Unit 3: Anti-Forensics Techniques and Windows Forensics - Subjective Questions

Anti-forensics refers to a set of techniques, tools, and methods used to obstruct, mislead, or defeat digital forensic investigations. Its purpose is to make the acquisition, analysis, and interpretation of digital evidence difficult, time-consuming, or unreliable.

Main Goals of Anti-Forensics:

• Prevent evidence collection – stopping investigators from acquiring data.
• Increase investigation time – making analysis costly and slow.
• Cast doubt on evidence – undermining reliability so evidence is inadmissible.
• Hide the existence of data – concealing that any evidence exists at all.
• Subvert forensic tools – exploiting bugs in analysis software.

Broad Categories of Anti-Forensics Techniques:

• Data Hiding – concealing data using steganography, slack space, hidden partitions, or alternate data streams (ADS).
• Artifact Wiping – securely deleting or overwriting files, metadata, and logs to remove traces.
• Trail Obfuscation – confusing or misleading investigators via log manipulation, timestamp alteration (timestomping), spoofing, and misinformation.
• Attacks Against Forensic Tools – exploiting vulnerabilities, using data that crashes tools, or leveraging tool detection.
• Encryption – rendering data unreadable without a key.

Effective investigations must anticipate these techniques and apply appropriate countermeasures.

How Data Deletion Works:
When a file is deleted in Windows, the operating system does not immediately erase the file's contents. Instead:

• The file's entry in the Master File Table (MFT) or File Allocation Table (FAT) is marked as unallocated.
• The clusters occupied by the file are flagged as available for reuse.
• The actual data remains on disk until overwritten by new data.

This is why deleted files can often be recovered until the space is reused.

Role of the Recycle Bin:
When a user deletes a file via Explorer, it is moved to the Recycle Bin rather than being erased. The Recycle Bin retains metadata that is highly valuable to investigators.

Recycle Bin Structure:

• Older systems (XP): RECYCLER folder with an INFO2 file.
• Modern systems (Vista onward): $Recycle.Bin folder containing:
  • $I files – store original file name, path, size, and deletion timestamp.
  • $R files – store the actual deleted file content.

Recoverable Artifacts:

• Original file name and full path
• Date and time of deletion
• File size
• The file content itself (from $R files)
• User SID (from the subfolder name), linking deletion to a specific user account.

These artifacts help establish what was deleted, when, and by whom.

File Carving is the process of recovering files from raw disk data or unallocated space without relying on file system metadata (MFT/FAT entries). It reconstructs files by identifying known patterns within the raw bytes.

Header/Footer-Based Carving:

• Uses known file signatures (magic numbers) to locate the start (header) and end (footer) of files.
• Examples:
  • JPEG: header FF D8 FF, footer FF D9
  • PDF: header %PDF, footer %%EOF
  • PNG: header 89 50 4E 47
• The carver extracts all bytes between the header and footer.

File Structure-Based Carving:

• Uses knowledge of the internal structure/format of a file type (e.g., length fields, block boundaries) to reconstruct files more accurately.
• Useful when footers are missing or files are partially overwritten.

Challenges in File Carving:

• Fragmentation – files stored non-contiguously are hard to reassemble in correct order.
• Missing footers – some file types lack clear end markers.
• Overwritten data – partial overwrites corrupt recovered files.
• False positives – signatures may appear coincidentally within other data.
• Large data volumes – time and resource intensive.

Tools such as Scalpel, Foremost, and PhotoRec automate carving. Carving is essential for recovering evidence when metadata is destroyed.

Password recovery is often necessary to access encrypted or protected evidence.

Password Cracking Techniques:

• Brute Force Attack – tries every possible combination of characters. Guaranteed to succeed eventually but extremely slow for long/complex passwords.
• Dictionary Attack – tests words from a predefined list (dictionary) plus common variations. Fast but only works for weak/common passwords.
• Hybrid Attack – combines dictionary words with numbers/symbols (e.g., password123). Balances speed and coverage.
• Rainbow Table Attack – uses precomputed tables of hash values to reverse hashes quickly. Defeated by salting.
• Rule-Based Attack – applies transformation rules (leetspeak, capitalization) to dictionary words.

