Fundamental Computer Investigation

Guide for Windows

Version 1.0

Published: January 2007

For the latest information, please see
microsoft.com/technet/SolutionAccelerators
© 2007 Microsoft Corporation. This work is licensed under the Creative Commons Attribution-NonCommercial
License. To view a copy of this license, visit http://creativecommons.org/licenses/by-nc/2.5/ or send a letter to
Creative Commons, 543 Howard Street, 5th Floor, San Francisco, California, 94105, USA.
Contents
Overview ........................................................................................................ 1
Computer Investigation Model........................................................................ 1
Initial Decision-Making Process ...................................................................... 2
Chapter Summary ........................................................................................ 3
Audience ..................................................................................................... 3
Caveats and Disclaimers ............................................................................... 3
References and Credits ................................................................................. 4
Style Conventions ........................................................................................ 4
Support and Feedback .................................................................................. 4
Chapter 1: Assess the Situation ...................................................................... 5
Notify Decision Makers and Acquire Authorization ............................................. 5
Review Policies and Laws .............................................................................. 6
Identify Investigation Team Members ............................................................. 7
Conduct a Thorough Assessment .................................................................... 7
Prepare for Evidence Acquisition..................................................................... 9
Chapter 2: Acquire the Data .......................................................................... 11
Build a Computer Investigation Toolkit ...........................................................11
Collect the Data ..........................................................................................11
Store and Archive ........................................................................................13
Chapter 3: Analyze the Data ......................................................................... 15
Analyze Network Data ..................................................................................15
Analyze Host Data .......................................................................................16
Analyze Storage Media .................................................................................16
Chapter 4: Report the Investigation ............................................................. 19
Gather and Organize Information ..................................................................19
Write the Report .........................................................................................20
Chapter 5: Applied Scenario Example ........................................................... 23
Scenario.....................................................................................................23
Assess the Situation ....................................................................................24
Acquire Evidence of Confidential Data Access ..................................................25
Remote Evidence Collection ..........................................................................28
Local Evidence Collection ..............................................................................30
ii Fundamental Computer Investigation Guide For Windows

Analyze Collected Evidence ...........................................................................33

Report the Evidence ....................................................................................36
Applied Scenario Lab Configuration ................................................................37
Deploy Computers and Create Domain .....................................................37
Create Users and Groups ........................................................................37
Create Folders and Files..........................................................................38
Assign Sharing and Permissions ...............................................................39
Configure Auditing .................................................................................39
Appendix: Resources .................................................................................... 41
Preparing Your Organization for a Computer Investigation ................................41
Worksheets and Samples .............................................................................42
Reporting Computer-Related Crimes ..............................................................42
Local Law Enforcement Agencies..............................................................43
Training .....................................................................................................45
Tools .........................................................................................................45
Windows Sysinternals Tools ....................................................................46
Windows Tools ......................................................................................49
Acknowledgments ......................................................................................... 53
Index ............................................................................................................ 55
Overview
Internet connectivity and technological advances expose computers and computer
networks to criminal activities such as unauthorized intrusion, financial fraud, and identity
and intellectual property theft. Computers can be used to launch attacks against
computer networks and destroy data. E-mail can be used to harass people, transmit
sexually explicit images, and conduct other malicious activities. Such activities expose
organizations to ethical, legal, and financial risks and often require them to conduct
internal computer investigations.
This guide discusses processes and tools for use in internal computer investigations. It
introduces a multi-phase model that is based on well-accepted procedures in the
computer investigation community. It also presents an applied scenario example of an
internal investigation in an environment that includes Microsoft® Windows®–based
computers. The investigation uses Windows Sysinternals tools (advanced utilities that
can be used to examine Windows–based computers) as well commonly available
Windows commands and tools.
Some of the policies and procedures invoked in investigations that result from computer
security incidents might also exist in disaster recovery plans. Although such plans are
beyond the scope of this guide, it is important for organizations to establish procedures
that can be used in emergency and disaster situations. Organizations should also identify
and manage security risks wherever possible. For more information, see the Security
Risk Management Guide.

Computer Investigation Model

According to Warren G. Kruse II and Jay G. Heiser, authors of Computer Forensics:
Incident Response Essentials, computer forensics is "the preservation, identification,
extraction, documentation, and interpretation of computer media for evidentiary and/or
root cause analysis." The computer investigation model in the following figure organizes
the different computer forensics elements into a logical flow.

The four investigation phases and accompanying processes in the figure should be
applied when working with digital evidence. The phases can be summarized as follows:
2 Fundamental Computer Investigation Guide For Windows

 Assess the situation. Analyze the scope of the investigation and the action to be
taken.
 Acquire the data. Gather, protect, and preserve the original evidence.
 Analyze the data. Examine and correlate digital evidence with events of interest that
will help you make a case.
 Report the investigation. Gather and organize collected information and write the
final report.
Detailed information about each of the phases is provided in the chapters of this guide.

Initial Decision-Making Process

Before you begin each of the general investigation phases you should apply the initial
decision-making process shown in the following figure.

You should determine whether or not to involve law enforcement with the assistance of
legal advisors. If you determine that law enforcement is needed, then you need to
continue the internal investigation unless law enforcement officials advise you otherwise.
Law enforcement might not be available to assist in the investigation of the incident, so
you must continue to manage the incident and investigation for later submission to law
enforcement.
Depending on the type of incident being investigated, the primary concern should be to
prevent further damage to the organization by those person(s) who caused the incident.
The investigation is important, but is secondary to protecting the organization unless
there are national security issues.
If law enforcement is not involved, your organization may have existing standard
operating procedures and policies that guide the investigation process. Refer to the
"Reporting Computer-Related Crimes" section in Appendix: Resources in this guide for
types of crimes that need to be reported to law enforcement.
Overview 3

Chapter Summary
This guide is comprised of five chapters and an appendix, which are briefly described in
the following list. The first four chapters provide information about the four phases of the
internal investigation process:
 Chapter 1: Assess the Situation explains how to conduct a thorough assessment of
the situation and prepare for the internal investigation.
 Chapter 2: Acquire the Data provides guidance about how to gather digital evidence.
 Chapter 3: Analyze the Data examines the standard techniques of evidence analysis.
 Chapter 4: Report the Investigation explains how to write the investigation outcome
report.
 Chapter 5: Applied Scenario Example describes a fictional scenario that depicts
unauthorized access to confidential information.
 Appendix: Resources includes information about how to prepare for a computer
investigation, contact information for reporting computer-related crimes and obtaining
computer investigation training, worksheets that can be used in computer
investigations, and lists of certain computer investigation tools.

