OLE structured storage, Registry as log file,
124OpenSaveMRU key, user hives,
150–151OpenSavePidMRU key, user hives,
150–151Open-source tools (general)
See also specific tools
analysis system set-up,
24pre-infection intelligence collection,
173–174Operational logs
WLAN-AutoConfig example,
92fOrder of volatility, definition,
11OSession.evt, timeline creation on XP,
233–234P
Packed files
Packet sniffers, incident response data collection,
41Pagefile
ParentIDPrefix value, device mapping,
126Parse::Win32Registry Perl module,
282events file creation,
244bLog2timeline framework,
213malware persistence mechanism,
175–176malware propagation mechanism,
173–174NTFS $I30 Index Attributes,
85timeline creation on Windows,
8,
234Partition table
Payment card industry (PCI)
Data Security Standards (DSS),
47incident response example,
31PDF files, initial infection vector,
172–173Peer-to-peer (P2P) file sharing
initial infection vector,
172PEiD tool
packed file malware detection,
193Perl Package Manager (PPM),
232bPerl script listing
analysis system set-up,
24Event Log file extraction,
87Event Log file parsing,
88events file additions,
248fevents file creation,
244bfile system tunneling example,
84INFO2 file extraction,
95Internet activity analysis,
205–206LEGACY_IMDISK LastWrite time,
140–141Log2timeline framework,
213prefetch file parsing,
98–99Registry data and TLN creation,
239–242time stomping example,
82USB external drive analysis,
135Windows Event Log parsing,
95Persistence mechanism (malware),
177file system startup locations,
177–178networked environments,
178PGPDisk volume, MountedDevices key,
130,
130fPhishing attacks, training for,
173bPhysical Disk Emulator (PDE) module,
60Physical memory
incident preparation questions,
32Platform-as-a-service (PaaS),
21Plugin Browser, Registry analysis,
164,
165fPoint of contact (PoC), incident preparation,
29Portable executable (PE) files
application file prefetching,
97incident response data collection,
44installed AV applications,
186NTOSBOOT-BOODFAAD.pf,
100speculation issues,
12–13PrefetchParameters key,
97Previous Versions shell extension,
51,
51fProcess Monitor (ProcMon),
14Process Registry key (XP),
5–6ProDiscover
analysis system set-up,
24dropdown menu example,
205fInternet History Viewer,
205fWindows 7 .job file,
102fProDiscover Basic Edition (BE),
24,
66b,
68ProDiscover Incident Response Edition (IR)
Internet activity analysis,
204time stamp display,
77,
78fVSCs in acquired images,
71ProfileGuid value, NetworkList,
147ProfileList subkey, timeline analysis,
223–224Profiles key, NetworkList,
147Propagation mechanism (malware)
ProScript, analysis system set-up,
23Psexec.exe, interesting artifact searches,
90PSExecSvc service, malware detection,
206Pwdump7.exe, Registry analysis,
122Python script listing
Python scripts
analysis system set-up,
24Android device application files,
116NTFS $I30 Index Attributes,
85$SIA and $FNA extraction,
80,
82Q
Questions
incident preparation,
30–33malware persistence mechanism,
177R
as Registry information source,
162Registry
camera image file analysis,
117installed AV applications,
186malware persistence mechanism,
175–176ProDiscover Basic Edition,
24EMDMgmt subkey values,
132fevidence eliminators,
162bhistorical Registry data,
152bPlugin Browser interface,
164,
165fRegIdleBackup key values,
149fUnmanaged subkey values,
146fSystem hive
testing for malware execution,
208USB drive/disk signature,
134fUSBStor and USB subkeys,
134fUSBStor device subkey properties,
127fc6d3bf33.Windows.XP.Mode key,
161ftracking user activity,
154bUserAssist historical data,
160bRegistry Editor tool (RegEdit.exe),
123f,
126Registry hives
file analysis example,
76incident response data collection,
44speculation issues,
12–13System Restore Points,
50timeline analysis case study,
248Windows version comparison,
5event parsing into timeline,
246malware persistence mechanism,
175–176Registry as log file,
124Registry nomenclature,
123Registry values (general)
Application Event Logs,
184Registry as log file,
124Registry nomenclature,
123analysis system set-up,
24events file creation,
244bLEGACY_IMDISK LastWrite time,
140–141Registry data and TLN creation,
240timeline analysis case study,
248USB external drive analysis,
135VSC access automation,
70Remote administration tool (RAT),
197Remote Desktop Client, jump list parsing,
109Remote Desktop Connection, jump list information,
107Remote Desktop Protocol (RDP),
35,
221Remote systems
VSC access
Root key
Rootkits
malware persistence mechanism,
175Rot-13 translation cipher, UserAssist subkeys,
158Rpcall.exe, timeline analysis case study,
249Run key
malware persistence mechanism,