Password Bypassing Techniques:

• Resetting/Clearing – overwriting or removing the stored password hash (e.g., editing the SAM file).
• Exploiting default credentials or backdoors.
• Extracting cached credentials from memory (RAM).
• Booting from live media to access files without logging in.

Comparison:

Investigators typically start with faster methods (dictionary/hybrid) before resorting to brute force.

Steganography is the practice of concealing data within another non-secret file or medium so that its very existence is hidden. Unlike encryption (which hides the meaning), steganography hides the presence of the message.

Common Steganography Methods:

• Image Steganography – embedding data in image pixels using LSB (Least Significant Bit) substitution.
• Audio Steganography – hiding data in inaudible frequencies or LSBs of audio samples.
• Video Steganography – embedding data across video frames.
• Text Steganography – using whitespace, formatting, or word patterns.
• File System Steganography – hiding data in slack space or unused areas.

Detection Techniques (Steganalysis):

• Statistical Analysis – detecting anomalies in the distribution of pixel/sample values (e.g., Chi-square test, histogram analysis).
• Signature-Based Detection – searching for known headers/patterns left by stego tools.
• File Size/Property Anomalies – comparing suspected files with known originals.
• Visual/Audible Inspection – enhancing images to spot distortions.
• Tool Detection – identifying installed steganography software (e.g., Steghide, OpenStego) on the system.

Key Indicators:

• Unusually large file sizes
• Presence of duplicate images (original vs. modified)
• Statistical irregularities in LSBs

Steganalysis tools include StegExpose, StegDetect, and Stegsecret. Detecting steganography is challenging because well-implemented techniques leave minimal traces.

File systems contain several areas that can be exploited to conceal data from casual inspection and even some forensic tools.

1. Slack Space:

• Disk space is allocated in fixed-size clusters. When a file does not fully fill its last cluster, the leftover area is slack space.
• File slack can contain remnants of previously deleted files or be deliberately used to hide data.
• Example: A 5 KB file in a 4 KB cluster system uses 2 clusters (8 KB), leaving 3 KB of slack.

2. Alternate Data Streams (ADS):

• An NTFS feature allowing a file to have multiple data streams. The default stream is visible; additional streams are hidden.
• Example: notepad file.txt:hidden.txt attaches a hidden stream to file.txt.
• Hidden streams do not change the visible file size in Explorer, making them stealthy.
• Detected using tools like dir /r, Streams (Sysinternals), or forensic suites.

3. Hidden/Host-Protected Areas:

• HPA (Host Protected Area) and DCO (Device Configuration Overlay) are disk regions hidden from the OS at the firmware level.
• Data hidden here is invisible to normal tools; specialized hardware/software is needed to access them.

4. Hidden Partitions:

• Partitions marked as hidden or with non-standard file systems escape casual detection.

Forensic Implications:

• Investigators must examine slack space, enumerate ADS, and verify disk geometry to uncover concealed data.

Trail Obfuscation aims to confuse, mislead, or disorient investigators by creating false trails or destroying the logical sequence of events.

Techniques:

1. Timestamp Manipulation (Timestomping):

• Altering the MACE timestamps (Modified, Accessed, Created, Entry-modified) of files to hide activity or create false timelines.
• Tools like timestomp (Metasploit) can set arbitrary timestamps.
• Countermeasure: Compare the FILE_NAME attribute timestamps in the MFT. Discrepancies (e.g., STANDARD_INFORMATION, or timestamps with zeroed sub-second values) indicate tampering.

2. Log Manipulation:

• Deleting, clearing, or editing event logs to remove traces of activity.
• Clearing the Windows Security log generates Event ID 1102, which itself is an indicator.
• Countermeasure: Centralized/remote logging (SIEM), checking for gaps in log sequence numbers, and recovering log fragments from unallocated space.