Audience
This guide is intended for IT professionals in the United States who need a general
understanding of computer investigations, including many of the procedures that can be
used in such investigations and protocols for reporting incidents.

Caveats and Disclaimers

This guidance does not constitute legal advice, and is not a substitute for individualized
legal and other advice from legal advisors. You should always consult your legal advisors
before you decide whether to implement any of the described processes. The tools and
technologies described in this guide are current at the time of its release, and may
change in the future.
It is also important to understand that legal restrictions may limit your ability to implement
these procedures. For example, the United States has many laws related to the rights of
people who are suspected of committing illicit acts. Unless legal restrictions are
specifically referenced in existing policies and procedures established by the
organization, it is important that you obtain legally binding written approvals from legal
advisors, management, and key stakeholders throughout the internal investigation.
Note This guide does not include information about incident response policy and procedure
development, specific data imaging product guidance, guidance about building a forensics lab, or
computer investigations in non-Windows environments. For information about incident response
policy and procedure development, see the Microsoft Operations Framework (MOF) Web site.
4 Fundamental Computer Investigation Guide For Windows

References and Credits

The information in this guide is based on information provided by recognized industry
experts and other guidance, including the following publications:
 Forensic Examination of Digital Evidence: A Guide for Law Enforcement by the
National Institute of Justice, an agency of the U.S. Department of Justice.
 Guide to Integrating Forensic Techniques into Incident Response PDF document by
the National Institute of Standards and Technology.
 "RFC3227 - Guidelines for Evidence Collection and Archiving" by D. Brezinski and T.
Killalea.

Style Conventions
This guidance uses the style conventions that are described in the following table.

Element Meaning

Bold font Signifies characters typed exactly as shown, including commands,

switches, and file names. User interface elements also appear in bold.
Italic font Titles of books and other substantial publications appear in italic.
<Italic> Placeholders set in italic and angle brackets <Italic> represent
variables.
Monospace Defines code and script samples.
font

Note Alerts the reader to supplementary information.

Important Alerts the reader to essential supplementary information.

Support and Feedback

The Solution Accelerators – Security and Compliance (SASC) team would appreciate
your thoughts about this and other Solution Accelerators. Please contribute comments
and feedback to [email protected]. We look forward to hearing from you.
Solution Accelerators provide prescriptive guidance and automation for cross-product
integration. They present proven tools and content so you can plan, build, deploy, and
operate information technology with confidence. To view the extensive range of Solution
Accelerators and for additional information, visit the Solution Accelerators page on
Microsoft TechNet.
Chapter 1: Assess the Situation
This chapter describes how to conduct a thorough assessment of the situation, how to
establish scope, and the required resources for an internal investigation. Use the five-
step process shown in the following figure.

Figure 1.1. Assessment phase of the computer investigation model

Notify Decision Makers and Acquire

Authorization
To conduct a computer investigation, you first need to obtain proper authorization unless
existing policies and procedures provide incident response authorization. Then you need
to conduct a thorough assessment of the situation and define a course of action. Use the
following best practices:
 If no written incident response policies and procedures exist, notify decision makers
and obtain written authorization from an authorized decision maker to conduct the
computer investigation.
 Document all actions you undertake that are related to this investigation. Ensure
there is a complete and accurate documented summary of the events and decisions
that occurred during the incident and the incident response. This documentation may
ultimately be used in court to determine the course of action that was followed during
the investigation.
6 Fundamental Computer Investigation Guide For Windows

 Depending on the scope of the incident and absent any national security issues or
life safety issues, the first priority is to protect the organization from further harm.
After the organization is secure, restoration of services (if needed) and the
investigation of the incident are the next priorities.
Decisions you make may be questioned as much as the evidence. Because computer
evidence is complex, different investigations (such as those conducted by an opposing
party) may make different decisions and reach different conclusions.

Review Policies and Laws

At the start of a computer investigation it is important to understand the laws that might
apply to the investigation as well as any internal organization policies that might exist.
Note the following important considerations and best practices:
 Determine if you have legal authority to conduct an investigation. Does your
organization have policies and procedures that address the privacy rights of
employees, contractors, or other persons using your network? Do any such policies
and procedures specify the circumstances in which monitoring is allowed? Many
organizations state in their policies and procedures that there is no expectation of
privacy in the use of the organization's equipment, e-mail, Web services, telephone,
or mail, and that the company reserves the right as a condition of employment to
monitor and search these resources. Such policies and procedures should be
reviewed by the organization's legal advisors, and all employees, contractors, and
visitors should be notified of their existence. If you are uncertain about your authority,
contact your management, your legal advisors, or (if necessary) your local
authorities.
 Consult with your legal advisors to avoid potential issues from improper handling of
the investigation. These issues may include:
 Compromising customers' personal data.
 Violating any state or federal law, such as federal privacy rules.
 Incurring criminal or civil liability for improper interception of electronic
communications. Consider warning banners.
 Viewing sensitive or privileged information. Sensitive data that may compromise
the confidentiality of customer information must only be made available as part of
investigation-related documentation if it directly pertains to the investigation.
 Ensure the following customer privacy and confidentiality issues are addressed:
 All data should be transferred securely, stored on local computers (not network
servers), and should not be easily accessible.
 All data (including documentation) should be maintained for the period specified
by legal advisors or local policy after the computer investigation is closed. If the
data is part of a potential criminal case, consult with the law enforcement agency
investigating the case. If the case is a civil case, consult with your organization's
legal advisors. Also, review any data retention issues related to the Sarbanes-
Oxley Act of 2002 or other legal requirements for data retention.
 Maintain digital copies of evidence, printouts of evidence, and the chain of custody
for all evidence, in case of legal action. Preservation of the chain of custody is
Chapter 1: Assess the Situation 7

