guide from v5.1.2 to v Windows
LIVEACTION, INC. LiveNX Upgrade Guide from v5.1.2 to v5.1.3 - Windows UPGRADE LiveAction, Inc. 3500 Copyright WEST BAYSHORE 2016 LiveAction, ROAD Inc. All rights reserved. LiveAction, LiveNX, LiveUX, the
Force Delete Software Win Xp Folder Access Denied
Force Delete Software Win Xp Folder Access Denied Wise Force Deleter, a solution for 'cannot delete file: Access is denied' on Windows 8&8.1 and other Windows operating systems, from Windows XP and up.
A+ Guide to Managing and Maintaining Your PC. Managing and Supporting Windows XP
A+ Guide to Managing and Maintaining Your PC Fifth Edition Chapter 16 Managing and Supporting Windows XP Security Using Windows NT/ 2000/XP Goals Secure system resources including hardware and software
CSE 4482 Computer Security Management: Assessment and Forensics. Computer Forensics: Working with Windows and DOS Systems
CSE 4482 Computer Security Management: Assessment and Forensics Computer Forensics: Working with Windows and DOS Systems Instructor: N. Vlajic,, Fall 2010 Required reading: Guide to Computer Forensics
Help Contents - December 4, 2012
1 of 70 12/4/2012 12:18 PM Help Contents - December 4, 2012 1-10ZiG Manager 1.1 - Configuring and Managing the Server 1.1.1 - Server Settings 1.1.2 - Network Settings 1.1.3 - Ports Used 1.1.4 - Discovery
Usb Port On Manually Disable Windows 7 Registry Pdf
Usb Port On Manually Disable Windows 7 Registry Pdf If you can find the switch, you can easily unlock and remove the write Step Click on the new registry key StorageDevicePolicies and on the right pan
Guide to Computer Forensics and Investigations Fourth Edition. Chapter 6 Working with Windows and DOS Systems
Guide to Computer Forensics and Investigations Fourth Edition Chapter 6 Working with Windows and DOS Systems Understanding Disk Drives Disk drives are made up of one or more platters coated with magnetic
MPX Server Software User Manual
MPX Server Software User Manual Contents 1 Server Software Installation... - 3 - Initial Setup... - 6-2 Software Interface... - 10 - Login Page:... - 10-2.1 Homepage... - 12-2.2 Resources... - 13-2.3 Composer...
Wireless Presentation System
Wireless Presentation System WGA-310 User s Manual (Model Name: WPS-Interactive) Transmissor WPS AVLIFE (SBWPS2) Versão 2015.04 Version: 2.0 Date: Jan. 15, 2013 Table of Contents Table of Contents 1. Overview...
Comodo Network Center Software Version 1.1
Comodo Network Center Software Version 1.1 User Guide Guide Version 2.3.112311 Comodo Security Solutions 1255 Broad Street STE 100 Clifton, NJ 07013 Table of Contents Comodo Network Center - Introduction...
Hypertext Transfer Protocol over Secure Sockets Layer (HTTPS)
Hypertext Transfer Protocol over Secure Sockets Layer (HTTPS) This chapter provides information about Hypertext Transfer Protocol over Secure Sockets Layer. HTTPS, page 1 HTTPS for Cisco Unified IP Phone
File System Concepts File Allocation Table (FAT) New Technology File System (NTFS) Extended File System (EXT) Master File Table (MFT)
File System Concepts File Allocation Table (FAT) New Technology File System (NTFS) Extended File System (EXT) Master File Table (MFT) 1 FILE SYSTEM CONCEPTS: FILE ALLOCATION TABLE (FAT) Alex Applegate
Hosted Encore 5 Desktop Installation Guide
Hosted Encore 5 Desktop Installation Guide November 18, 2015 WARNING: This Guide is for quickly configuring desktops to communicate with Cluen s hosted Encore solution. If you are installing Encore within
Windows 8 Step by Step Upgrade Guide 1/53
Windows 8 Step by Step Guide 1/53 Contents 1. Before you Start Upgrading 1. Windows 8 Setup Process 2. System Requirements 3. Preparations 2. 3. 4. the 5. Clean the 6. 1. Personalize 2. Wireless 3. Custom
My Cloud EX2 Ultra Storage Device Release Notes for Firmware
My Cloud EX2 Ultra Storage Device Release Notes for Firmware 2.30.165 These release notes provide information on My Cloud EX2 Ultra Storage Device Information on the firmware is provided as listed below:
WINDOWS EVENT FORENSIC PROCESS
Chapter 7 WINDOWS EVENT FORENSIC PROCESS Quang Do, Ben Martini, Jonathan Looi, Yu Wang, and Kim-Kwang Choo Abstract Event logs provide an audit trail that records user events and activities on a computer
Video Surveillance System for $300
READYNAS SOLUTIONS SERIES Video Surveillance System for $300 Infrant Technologies, Inc. 3065 Skyway Court, Fremont, CA 94539 www.infrant.com Introduction The Video Surveillance market is expected to top
4 Enter an IP address and sub-net mask for the ftp server and. 5 Go to the [System and Maintenance] > [Administrative Tools]
![4 Enter an IP address and sub-net mask for the ftp server and. 5 Go to the [System and Maintenance] > [Administrative Tools]](/thumbs/87/97409897.jpg "4 Enter an IP address and sub-net mask for the ftp server and. 5 Go to the [System and Maintenance] > [Administrative Tools]")
$00_WT-4_En.book Page 115 Friday, August 10, 2007 2:02 PM 4 Enter an IP address and sub-net mask for the ftp server and click [OK]. 5 Go to the [System and Maintenance] > [Administrative Tools] control
AccessData Forensic Toolkit 5.6 Release Notes
AccessData Forensic Toolkit 5.6 Release Notes Document Date: 12/08/2014 2014 AccessData Group, Inc. All rights reserved Introduction This document lists the new features, fixed issues, and known issues
Management Mechanisms
Chapter 4 Management Mechanisms This chapter describes three fundamental mechanisms in Microsoft Windows that are critical to the management and configuration of the system: The registry Services The Registry
Running head: FTK IMAGER 1
Running head: FTK IMAGER 1 FTK Imager Jean-Raymond Ducasse CSOL-590 June 26, 2017 Thomas Plunkett FTK IMAGER 2 FTK Imager Outline Process for Adding Individual Files & Folders as Evidence Items Although
Device Set-Up. User s Guide
Device Set-Up User s Guide Contents About this Product... iii Trademarks... iv 1 Getting Started 1.1 System Requirements... 1-1 1.2 Overview of Functions... 1-2 2 Software Installation 2.1 OpenAPI settings...
EntraPass (W10) Installation Guide Kantech-OnBoard systems
Overview Purpose ExacqVision recorders now include Kantech EntraPass Corporate Edition software. The purpose of this document is to guide the technician or installer through the process of installing and
User Guide. BlackBerry Workspaces for Windows. Version 5.5
User Guide BlackBerry Workspaces for Windows Version 5.5 Published: 2017-03-30 SWD-20170330110027321 Contents Introducing BlackBerry Workspaces for Windows... 6 Getting Started... 7 Setting up and installing
Chapter 3. Shortcuts
Chapter 3 Shortcuts Link Files Practical Exercise - Manually Decoding Link Files 1. Use WinHEX to open up the file named \Student Files\03_Link Files\c-3.txt.lnk. 2. First, let s look at the file header
SharePoint 2010 Instructions for Users
SharePoint 2010 Instructions for Users 1. Access your SharePoint Web site...2 2. Work with folders and documents in a Shared Documents Library...3 2.1 Edit a document...3 2.2 Create a New Document...3
Basic User Manual KS-60 USB WiFi Antenna
Basic User Manual KS-60 USB WiFi Antenna www.scoutantenne.com ed. 04-2015 1. Introduction Thank you for purchasing the Scout KS-60 USB WiFi antenna, a professional marine antenna with 100% waterproof technology
Notes: Describe the architecture of your product. Please provide also which Database technology is used for case management and evidence management.
EF-1. All protocols used between the different components in the distributed architecture (management server, agents, database, forensic analyst system, etc) shall be encrypted and signed. EF-2. The Enterprise
AVWorks. Installer/User Guide
AVWorks Installer/User Guide INSTRUCTIONS This symbol is intended to alert the user to the presence of important operating and maintenance (servicing) instructions in the literature accompanying the appliance.