3. Other Obfuscation:

• IP/MAC spoofing to misattribute actions.
• Using proxies/VPNs/Tor to hide origin.
• Planting false evidence to mislead.
• Data misdirection – placing decoy files.

Countermeasures Summary:

• Cross-verify timestamps across multiple sources.
• Maintain immutable, off-system logs.
• Correlate multiple artifacts (registry, prefetch, logs) to detect inconsistencies.
• Preserve original evidence with hashing to detect alteration.

Artifact Wiping is an anti-forensic technique that securely and permanently destroys data so that it cannot be recovered, unlike normal deletion which only removes references.

Types of Wiping:

1. File Wiping (Secure Deletion):

• Overwrites the actual content of specific files (and sometimes their metadata) one or more times with random data or fixed patterns.
• Tools: Eraser, sdelete, shred, BCWipe.
• Standards: DoD 5220.22-M (3-pass), Gutmann (35-pass).

2. Disk Wiping:

• Overwrites the entire drive, destroying all data, file systems, and metadata.
• Used to sanitize an entire storage device.

3. Metadata Wiping:

• Specifically targets metadata (timestamps, file names in MFT, EXIF data) to remove traces even if content recovery is attempted.

Detection of Overwritten Data / Wiping Activity:

• Presence of wiping tools – installed software, prefetch entries, registry keys, or recent execution artifacts indicating a wiper was run.
• Patterns of zeroed/random data – large contiguous regions filled with repeating patterns suggest wiping.
• MFT anomalies – entries with wiped names or missing $DATA attributes.
• Registry/UserAssist/Prefetch – records of the wiping tool being executed.
• Log gaps – sudden absence of expected artifacts.

Note: Once data is properly overwritten, recovery is generally impossible; investigators instead focus on proving that wiping occurred and when, which itself is evidence.

Encryption transforms readable data (plaintext) into an unreadable form (ciphertext) using an algorithm and a key. As an anti-forensic technique, it renders evidence inaccessible without the correct key.

Full Disk Encryption (FDE):

• Encrypts the entire storage volume, including the OS, system files, and free space.
• Examples: BitLocker, VeraCrypt, FileVault, LUKS.
• Data is decrypted on-the-fly when the system is running (key in memory).

File-Level Encryption:

• Encrypts individual files or folders rather than the whole disk.
• Examples: EFS (Encrypting File System), password-protected archives.
• Only specific files are protected; the rest of the disk is readable.

Comparison:

Handling Encrypted Evidence:

• Live acquisition – capture the system while running to obtain decryption keys from RAM (memory forensics).
• Key/passphrase recovery – search for written passwords, use dictionary/brute-force attacks.
• Recovery keys – BitLocker recovery keys may be stored in Active Directory or a Microsoft account.
• Cold boot attacks – recovering keys from RAM shortly after power-off.
• Legal compulsion – ordering the suspect to provide the key (jurisdiction-dependent).

Best Practice: Never power off a running encrypted system before capturing volatile memory, as keys may be lost.

Program Packers are tools that compress or encrypt an executable and wrap it with a small stub that decompresses/decrypts the original code into memory at runtime. They are used to reduce file size but are heavily exploited by malware to evade detection and analysis.

Purpose (from an anti-forensic view):

• Obfuscate code so static analysis and signature-based AV fail.
• Minimize footprint – reduce detectable artifacts on disk.
• Hinder reverse engineering.

Common Packers: UPX, ASPack, PECompact, Themida, MPRESS.

Footprint-Minimizing Techniques:

• Living-off-the-land – using legitimate system tools (PowerShell, WMI) instead of dropping files.
• Fileless malware – running entirely in memory, leaving no disk trace.
• Deleting installers/logs after execution.
• Using memory-only payloads.

Detection of Packed Executables:

• High Entropy – packed/encrypted sections show high randomness (entropy near 8 bits/byte). Tools measure entropy per section.
• Unusual Section Names – e.g., UPX0, UPX1, .aspack.
• Small number of imports – packed files often import only a few functions (like LoadLibrary, GetProcAddress).
• Signature Detection – tools like PEiD, Detect It Easy (DIE) identify known packers.
• Entry point anomalies – entry point in a writable/unusual section.