accomplished by having verifiable documentation that indicates who handled the

evidence, when they handled it, and the locations, dates, and times of where the
evidence was stored. Secure storage of evidence is necessary, or custody cannot be
verified.

Identify Investigation Team Members

Determining who should respond to an incident is important to conducting a successful
internal computer investigation. Ideally, team membership should be established before
the team is needed for an actual investigation. It is important that investigation teams be
structured appropriately and have the appropriate skills. Your organization could
establish team membership as part of a disaster recovery planning process. Use the
following best practices as guidance for forming an investigation team:
 Identify a person who understands how to conduct an investigation. Remember that
the credibility and skills of the person performing the investigation are often
scrutinized if a situation results in legal proceedings in a court of law.
 Identify team members and clarify the responsibilities of each team member.
 Assign one team member as the technical lead for the investigation. The technical
lead usually has strong technical skills and is experienced in computer investigations.
In investigations that involve suspected parties who are technically skilled, you might
need to select investigation team members who are more skilled than the suspected
parties.
 Keep the investigation team as small as possible to ensure confidentiality and to
protect your organization against unwanted information leaks.
 Engage a trusted external investigation team if your organization does not have
personnel with the necessary skills.
 Ensure that every team member has the necessary clearance and authorization to
conduct their assigned tasks. This consideration is especially important if any third-
party personnel, such as consultants, are involved in the investigation.
Important The volatile nature of digital evidence makes it critical to conduct investigations in a
timely manner. Be sure to secure availability of all team members for the duration of any
investigation.

Conduct a Thorough Assessment

A thorough, clearly documented assessment of the situation is required to prioritize your
actions and justify the resources for the internal investigation. This assessment should
define the current and potential business impact of the incident, identify affected
infrastructure, and obtain as thorough an understanding as possible of the situation. This
information will help you define an appropriate course of action.
Use the following best practices to conduct a thorough assessment:
 Use all available information to describe the situation, its potential severity, potentially
affected parties, and (if available) the suspected party or parties.
 Identify the impact and sensitivity of the investigation on your organization. For
example, assess whether it involves customer data, financial details, health care
8 Fundamental Computer Investigation Guide For Windows

records, or company confidential information. Remember to evaluate its potential

impact on public relations. This assessment will likely be beyond the expertise of IT,
and should be done in conjunction with management and legal advisors.
 Analyze the business impact of the incident throughout the investigation. List the
number of hours required to recover from the incident, hours of downtime, cost of
damaged equipment, loss of revenue, and value of trade secrets. Such an
assessment should be realistic and not inflated. The actual costs of the incident will
be determined at a later date.
 Analyze affected intangible resources, such as future impact on reputation, customer
relationships, and employee morale. Do not inflate the severity of the incident. This
analysis is for informational purposes only to help understand the scope of the
incident. The actual impact will be determined at a later date. This assessment will
likely be beyond the expertise of IT, and should be done in conjunction with
management and legal advisors.
Use the following best practices to identify, analyze, and document the infrastructure and
computers that are affected by the situation. Much of this guidance could have already
been followed as part of a risk assessment process to prepare a disaster recovery plan.
 Identify the network(s) that are involved, the number of computers affected, and the
type of computers affected.
 Obtain the network topology documentation, which should include a detailed network
diagram that provides infrastructure information about servers, network hardware,
firewalls, Internet connections, and other computers on the network.
 Identify external storage devices and any remote computers that should be included.
External storage devices could include thumb drives, memory and flash cards, optical
discs, and magnetic disks.
 Capture the network traffic over a period of time if live analysis is required. This type
of analysis is only needed if you believe there is ongoing suspicious traffic on the
network, and is typically only performed after auditing and logging have been
exhausted as sources of evidence. Microsoft® Windows® XP and Windows Server®
2003 include built-in network capture tools such as Netcap and Rasdiag that can
capture local network traffic without having to install products such as Netmon or
Ethereal. Use tools such as Windows Network Monitor (NetMon) and Windows
Sysinternals TDIMon for network data analysis. Windows Sysinternals tools can be
downloaded from the Windows Sysinternals page on Microsoft TechNet.
Important Network sniffing (capturing network traffic) can be a breach of privacy,
depending on the scope of the capture. You should therefore be very cautious about
deploying network capture tools on your network.

 Use tools to examine the state of software applications and operating systems on
computers that are likely affected. Useful tools for this task include the Windows
application logs, system logs, and Windows Sysinternals PsTools.
 Examine affected file and application servers. Use Windows Sysinternals tools such
as PsTools, PsFile, ShareEnum and internal Windows security logs to examine and
document activity on these servers.
Important Some of the information gathered during this assessment (such as running
processes and data in memory) is captured by your tools in real time. You must ensure that any
records or logs generated are securely stored to prevent losing this volatile data.
Chapter 1: Assess the Situation 9

In addition, the following best practices can help you obtain a complete understanding of
the situation.
 Build a timeline and map everything to it. A timeline is especially important for global
incidents. Document any discrepancies between the date and time of hosts, such as
desktop computers, and the system date and time, such as the Windows Time
service in Windows Server 2003.
 Identify and interview anyone who might be involved in the incident, such as system
administrators and users. In some situations, such people might be external to the
organization. Interviewing users and affected personnel often provides good results
and insights into the situation. Interviews should be conducted by experienced
interviewers.
 Document all interview outcomes. You will need to use them later to fully understand
the situation.
 Retrieve information (logs) from internal and external facing network devices, such as
firewalls and routers, which might be used in the possible attack path.
 Some information, such as IP address and domain name ownership, is often public
by its nature. For example, you can use the Windows Sysinternals Whois tool or the
American Registry for Internet Numbers to identify an owner of an IP address.