175–176timeline analysis case study,
248S
Safari (Apple), malware persistence mechanism,
177Safe Mode, malware persistence mechanism,
175–176SAM hive
System Restore Points,
50SAM Registry hive file,
282SANS Investigative Forensic Toolkit (SIFT)
analysis system set-up,
22–25incident response acquisition process,
43–44Registry data and TLN creation,
239–240VSCs in acquired images,
68bWindows Event Log parsing,
93AppleSoftwareUpdate task,
101fat.exe
vs. schtasks.exe,
103RegIdleBackup key values,
149ftimeline analysis data sources,
215Windows 7 .job file,
102fXP Scheduled Task Wizard,
101fSchuster, Andreas,
93,
236Secevent.evt, XP/2003 systems,
90events file creation,
244binteresting artifact searches,
90timeline creation on Windows,
8,
244Ultimate Windows Security Event Log site,
88–89Security hive
events file creation,
244bSecurity identifier (SID)
Seeded sites, malware detection,
207–208Servers, auditing functionality,
37–38Service set identifier (SSID),
146ServiceName value, NetworkCards key,
148Services Event Log, characteristics,
91Setup Event Log, characteristics,
91SHA-25 algorithm, scheduled tasks,
150ShadowExplorer v0.8, interface example,
55fShell link files, jump lists,
106The Sleuth Kit (TSK) tools
SIFT VM usage example,
22Smart phones
Sniper Forensics (Pogue),
7
Software-as-a-service (SaaS),
21malware persistence mechanism,
175–176Process Registry key,
5–6RegIdleBackup key values,
149fUnmanaged subkey values,
146fSoftware Registry hive
VSC access automation,
124Solid-state drive (SSD),
98Source value, timeline analysis,
222–223Spear phishing, definition,
173–174Speculation, analysis principles,
12Squid, Log2timeline framework,
213Ssdeep hash, MBR infectors,
202$STANDARD_INFORMATION attribute ($SIA)
file system tunneling example,
84–85file/directory records,
77time stomping example,
83Start value, Windows services analysis,
139–140Startup location, malware persistence mechanism,
177–178Sticky Notes files, Registry as log file,
124Strings.exe
analysis system set-up,
24–25Structured storage, Registry as log file,
124Suspicious processes, Carbon Black log example,
39,
39fSvchost.exe, malware detection,
203Symantec antivirus (AV) products,
234Sysevent.evt, XP/2003 systems,
90timeline creation on Windows,
8,
244System field, timeline analysis,
223System hive
U3-enabled device analysis,
125VSC access automation,
124System Properties dialog,
53findirect artifacts,
15–16timeline analysis case study,
250timeline analysis via visualization,
246timeline data volume,
243bXP system “noisiness,”,
17–18System time change, detecting,
264–265System-level privileges
Internet activity analysis,
15,
204T
Tablet devices, ubiquitousness,
1–2Task Scheduler
indirect artifacts,
15–16Windows version differences,
5TaskCache\TasksGUID key, values example,
149fTaskCache\Tree subkeys, via WRR,
149fTemp directory
VSCs and Registry keys,
52Temporal proximity
Temporary files, Registry keys,
52Temporary Internet Files (TIF),
100,
204Terminal Server Client key, UserAssist subkeys,
160Threat intelligence,
272bfile system tunneling example,
84file/directory records,
77Log2timeline framework,
213values from other file,
82–83Time stomping
Timeline (TLN) analysis
analysis system set-up,
23events file additions,
248fevents file creation,
244non-time-stamped data sources,
242Timeline (TLN) creation
image partition table,
231fTimestamping
timeline analysis data sources,
214–215TimeZoneInformation key,
222bTool validation myth-odology, analysis prinicples,
9–11Tools
vs. process, analysis principles,
9Training
incident preparation,
45–46Trojans
Process Registry key,
5–6TrueCrypt encrypted volumes,
257TrueCrypt volume, MountedDevices key,
130,
130fTrusted advisor, incident response,
42U
U3-enabled devices, Registry analysis,
125Ultimate Windows Security Event Log site,
88–89,
90Unallocated space
Unicode format
prefetch file parsing,
98–99Unique instance ID key
USB external drive analysis,
134Unmanaged subkey, values,
146,
146fUpdate sequence number (USN),
85–86deleted Registry keys,
138bEMDMgmt subkey values,
132fUSBStor device subkey properties,
127fUSBStor subkey LastWrite times,
133bUSB devices, Windows shortcuts and,
255–257USB external drives
drive/disk signature,
134fUSBStor and USB subkeys,
134fUSB thumb drive
initial infection vector,
173USBStor key
U3-enabled device analysis,
126bUSB external drive analysis,
134USBStor subkeys
USB external drive analysis,
134fUser activity tracking, expert tips,
154bUser field, timeline analysis,
223–224User hives
c6d3bf33.Windows.XP.Mode key,
161ftracking user activity,
154bUserAssist historical data,
160bVirtual PC key path,
161fUserAssist information,
245UserAssist subkey data,