Analysis Approach:

• Unpacking – run in a sandbox and dump the unpacked image from memory, then analyze.
• Memory forensics to capture the decrypted code at runtime.

Detecting packers is a key step before deeper malware analysis.

Anti-Forensic Countermeasures are the strategies, tools, and procedures used by forensic investigators to overcome or mitigate anti-forensic techniques.

Countermeasures by Technique:

1. Against Data Hiding:

• Examine slack space, ADS, HPA/DCO, and hidden partitions.
• Use steganalysis tools for hidden data.
• Verify disk geometry against reported capacity.

2. Against Encryption:

• Perform live acquisition to capture keys from RAM.
• Search for stored/recovery keys.
• Apply password recovery techniques.

3. Against Artifact Wiping:

• Detect presence and execution of wiping tools (prefetch, registry, logs).
• Recover fragments from unallocated space.
• Prove wiping occurred as circumstantial evidence.

4. Against Trail Obfuscation:

• Cross-verify FILE_NAME timestamps.
• Use centralized/remote logging.
• Correlate multiple independent artifacts.

5. Against Tool Attacks:

• Use multiple, validated forensic tools and cross-check results.
• Keep tools patched and tested.

General Best Practices:

• Maintain chain of custody and hashing (MD5/SHA-256) to prove integrity.
• Live and dead acquisition combined.
• Write blockers to prevent evidence alteration.
• Timeline analysis correlating registry, logs, prefetch, and file system.
• Continuous training on emerging anti-forensic methods.
• Documentation of every step for court admissibility.

A layered, multi-tool, well-documented approach is the most effective countermeasure.

Volatile Information is data that is lost when the system loses power or is rebooted. It exists temporarily in memory.

Examples of Volatile Data:

• Contents of RAM
• Running processes and their memory
• Network connections and open ports
• ARP cache, routing tables
• Logged-in users, open files
• Clipboard contents, encryption keys in memory

Non-Volatile Information persists even after power loss, stored on permanent media.

Examples of Non-Volatile Data:

• Files on hard drives / SSDs
• Registry hives
• Event logs, browser history
• Swap/page files, hibernation files
• Slack space and unallocated space

Order of Volatility (RFC 3227):
Evidence should be collected from the most volatile to the least volatile to avoid losing transient data:

1. CPU registers, cache
2. RAM (memory)
3. Network state (connections, ARP cache)
4. Running processes
5. Disk (files, swap)
6. Remote logging / monitoring data
7. Physical configuration, archival media

Why It Matters:

• Volatile data disappears the moment the system is powered off, so it must be captured first using live acquisition.
• Failing to follow this order can result in irrecoverable loss of critical evidence such as encryption keys or active network sessions.

Following the order of volatility ensures maximum evidence preservation.

Windows Memory Analysis involves capturing and examining the contents of a system's RAM to extract volatile evidence that is not available on disk.

Memory Acquisition Methods:

• Software-based – tools like FTK Imager, DumpIt, WinPmem, Belkasoft RAM Capturer, Magnet RAM Capture create a memory dump while the system is live.
• Hardware-based – using dedicated hardware (e.g., FireWire/DMA) to read physical memory.
• Crash dumps / Hibernation file (hiberfil.sys) – can be analyzed as memory snapshots.
• Virtual machine snapshots – VM memory files (.vmem) contain RAM state.

Important: Acquisition must be done on a live/running system, and using a minimal-footprint tool to avoid overwriting evidence.

Artifacts Recoverable from Memory:

• Running processes and process tree (parent/child relationships)
• Loaded DLLs and drivers
• Open network connections and sockets
• Command history and console output
• Encryption keys and passwords (e.g., BitLocker keys)
• Injected/hidden code (rootkits, malware)
• Registry data cached in memory
• Clipboard contents, chat fragments, browser data
• Unencrypted data that is encrypted on disk

Analysis Tools:

• Volatility Framework – the leading open-source tool. Common plugins:
  • pslist / pstree – list processes
  • netscan / connscan – network connections
  • malfind – detect injected code
  • dlllist, hivelist, hashdump
• Rekall, Redline, Magnet AXIOM.