Prepare for Evidence Acquisition

To prepare for the Acquire the Data phase, you should ensure that you have properly
determined the actions and outcome of the Assess the Situation phase. A detailed
document containing all information you consider relevant provides a starting point for the
next phase and for the final report preparation. In addition, understand that if the incident
becomes more than just an internal investigation and requires court proceedings, it is
possible that all processes used in gathering evidence might be used by an independent
third party to try and achieve the same results.
Such a document should provide detailed information about the situation and include the
following:
 An initial estimate of the impact of the situation on the organization's business.
 A detailed network topology diagram that highlights affected computer systems and
provides details about how those systems might be affected.
 Summaries of interviews with users and system administrators.
 Outcomes of any legal and third-party interactions.
 Reports and logs generated by tools used during the assessment phase.
 A proposed course of action.
Important Creating consistent, accurate, and detailed documentation throughout the computer
investigation process will help with the ongoing investigation. This documentation is often critical
to the project's success and should never be overlooked. As you create documentation, always be
aware that it constitutes evidence that might be used in court proceedings. Before you begin the
next phase, ensure that you have obtained a responsible decision maker's signoff on the
documentation that you created during the assessment phase.
Chapter 2: Acquire the Data
This chapter discusses how to acquire the data that is necessary for the investigation.
Some computer investigation data is fragile, highly volatile, and can be easily modified or
damaged. Therefore, you need to ensure that the data is collected and preserved
correctly prior to analysis. Use the three-step process shown in the following figure.

Figure 2.1. Acquisition phase of the computer investigation model

Build a Computer Investigation Toolkit

Your organization will need a collection of hardware and software tools to acquire data
during an investigation. Such a toolkit might contain a laptop computer with appropriate
software tools, operating systems and patches, application media, write-protected backup
devices, blank media, basic networking equipment, and cables. Ideally, such a toolkit will
be created in advance, and team members will be familiar with the tools before they have
to conduct an investigation.
Note See the "Preparing Your Organization for a Computer Investigation" and "Tools" sections
of Appendix: Resources in this guide for a list of suggested software tools that can be included in
the computer investigation toolkit and for guidelines to follow when building a toolkit.

Collect the Data

Data collection of digital evidence can be performed either locally or over a network.
Acquiring the data locally has the advantage of greater control over the computer(s) and
data involved. However, it is not always feasible (for example, when computers are in
locked rooms or other locations, or when high availability servers are involved). Other
factors, such as the secrecy of the investigation, the nature of the evidence that must be
gathered, and the timeframe for the investigation will ultimately determine whether the
evidence is collected locally or over the network.
12 Fundamental Computer Investigation Guide For Windows

Important When using tools to collect data, it is important to first determine whether or not a
rootkit has been installed. Rootkits are software components that take complete control of a
computer and conceal their existence from standard diagnostic tools. Because rootkits operate at
a very low hardware level, they can intercept and modify system calls. You cannot find a rootkit
by searching for its executable, because the rootkit removes itself from the list of returned search
results. Port scans do not reveal that the ports the rootkit uses are open, because the rootkit
prevents the scanner from detecting the open port. Therefore, it is difficult to ensure that no
rootkits exist. One available tool you can use is the Microsoft® Windows® Sysinternals
RootkitRevealer.

When acquiring data over a network, you need to consider the type of data to be
collected and the amount of effort to use. Consider what data you need to obtain that
would support the prosecution of the offending parties. For example, it might be
necessary to acquire data from several computers through different network connections,
or it might be sufficient to copy a logical volume from just one computer.
The recommended data acquisition process is as follows:
1. Create accurate documentation that will later allow you to identify and authenticate
the evidence you collect. Ensure that you note any items of potential interest and log
any activities that might be of importance later in the investigation. Key to a
successful investigation is proper documentation, including information such as the
following:
 Who performed the action and why they did it. What were they attempting to
accomplish?
 How they performed the action, including the tools they used and the procedures
they followed.
 When they performed the action (date and time) and the results.
2. Determine which investigation methods to use. Typically, a combination of offline and
online investigations is used.
 In offline investigations, additional analysis is performed on a bit-wise copy of the
original evidence. (A bit-wise copy is a complete copy of all the data from the
targeted source, including information such as the boot sector, partition, and
unallocated disk space.) You should use the offline investigation method
whenever possible because it mitigates the risk of damaging the original
evidence. However, this method is only suitable for situations in which an image
can be created, so it cannot be used to gather some volatile data.
 In an online investigation, analysis is performed on the original live evidence. You
should be especially careful when performing online analysis of data because of
the risk of altering evidence that might be required to prove a case.
3. Identify and document potential sources of data, including the following:
 Servers. Server information includes server role, logs (such as event logs), files,
and applications.
 Logs from internal and external facing network devices, such as firewalls,
routers, proxy servers, network access servers (NAS), and intrusion detection
systems (IDS) that may be used in the possible attack path.
 Internal hardware components, such as network adapters (which include media
access control (MAC) address information) and PCMCIA cards. Also note
external port types, such as Firewire, USB, and PCMCIA.
Chapter 2: Acquire the Data 13

