FORENSIC TREASURE HUNT - RSA Conference

12 Pages·2013·0.75 MB·English

by  Christina Apostal

FORENSIC TREASURE
HUNT
Nick Klein
Instructor, SANS Institute
Director, Klein & Co. Computer Forensics
Session ID: SANS
Session Classification: Intermediate
SHORTCUT / LINK FILES
All material subject to copyright
of the SANS Institute
SHORTCUT / LINK FILES
► File and folder ► Volume serial ► Target
timestamps
► Full path ► Shortcut
timestamps
► Volume name
All material subject to copyright
of the SANS Institute
JUMP LISTS
All material subject to copyright
of the SANS Institute
JUMP LISTS
All material subject to copyright
of the SANS Institute
JUMP LISTS
All material subject to copyright
of the SANS Institute
PREFETCH
► Programs run ► Files, folders, devices
accessed
► First / last run times
► GUI and command line
► Run count
All material subject to copyright
of the SANS Institute
“SUPER” TIMELINE
All material subject to copyright
of the SANS Institute
USB DEVICES
► Vendor, make, model
► Physical device serial no.
► Last used drive letter
► Volume name
► Last user of device
► Times of:
► First connection
► Last connection
► First connection after last
reboot
All material subject to copyright
of the SANS Institute
WIRELESS GEOLOCATION
► Domain / intranet name ► First and last connection
times
► Wireless SSID
► Possible geolocation
► MAC address of AP
All material subject to copyright
of the SANS Institute