Process Steps:

1. Acquire memory image from live system.
2. Hash the image for integrity.
3. Identify the OS profile (Volatility).
4. Enumerate processes, connections, and modules.
5. Detect anomalies (hidden processes, injected code).
6. Extract keys, credentials, and relevant data.
7. Document findings.

Memory analysis is critical for detecting fileless malware, recovering encryption keys, and reconstructing live system state.

The Windows Registry is a hierarchical database that stores low-level configuration settings for the operating system, hardware, applications, and users. It is a rich source of forensic evidence.

Registry Structure:
The registry is organized into hives, keys, subkeys, and values.

Root Keys (Hives):

• HKEY_LOCAL_MACHINE (HKLM) – system-wide settings (hardware, software, security).
• HKEY_CURRENT_USER (HKCU) – settings for the logged-in user.
• HKEY_USERS (HKU) – all user profiles.
• HKEY_CLASSES_ROOT (HKCR) – file associations.
• HKEY_CURRENT_CONFIG (HKCC) – current hardware profile.

Physical Hive Files (in C:\Windows\System32\config\):

• SAM – user accounts and password hashes.
• SECURITY – security policy.
• SOFTWARE – installed software settings.
• SYSTEM – system configuration, services, devices.
• NTUSER.DAT (per user) – user-specific settings.

Forensically Important Registry Locations:

• Run/RunOnce keys (...\CurrentVersion\Run) – auto-start programs (malware persistence).
• UserAssist – GUI programs executed by the user (ROT13 encoded).
• RecentDocs – recently opened documents.
• TypedURLs – URLs typed in Internet Explorer/Edge.
• MountedDevices / USBSTOR – connected USB devices with serial numbers.
• MRU lists – most recently used files/commands.
• ShellBags – folder access history and view settings.
• ComputerName, TimeZone, Network settings.
• Last logged-on user, installed applications.

Importance in Forensics:

• Reveals user activity and program execution.
• Tracks USB and external device usage.
• Provides persistence mechanisms used by malware.
• Establishes timeline via key LastWrite timestamps.

Tools: RegRipper, Registry Explorer, FTK Registry Viewer.

Registry analysis is central to reconstructing user behavior and system events.

Web browsers store extensive data about user activity, making them a valuable source of forensic evidence.

1. Browser Cache:

• Stores copies of web page elements (images, HTML, scripts) to speed up loading.
• Forensic value: Reveals which pages were visited and their content, even if the site later changed or was deleted. Includes timestamps.

2. Cookies:

• Small files storing session data, preferences, and authentication tokens set by websites.
• Forensic value: Show which sites a user interacted with, login sessions, and sometimes timestamps of visits. Can prove account usage.

3. Browsing History:

• A record of visited URLs, page titles, visit counts, and timestamps.
• Forensic value: Directly establishes user intent and activity — sites visited, search queries, and time patterns.

4. Other Artifacts:

• Downloads history – files downloaded, source URLs, timestamps.
• Autofill / saved form data – names, addresses, search terms.
• Saved passwords and bookmarks.
• Session restore files – open tabs at last close.

Storage Locations (examples):

• Chrome: ...\User Data\Default\ (SQLite databases: History, Cookies, Cache).
• Firefox: places.sqlite, cookies.sqlite.
• Edge: similar to Chrome (Chromium-based).

Analysis Considerations:

• Data is often stored in SQLite databases – examined with tools like DB Browser for SQLite or dedicated suites (Magnet AXIOM, Autopsy, BrowserHistoryView).
• Private/Incognito mode leaves fewer disk artifacts but data may still reside in RAM or DNS cache.
• Deleted history may be recovered from unallocated space or SQLite WAL files.

Browser forensics is key in cases involving fraud, harassment, and unauthorized access.

Windows generates numerous system files and metadata that record user and system activity, providing valuable forensic evidence.