 Storage devices that need to be acquired (internal and external), including hard
disks, network storage devices, and removable media. Don’t forget portable
mobile devices such as PocketPC, Smartphone devices, and MP3 players such
as Zune™.
4. When you must capture volatile data, carefully consider the order in which you collect
the data. Volatile evidence can be easily destroyed. Information such as running
processes, data loaded into memory, routing tables, and temporary files can be lost
forever when the computer is shut down. Information about tools and commands that
can help gather this information is available in the "Tools" section of Appendix:
Resources in this guide.
5. Use the following methods to collect data from storage media and record storage
media configuration information:
 If you need to remove any internal storage devices, turn off the computer first.
However, before you turn off the computer you should verify that all volatile data
has been captured whenever possible.
 Determine whether to remove the storage device from the suspect computer and
use your own system to acquire the data. It may not be possible to remove the
storage device because of hardware considerations and incompatibilities.
Typically, you would not disconnect storage devices such as RAID devices,
storage devices with a hardware dependency (for example, legacy equipment),
or devices in network storage systems such as storage area networks (SANs).
 Create a bit-wise copy of the evidence in a backup destination, ensuring that the
original data is write-protected. Subsequent data analysis should be performed
on this copy and not on the original evidence. Step-by-step guidance for imaging
is beyond the scope of this guide but is an integral part of evidence collection.
Important Use industry accepted tools when acquiring a bit-wise copy. For example,
EnCase by Guidance Software or FTK by AccessData.

 Document internal storage devices and ensure that you include information about
their configurations. For example, note the manufacturer and model, jumper
settings, and the size of the device. In addition, note the type of interface and the
condition of the drive.
6. Verify the data you collect. Create checksums and digital signatures when possible to
help establish that the copied data is identical to the original. In certain circumstances
(for example, when a bad sector exists on the storage media) it may be impossible to
create a perfect copy. Ensure that you have obtained the best copy possible with the
available tools and resources. You can use the Microsoft File Checksum Integrity
Verifier (FCIV) tool to compute an MD5 or SHA1 cryptographic hash of the content of
a file.

Store and Archive

When evidence is collected and ready for analysis, it is important to store and archive the
evidence in a way that ensures its safety and integrity. You should follow any storage and
archival procedures that exist within your organization.
Best practices for data storage and archival include the following:
 Physically secure and store the evidence in a tamperproof location.
14 Fundamental Computer Investigation Guide For Windows

 Ensure that no unauthorized personnel has access to the evidence, over the network
or otherwise. Document who has physical and network access to the information.
 Protect storage equipment from magnetic fields. Use static control storage solutions
to protect storage equipment from static electricity.
 Make at least two copies of the evidence you collected, and store one copy in a
secure offsite location.
 Ensure that the evidence is physically secured (for example, by placing the evidence
in a safe) as well as digitally secured (for example, by assigning a password to the
storage media).
 Clearly document the chain of custody of the evidence. Create a check-in / check-out
list that includes information such as the name of the person examining the evidence,
the exact date and time they check out the evidence, and the exact date and time
they return it. A sample Worksheet - Chain of Custody Log Documentation
document is included with the worksheets referenced in Appendix: Resources in this
guide.
Chapter 3: Analyze the Data
This chapter discusses different approaches and well-accepted industry best practices for
analyzing the evidence that is gathered during the Acquire the Data phase of an internal
investigation. Use the three-step process shown in the following figure.

Figure 3.1. Analysis phase of the computer investigation model

Important Online analysis of data, which examines a computer directly while it is running, is
often necessary. Online analysis is typically performed because of time constraints on an
investigation or to capture volatile data. You should be especially careful when performing online
analysis to ensure that you minimize the risk to other evidence.

Analyze Network Data

In many investigations it is not necessary to analyze network data. Instead, the
investigations focus on and examine images of the data. When network analysis is
required, use the following procedure:
1. Examine network service logs for any events of interest. Typically, there will be large
amounts of data, so you should focus on specific criteria for events of interest such
as username, date and time, or the resource being accessed.
2. Examine firewall, proxy server, intrusion detection system (IDS), and remote access
service logs. Many of these logs contain information from monitored incoming and
outgoing connections and include identifying information, such as IP address, time of
the event, and authentication information. You might want to examine the log data in
a tool that is suited for data analysis, such as Microsoft® SQL Server™ 2005.
3. View any packet sniffer or network monitor logs for data that might help you
determine the activities that took place over the network. In addition, determine
whether connections you examine are encrypted—because you will not be able to
read the contents of an encrypted session. However, you can still derive the time of
16 Fundamental Computer Investigation Guide For Windows

the connection and whether a suspected party established a session with a specific
server.

Analyze Host Data

Host data includes information about such components as the operating system and
applications. Use the following procedure to analyze the copy of the host data you
obtained in the Acquire the Data phase.
1. Identify what you are looking for. There will likely be a large amount of host data, and
only a portion of that data might be relevant to the incident. Therefore, you should try
to create search criteria for events of interest. For example, you might use the
Microsoft Windows® Sysinternals Strings tool to search the files located in the
\Windows\Prefetch folder. This folder contains information such as when and where
applications were launched. For information about how to use the Strings tool and
send or pipe the results to a text file, see Chapter 5: Applied Scenario Example in this
guide.
2. Examine the operating system data, including clock drift information, and any data
loaded into the host computer's memory to see if you can determine whether any
malicious applications or processes are running or scheduled to run. For example,
you can use the Windows Sysinternals AutoRuns tool to show you what programs
are configured to run during the boot process or login.
3. Examine the running applications, processes, and network connections. For
example, you can look for running processes that might have an appropriate name
but are running from non-standard locations. Use tools such as Windows
Sysinternals ProcessExplorer, LogonSession, and PSFile to perform these tasks.
See the "Tools" section in Appendix: Resources of this guide for information about
these tools.