ModeChanger
35020808-02 2015.11 ModeChanger ModeChanger is a software utility that can switch the drive between normal mode and encrypted mode. Operating in encrypted mode will help protect your data. While the drive
AccessData Forensic Toolkit Release Notes
AccessData Forensic Toolkit 5.3.3 Release Notes Document Date: 5/19/2014 2014 AccessData Group, Inc. All rights reserved Introduction This document lists the new features, fixed issues, and known issues
LiveNX Upgrade Guide 8.0.x to 8.1.x
LIVEACTION, INC. LiveNX Upgrade Guide 8.0.x to 8.1.x UPGRADE LiveAction, Inc. 3500 Copyright WEST BAYSHORE 2016 LiveAction, ROAD Inc. All rights reserved. LiveAction, LiveNX, LiveUX, the LiveAction Logo
INSTITUTO SUPERIOR TÉCNICO
INSTITUTO SUPERIOR TÉCNICO DEPARTAMENTO DE ENGENHARIA INFORMÁTICA FORENSICS CYBER-SECURITY MEIC, METI Lab Guide III & IV Case Solving: Mr. Informant Case 2015/2016 nuno.m.santos@tecnico.ulisboa.pt 1 Introduction
A+ Guide to Software: Managing, Maintaining, and Troubleshooting, 5e. Chapter 7 Fixing Windows Problems
: Managing, Maintaining, and Troubleshooting, 5e Chapter 7 Fixing Windows Problems Objectives Learn what to do when a hardware device, application, or Windows component gives a problem Learn what to do
Hypertext Transfer Protocol Over Secure Sockets Layer (HTTPS)
Hypertext Transfer Protocol Over Secure Sockets Layer (HTTPS) This chapter provides information about Hypertext Transfer Protocol over Secure Sockets Layer. HTTPS, page 1 HTTPS for Cisco Unified IP Phone
Lab 03. Windows Operating Systems (Cont.)
Lab 03 s (Cont.) Objectives Develop a good understanding of 1. The role of an operating system in a computer system 2. Services provided by an operating system and have some hands on experience in 1. Understanding
Lab - Configure Data Backup and Recovery in Windows 7 and Vista
Lab - Configure Data Backup and Recovery in Windows 7 and Vista Introduction In this lab, you will back up data. You will also perform a recovery of the data. Recommended Equipment A computer with Windows
CollabNet SourceForge Office Plug-in
CollabNet SourceForge Office Plug-in Introduction CollabNet SourceForge Office Plug-in is developed using Microsoft Windows.NET application that allows users to browse and edit the contents of their SourceForge
USMTGUI - User guide for backup and restore of local and Domain user profiles
USMTGUI - User guide for backup and restore of local and Domain user profiles Easy transfer of User Profiles from one PC to another. Save data to USB hard disk or network and restore to the new PC In this
PASSWORDS & ENCRYPTION
PASSWORDS & ENCRYPTION Villanova University Department of Computing Sciences D. Justin Price Fall 2014 CRYPTOGRAPHY Hiding the meaning of a message from unintended recipients. Open source algorithms are
AccessData Forensic Toolkit Release Notes
AccessData Forensic Toolkit 5.6.1 Release Notes Document Date: 3/09/2015 2015 AccessData Group, Inc. All rights reserved Introduction This document lists the new features, fixed issues, and known issues
Windows 7 THE MISSING MANUAL. w [ David Pogue POGUE PRESS" O'REILLY8. Beijing. Cambridge. Farnham KOln Sebastopol. Taipei Tokyo
Windows 7 THE MISSING MANUAL w [ David Pogue Beijing Cambridge POGUE PRESS" O'REILLY8 Farnham KOln Sebastopol Taipei Tokyo Table of Contents The Missing Credits xii Introduction 1 What's New 3 About This
Data Manager. Scheduling Data Backup CHAPTER
CHAPTER 9 To access Data management tasks, log into the system (see Logging In section on page 2-1). Then, from the Home page, click the Tools tab. The Tools page appears. From the Tools page, click. The
ViewPower. User s Manual. Management Software for Uninterruptible Power Supply Systems
ViewPower User s Manual Management Software for Uninterruptible Power Supply Systems Table of Contents 1. ViewPower Overview...2 1.1. Introduction...2 1.2. Structure...2 1.3. Applications...2 1.4. Features...3