1. Prefetch Files (C:\Windows\Prefetch\*.pf):

• Created by Windows to speed up application launches.
• Forensic value:
  • Proves an application was executed.
  • Records number of times run and last run timestamps (up to 8 recent runs in Win8+).
  • Shows files/DLLs accessed by the program.
• Even if the original executable is deleted, its prefetch file may remain.

2. Thumbnail Cache (thumbcache_*.db):

• Stores thumbnails of images/documents viewed in Explorer.
• Forensic value: Thumbnails persist even after the original files are deleted, proving that images once existed on the system.

3. File Metadata:

• File system metadata (MFT): MACE timestamps (Created, Modified, Accessed, MFT-Entry modified), file size, owner.
• Application metadata: e.g., EXIF data in photos (camera model, GPS coordinates, date), Office document properties (author, revision, editing time).
• Forensic value: Establishes timelines, authorship, geolocation, and detects timestomping via timestamp inconsistencies.

4. Other Useful Files:

• $MFT – master file table (all file records).
• Pagefile.sys / hiberfil.sys – memory remnants.
• Recycle Bin (R files).

Analysis Tools: MFTECmd, PECmd (prefetch), ExifTool, Thumbcache Viewer.

Combining these artifacts allows investigators to reconstruct a detailed timeline of file and program activity.

ShellBags are registry artifacts that store information about the view settings, size, position, and layout of folders when a user browses them in Windows Explorer. Their real forensic value lies in what they reveal about folder access.

Purpose:

• Windows uses ShellBags to "remember" how a user prefers each folder to be displayed (icon size, sort order, window position).

Storage Locations (per user, in NTUSER.DAT and USRCLASS.DAT):

• HKCU\Software\Microsoft\Windows\Shell\Bags
• HKCU\Software\Microsoft\Windows\Shell\BagMRU
• USRCLASS.DAT → ...\Local Settings\Software\Microsoft\Windows\Shell\Bags and BagMRU

Forensic Value:

• Proof of folder access – ShellBags are created/updated when a user navigates to a folder, proving the folder was viewed.
• Evidence of deleted or external folders – ShellBags can persist for folders on:
  • Removable/USB drives that are no longer connected.
  • Network shares.
  • Deleted folders or folders in encrypted containers (e.g., TrueCrypt volumes) that were opened.
• Timestamps – provide when folders were first/last accessed.
• Hierarchy reconstruction – the BagMRU structure shows the folder tree the user browsed.

Significance:

• Extremely useful for proving a suspect knew about and accessed specific folders, even if those folders/files no longer exist on the system.

Tools: ShellBags Explorer (Eric Zimmerman), RegRipper.

ShellBags are powerful because they can reveal browsing of storage that is otherwise untraceable.

LNK Files (Shortcut Files):

• LNK files are Windows shortcut files (.lnk) that point to a target file, folder, or application.
• They are automatically created by Windows when a user opens a file (e.g., recent documents in %AppData%\Microsoft\Windows\Recent\).

Forensic Value of LNK Files:

• Target path – full path of the accessed file, including on external/USB drives or network shares.
• Timestamps – both the LNK file's own MACE times and the target file's original timestamps (Created, Modified, Accessed).
• Volume information – drive serial number, volume label, and drive type (helps prove USB usage).
• File size of the target.
• Proof a file was opened, even if the file itself is now deleted or the drive removed.

Jump Lists:

• Introduced in Windows 7, Jump Lists provide quick access to recently or frequently used files per application (visible on right-click of taskbar icons).
• Stored in:
  • AutomaticDestinations (*.automaticDestinations-ms) – populated automatically by the OS.
  • CustomDestinations (*.customDestinations-ms) – populated by applications/user pinning.
• Location: %AppData%\Microsoft\Windows\Recent\AutomaticDestinations\

Forensic Value of Jump Lists:

• Link specific applications to the files they opened.
• Contain embedded LNK data (paths, timestamps, volume info).
• Reveal frequency and recency of file access.
• Identified by application via an AppID (a hash of the executable path).