Analyze Storage Media

The storage media you collected during the Acquire the Data phase will contain many
files. You need to analyze these files to determine their relevance to the incident, which
can be a daunting task because storage media such as hard disks and backup tapes
often contain hundreds of thousands of files.
Identify files that are likely to be relevant, which you can then analyze more closely. Use
the following procedure to extract and analyze data from the storage media you collected:
1. Whenever possible, perform offline analysis on a bit-wise copy of the original
evidence.
2. Determine whether data encryption was used, such as the Encrypting File System
(EFS) in Microsoft Windows. Several registry keys can be examined to determine
whether EFS was ever used on the computer. For a list of the specific registry keys,
see the "Determining If EFS is Being Used on a Machine" section in the article
"Encrypting File System in Windows XP and Windows Server 2003" on Microsoft
TechNet. If you suspect data encryption was used, then you need to determine
whether or not you can actually recover and read the encrypted data. Your ability to
do so will depend upon different circumstances, such as the version of Windows,
whether or not it is a domain-joined computer, and how EFS was deployed. For more
Chapter 3: Analyze the Data 17

information about EFS see "The Encrypting File System" on Microsoft TechNet.
External EFS recovery tools are also available, such as Advanced EFS Data
Recovery by Elcomsoft.
3. If necessary, uncompress any compressed files and archives. Although most forensic
software can read compressed files from a disk image, you might need to
uncompress archive files to examine all files on the media you are analyzing.
4. Create a diagram of the directory structure. It might be useful to graphically represent
the structure of the directories and files on the storage media to effectively analyze
the files.
5. Identify files of interest. If you know which files were affected by the security incident,
you can focus the investigation on these files first. The hash sets created by the
National Software Reference Library can be used to compare well-known files (such
as operating system and application files) to the originals. Those files that match can
normally be eliminated from the investigation. You can also use informational sites
such as filespecs.com, Wotsit's Format, ProcessLibrary.com, and Microsoft DLL Help
to help you categorize and collect information about existing file formats as well as to
identify files.
6. Examine the registry, the database that contains Windows configuration information,
for information about the computer boot process, installed applications (including
those loaded during startup), and login information such as username and logon
domain. For registry background information and detailed descriptions of registry
content, see the Windows Server 2003 Resource Kit Registry Reference. Various
tools are available for analyzing the registry, including RegEdit, which ships with the
Windows operating system, Windows Sysinternals RegMon for Windows, and
Registry Viewer by AccessData.
7. Search the contents of all gathered files to help identify files that may be of interest.
Various intelligent searches can be performed using tools described in the "Tools"
section in Appendix: Resources of this guide. For example, you can use the Windows
Sysinternals Streams tool to reveal whether there are any NTFS alternate data
streams used on files or folders. NTFS alternate data streams can hide information
within a file by causing it to appear to contain zero bytes of data when viewed
through Windows Explorer although the file actually contains hidden data.
8. Study the metadata of files of interest, using tools such as Encase by Guidance
Software, The Forensic Toolkit (FTK) by AccessData, or ProDiscover by Technology
Pathways. File attributes such as timestamps can show the creation, last access, and
last written times, which can often be helpful when investigating an incident.
9. Use file viewers to view the content of the identified files, which allow you to scan and
preview certain files without the original application that created them. This approach
protects files from accidental damage, and is often more cost effective than using the
native application. Note that file viewers are specific to each type of file; if a viewer is
not available, use the native application to examine the file.
After you analyze all of the available information, you may be able to reach a conclusion.
However, it is important to be very cautious at this stage and ensure that you do not
blame the wrong party for any damages. However, if you are certain of your findings, you
will be ready to begin the Report the Investigation phase.
Chapter 4: Report the Investigation
This chapter discusses how to organize the information that you gather and the
documentation that you create throughout a computer investigation, as well as how to
write a final report. Use the two-step process shown in the following figure.

Figure 4.1. Reporting phase of the computer investigation model

Gather and Organize Information

During the initial phases of a computer investigation you create documentation about the
specific activities in each phase. From within this documentation you need to identify the
specific information that is relevant to your investigation and organize it into appropriate
categories. Use the following procedure to gather and organize the required
documentation for the final report.
1. Gather all documentation and notes from the Assess, Acquire, and Analyze phases.
Include any appropriate background information.
2. Identify parts of the documentation that are relevant to the investigation.
3. Identify facts to support the conclusions you will make in the report.
4. Create a list of all evidence to be submitted with the report.
5. List any conclusions you wish to make in your report.
6. Organize and classify the information you gather to ensure that a clear and concise
report is the result. Reference the following "Write the Report" section and Sample -
Internal Investigation Report.doc (in Appendix: Resources in this guide) to help
organize the information.
20 Fundamental Computer Investigation Guide For Windows

Write the Report

After you organize the information into appropriate categories, you can use it to write the
final report. It is critical to the outcome of the investigation that the report is clear,
concise, and written for the appropriate audience.
The following list identifies recommended report sections and information that should be
included in these sections.
 Purpose of Report. Clearly explain the objective of the report, the target audience,
and why the report was prepared.
 Author of Report. List all authors and co-authors of the report, including their
positions, responsibilities during the investigation, and contact details.
 Incident Summary. Introduce the incident and explain its impact. The summary
should be written so that a non-technical person such as a judge or jury would be
able to understand what occurred and how it occurred.
 Evidence. Provide descriptions of the evidence that was acquired during the
investigation. When describing evidence state how it was acquired, when, and who
acquired it.
 Details. Provide a detailed description of what evidence was analyzed and the
analysis methods that were used. Explain the findings of the analysis. List the
procedures that were followed during the investigation and any analysis techniques
that were used. Include proof of your findings, such as utility reports and log entries.
Justify each conclusion that is drawn from the analysis. Label supporting documents,
number each page, and refer to them by label name when they are discussed in the
analysis. For example, "Firewall log from server, supporting document D." Also,
provide information about those individuals who conducted or were involved with the
investigation. If applicable, provide a list of witnesses.
 Conclusion. Summarize the outcome of the investigation. The conclusion should be
specific to the outcome of the investigation. Cite specific evidence to prove the
conclusion, but do not provide excessive detail about how the evidence was obtained
(such information should be in the "Details" section). Include justification for your
conclusion, along with supporting evidence and documentation. The conclusion
should be as clear and unambiguous as possible. In many cases, it will be stated
near the beginning of the report, because it represents the actionable information.
 Supporting documents. Include any background information referred to throughout
the report, such as network diagrams, documents that describe the computer
investigation procedures used, and overviews of technologies that are involved in the
investigation. It is important that supporting documents provide enough information
for the report reader to understand the incident as completely as possible. As
mentioned earlier, label each supporting document with letters and number each
page of the document. Provide a complete list of supporting documents.
 If it is likely that the report will be presented to a varied audience, consider
creating a glossary of terms used in the report. A glossary is especially valuable
if the law enforcement agency is not knowledgeable about technical issues or
when a judge or jury needs to review the documents.
Note During an investigation you will likely collect valuable information about the use of
computer investigation processes. You might also gain experience and a better understanding of
Chapter 4: Report the Investigation 21