265timeline analysis case study,
248Software hive application analysis,
145USRCLASS.DAT hive file,
257,
259event parsing into timeline,
245file system tunneling example,
84LEGACY_IMDISK LastWrite time,
140–141USB external drive analysis,
135V
Vhdmount, VSCs in acquired images,
61Virtual machine (VM)
analysis system set-up,
22F-Response VSC demo set-up,
57Virtual memory, direct artifacts,
13Virtual PC (VPC)
concealing artifacts,
20–22VSCs in acquired images,
61Virtual private network (VPN),
35,
57Virtual Server, VSCs in acquired images, 00003#p0405
Virtualization
Visualization, timeline analysis,
246–247VMWare (.vmdk)
analysis system set-up,
24VMWare Workstation, VSCs,
65,
67,
67fVolatility Framework
Registry analysis of memory,
163–164Volume serial number, EMDMgmt key,
132–133Volume shadow copies (VSCs),
257Volume Shadow Copy Service (VSS)
timeline analysis data sources,
242–243Volume Shadow Copy (VSC)
analysis system set-up,
23historical Registry data,
152bindirect artifacts,
15–16live systems
as Registry information source,
162–163ShadowExplorer v0.8 interface,
55fsystem files System Restore Points,
51btimeline analysis via visualization,
246UserAssist historical data,
160bXP System Restore Points,
50fVolume Shadow Service,
52–53W
Wardriving, WiFi geolocation mapping,
146Warez server, intrusions,
17Warnings
Application Event Logs,
184at.exe
vs. schtasks.exe,
103Googled malware information,
192“knowing what to look for,”,
198mixing protection mechanisms,
188multiple persistence mechanisms,
180Perl module installations,
232USBStor subkey LastWrite time,
133bWindows Event Log parsing,
237Web history analysis, expert tips,
143bWeb sites, initial infection vector,
173–174Wevtutil.exe, Event Log conversion,
93WiFi geolocation mapping, expert tips,
146b–147bWindow of compromise
initial infection vector,
173LEGACY_IMDISK LastWrite time,
140–141alternate Registry sources,
161Apple product application files,
115application prefetching,
181Applications/Services logs,
91Audit Policy settings,
38fExplorer shell searches,
5F-Response VSC demo set-up,
57bhistorical Registry data,
152bmalware persistence mechanism,
177–178prefetch files and TLN creation,
238–239Previous Versions shell extension,
51fVolume Shadow Copies (VSCs),
120Registry as log file,
124Software hive application analysis,
143,
145SSD drive prefetch settings,
98Task Scheduler applet,
103fU3-enabled device analysis,
125USB external drive analysis,
134Windows Defender logs,
186Windows 8
application prefetching,
181prefetch files and TLN creation,
238Security Event Logs,
88–89Windows 2008
analysis system set-up,
23application prefetching,
181prefetch files and TLN creation,
238Security Event Logs,
88–89USB external drive analysis,
135Windows Explorer shell
malware persistence mechanism,
177VSCs in acquired images,
61–62Windows Local Group Policy,
178Windows Management Instrumentation (WMI),
54b,
198–199Windows Media Player,
144Windows Registry Forensics (Carvey),
64
Windows Registry Recovery tool,
282direct
vs. indirect artifacts,
14b–15binteresting artifact searches,
90Internet activity analysis,
204Internet history information,
14b–15bWindows shortcuts and USB devices,
255–257analysis system set-up,
22–25Apple product application files,
115application prefetching,
97auditing functionality,
37–38event parsing into timeline,
243–244events file creation,
244bfile format diversity,
76file system tunneling,
84indepth malware detection techniques,
192–193logs and incident response,
36–41malware persistence mechanism,
175–176Registry analysis checklists,
125bsystem “noisiness,”,
17–18timeline analysis data sources,
215,
242timeline analysis via visualization,
246timeline time formats,
222tracking user activity,
154bVSC access automation,
70Windows Vista
analysis system set-up,
23application prefetching,
181Explorer shell searches,
5prefetch files and TLN creation,
238Security Event Logs,
88–89Windows Defender logs,
186Apple product application files,
115application prefetching,
181Carbon Black log example,
39Event Logs, timeline creation,
233–235Explorer shell searches,
5prefetch files and TLN creation,
238Process Registry key,
5–6Scheduled Task Wizard,
101fSecurity Event Logs,
88–89system files in System Restore Points,
51system “noisiness,”,
17–18System Restore Points,
50ftimeline data volume,
243bVSS implementation,
9,
50Windows Defender logs,
186C6d3bf33.Windows.XP.Mode key,
160,
161fWindows XP SP3 system
file system tunneling example,
84time stomping example,
82–83WLAN-AutoConfig log, event example,
92fWorms, early Internet,
17–18Write-blockers, hard drive imaging,
4X
Y
Yara project, malware detection,
194Z