Combined Significance:

• LNK files and Jump Lists together provide strong evidence of which files a user opened, when, with which program, and from which device — even for deleted files or removed media.

Tools: LECmd, JLECmd (Eric Zimmerman), Windows Jump List Parser.

Logs are essential forensic artifacts that record system, application, and security events.

Text-Based Logs:

• Plain-text files that record events in a human-readable format.
• Examples:
  • IIS web server logs, Apache logs
  • Application-specific logs (.log, .txt)
  • setupapi.dev.log (device installation)
  • Firewall logs, antivirus logs
• Format: Usually one line per event with timestamp, source, and message. Formats vary by application (CSV, W3C, custom).
• Storage: Located wherever the application writes them (often program directories or %ProgramData%).
• Analysis: Read with any text editor, grep, or log-parsing tools; easy to search but easy to tamper with.

Windows Event Logs:

• Structured logs managed by the Windows Event Logging service.
• Format:
  • Older (XP/2003): .evt (binary).
  • Newer (Vista onward): .evtx (XML-based binary).
• Storage: C:\Windows\System32\winevt\Logs\
• Main Log Categories:
  • System – OS and driver events.
  • Application – application events.
  • Security – logons, privilege use, object access, policy changes.
  • Setup and custom/operational logs.

Key Security Event IDs:

• 4624 – Successful logon
• 4625 – Failed logon
• 4634 / 4647 – Logoff
• 4672 – Special privileges assigned
• 4720 – User account created
• 1102 – Security log cleared
• 7045 – New service installed

Comparison:

Forensic Importance:

• Reconstruct timeline of events (logons, program execution, errors).
• Detect intrusions, brute-force attempts, privilege escalation.
• Identify account creation/deletion and service installation (malware persistence).
• Detecting a cleared log (Event ID 1102) is itself evidence of anti-forensic activity.

Tools: Windows Event Viewer, Log Parser, EvtxECmd, Chainsaw, SIEM platforms.

Correlating both log types provides a comprehensive view of system and user activity.

A structured, defensible procedure ensures evidence integrity and admissibility.

Pre-Collection Preparation:

• Obtain legal authorization (warrant/consent).
• Prepare a trusted toolkit on read-only media (USB/CD) with statically compiled tools.
• Document the scene (photos, system state, running/off).
• Establish and maintain the chain of custody.

Phase 1 – Collecting Volatile Information (Live, if system is running):
Follow the order of volatility (most to least volatile):

1. Capture RAM – full memory dump using DumpIt/WinPmem/FTK Imager.
2. Record system date/time and uptime.
3. Running processes – tasklist, pslist.
4. Network connections & ports – netstat -ano, arp -a.
5. Logged-on users – logonsessions, net session.
6. Open files and handles – handle, openfiles.
7. Routing tables, DNS/ARP cache, clipboard.
8. Loaded drivers and services.

Hash each captured item immediately. Avoid installing tools on the target; run from external media.

Phase 2 – Collecting Non-Volatile Information:

1. Decide acquisition type:
   • Live acquisition if system cannot be shut down (e.g., encryption active).
   • Dead acquisition – power down properly (pull plug for Windows to avoid graceful cleanup, per policy) and image the disk.
2. Use a write blocker to prevent altering the source drive.
3. Create a forensic image (bit-by-bit) using FTK Imager/dd/EnCase (formats: E01, raw dd).
4. Hash the image (MD5/SHA-256) and compare with the original to verify integrity.
5. Collect key artifacts:
   • Registry hives, event logs, prefetch, browser data, page/hibernation files, file system metadata (MFT).

Phase 3 – Documentation & Preservation:

• Record every action, timestamp, tool, and version used.
• Store evidence securely; maintain chain of custody forms.
• Work only on copies, never the original.
• Verify hashes before and after each step.

Best Practices Summary:

• Volatile data first, then non-volatile.
• Minimize footprint on the live system.
• Hash everything for integrity.
• Use validated tools and write blockers.
• Maintain thorough documentation for court admissibility.

This methodical approach preserves the maximum amount of evidence while ensuring it remains legally defensible.