operational and security-related procedures. You should review your existing operational and
incident response documentation and incorporate the knowledge you gain during an
investigation. If you do not have such documentation or wish to adopt an industry standard
format, you can use the Microsoft® Operations Framework (MOF) documentation templates and
guidance. For more information about MOF visit the Microsoft Operations Framework home page.
Chapter 5: Applied Scenario Example
This scenario depicts unauthorized access to internal confidential information within a
national financial institution—Woodgrove Bank. The scenario is fictional, as are the
people and the organizations mentioned in the scenario.
The scenario was designed to provide an overview of tools and technologies used for
data collection and examination. In a real security breach situation, you should consult
with appropriate management, legal, and law enforcement groups for advice about the
appropriate investigative techniques to use. Also, although the authors recognize that
imaging a suspect drive is important in investigative work, it is beyond the scope of this
guide and only briefly mentioned during the data acquisition phase of the scenario.

Scenario
It has been brought to the attention of Ray Chow, the Enterprise Systems Administrator
of Woodgrove National Bank, that someone was bragging about knowing the salary of
many different bank employees. Ray learned the name of the employee who claimed to
know this information—Mike Danseglio. Mike works in the loan department and should
not have access to any Human Resources (HR) files.
Woodgrove National Bank has a policy that relates to the proper use of bank computers.
This policy states that there is no expectation of privacy when using company computers
for any purpose, including e-mail services and access to Web sites. The policy also
states that no programs will be loaded on any computers without the written permission
of the IT Director, and that any attempts to circumvent passwords or obtain unauthorized
access to bank files will be grounds for termination or legal prosecution. The policy also
allows the IT staff to install any network monitoring devices, including sniffers or other
packet capture devices, to maintain network security or to investigate possible abuses.
Ray wants to ensure that he uses accepted computer investigation procedures to
investigate this issue and report his findings. Ray believes that information might have
been originally obtained from the HR file server and plans to follow the four-phase
computer investigation model shown in the following figure:

Figure 5.1. Computer investigation model overview

24 Fundamental Computer Investigation Guide For Windows

Important See the "Applied Scenario Lab Configuration" section at the end of this chapter for
information about how to emulate this scenario and follow along using the tools.

Assess the Situation

Ray meets with management to assess the situation. Management indicates that
unauthorized access to and distribution of confidential payroll information would be
grounds for termination, but they will not prosecute an employee for such actions.
Woodgrove National Bank policy states that management will consult with the internal
legal department to check local laws and determine whether any other policies affect
investigations about improper employee access to restricted computer systems.
The Woodgrove National Bank legal department provides written permission for Ray to
examine the contents of Mike Danseglio’s company computer. The legal and
management teams ask to be informed of the investigation outcome. They also ask Ray
to follow up with steps to protect sensitive data more effectively in the future if he finds
that a breach occurred.
Ray's first task is to identify the computers that are involved in the investigation and
document the hardware configuration for each. After he completes this task, Ray draws a
logical diagram of the involved computers, which is shown in the following figure.

Figure 5.2. Logical diagram of computers involved in the investigation

Ray then considers different options for proceeding with the investigation. Because some
of the information he needs to acquire is volatile data, Ray decides to begin the internal
computer investigation by analyzing live data. He will then make an image of Mike
Danseglio’s drive and examine the static evidence.
Ray creates a USB drive that includes the appropriate investigative tools for a live
investigation. (The "Tools" section in Appendix: Resources in this guide describes the
tools that are referenced in this chapter.)
Ray's next task is to duplicate the suspected party's hard disk in a way that protects and
preserves the evidence if he locates information that requires him to report the case to
law enforcement.
Chapter 5: Applied Scenario Example 25

Ray notes items of potential interest, documents what is needed to be able to identify and
authenticate the collected evidence later in the investigation, and creates an audit log of
actions performed during the investigation.

Acquire Evidence of Confidential Data

Access
Woodgrove National Bank management authorized Ray to examine the directory
structure on the HR file server (WNB-HQ-FS1) and the payroll files to determine whether
an unauthorized individual read the files. Ray could go to Mike Danseglio’s computer
immediately and look for evidence, or he could begin at the server and try to locate
evidence in the audit logs. Ray also wants to know what user rights Mike Danseglio has
with regard to the HR folders.
Ray decides to use the following two-step approach to acquire the evidence:
1. Examine the HR file server to look for evidence of unauthorized access to
confidential files and folders. This examination may or may not confirm
management’s suspicion that Mike Danseglio accessed these files without proper
authorization.
2. Examine the contents of Mike Danseglio’s drive locally and remotely to look for any
confidential data. Ray plans to use a combination of native Microsoft® Windows®
tools (including Ipconfig, Systeminfo, and Netstat) and Windows Sysinternals tools
(including AccessChk, PsLoggedOn, and PsFile).
Ray interviews HR team members and examines the file server. He notes that payroll
files are summarized once each month in spreadsheet files that are kept in the
HR\Internal\Payroll folder. The HR MGRS group is the only group that should have read
or write permissions to this folder, and Mike Danseglio is not a member of this group. Ray
needs to determine whether it is possible for someone to access the HR Department
folder that contains the salary information for bank employees.
Ray views the event logs for the HR file server. He previously configured auditing on the
HR\Internal folder so that he could track access failures and successes. Ray notes all the
steps he takes to open and view the Security event log.
Several entries in the event log stand out, such as the one shown in the following screen
shot. A few entries indicate that a mdanseglio user account accessed the
HR\Internal\Payroll\090806PR-A139.xls file.
26 Fundamental Computer Investigation Guide For Windows

Figure 5.3. Security event log entries that indicate user account mdanseglio
accessed the 090806PR-A139.xls file in the HR\Internal\Payroll folder

First, Ray creates new \evidence and \tools folders on the USB drive. To ensure the
integrity of the evidence files he creates, Ray will perform an MD-5 cryptographic hash on
any files he copies from Mike’s computer to the evidence folder.
MD-5 cryptographic hashes are created by running an algorithm on a file to create a
unique 128-bit “fingerprint” of the contents of the file. If someone questions the integrity of
the data collected by Ray (for example, to imply the file may have been edited at a later
time), Ray can provide the original MD-5 checksum value for comparison and validation.
Ray exports the log set to a USB drive that is labeled HR01. He will use this same USB
drive for all his evidence collection.
Note Connecting a USB drive to a Windows–based computer adds an entry to the Setupapi.log
file and alters the following registry key:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Storage\RemovableMedia

Ray decides to determine what permissions are assigned to the HR\Internal folder by
running the Windows Sysinternals AccessChk tool on the server. This tool shows what
permissions the specified user or group has to files, registry keys, or Windows services.
Ray runs the tool from his USB drive, which appears as drive F:, by typing the following
at a command prompt:
f:\tools>accesschk mdanseglio c:\hr\internal
Chapter 5: Applied Scenario Example 27

Note The Sysinternals AccessChk tool requires an installation process and will leave a footprint
on the local drive in the following registry key:
HKEY_CURRENT_USER\Software\Sysinternals\AccessChk

Ray notes that the mdanseglio user account has read and write permissions to the
\Benefits, \Payroll, and \Reviews subfolders under \HR\Internal as shown in the following
screen shot:

Figure 5.4. AccessChk results that indicate user account mdanseglio has read and
write permissions to the HR\Internal subfolders

Ray suspects that errors in the configuration of the HR server permissions allowed Mike
Danseglio to access the HR\Internal folder. Ray spends a few minutes investigating Mike
Danseglio’s user rights and notices that he is a member of a group called branch01mgrs.
This group has read and write permissions to the HR\Internal folders.
Ray wants to know whether Mike Danseglio is currently logged on to any servers on the
network. Ray uses PsLoggedOn, a tool that displays locally logged on users as well as
users who are logged on through resources to either the local computer or a remote one.
Ray inserts his USB stick into his computer and types the following at the command
prompt:
f:\tools>psloggedon mdanseglio

The results, shown in the following screen shot, indicate that Mike Danseglio is logged
onto WNB-HQ-FS1 at this time.

Figure 5.5. Psloggedon results indicating that user account mdanseglio is logged
on to WNB-HQ-FS1

Ray removes Mike Danseglio from the branch01mgrs group and rechecks his user rights
to the HR\Internal folder.
After further review of the Security event logs and the results of AccessChk to look for
other possible incorrect permission configurations to the HR\Internal folder, Ray begins
investigating the contents of Mike Danseglio’s computer using remote investigative
techniques.
28 Fundamental Computer Investigation Guide For Windows

Remote Evidence Collection

Ray decides to gather information remotely from Mike Danseglio’s computer before he
tries to gather information locally, and he comes into the office during a weekend to make
a forensically sound copy of Mike’s hard disk. In an actual situation, Ray might perform
his entire forensics investigation on a hard disk image of the suspected party's computer.
However, this scenario depicts the use of tools and techniques to gather volatile evidence
locally and remotely.
Ray uses a USB drive connected to his own computer that contains numerous tools. The
USB drive will store all evidence that he collects as well as a text file record of all
commands he types.
Ray uses the following basic procedure, which allows him to mark the time his
examination starts, collect the evidence from Mike Danseglio’s computer across the
network, record all his investigatory steps, and create an MD5 hash of the evidence he
collects.
Important Some Sysinternals tools, including PsExec, PsFile, and PsLogList, are blocked by the
default Windows Firewall configuration. To follow along with this applied example and use these
tools to examine what information can be gathered across the network, you need to click the
Exceptions tab in Windows Firewall and enable File and Printer Sharing. However, you do
NOT need to share anything.
On target computers that have Windows Firewall enabled and File and Printer Sharing disabled
(the default setting), the Systeminfo, Ipconfig, Arp, Netstat, Schtasks, PsFile, PsList, and
PsLogList tools must be run directly on the target computer. In such a case, run each of these
tools directly on the target system and pipe the results to the evidence2.txt file created in the
"Local Evidence Collection" section later in this chapter.

1. Access the USB drive.

Ray accesses the USB drive and the \tools folder that contains his command-line
tools (including PsExec and the File Checksum Integrity Validator (FCIV) tool).
j:
cd tools

2. Note the examination start date and time.

Ray pipes the results of the date and time commands to record the start time of his
investigation into a new mdevidence.txt file that is created in the \evidence folder on
his USB drive. (Ray will obtain the system time on Mike Danseglio’s computer in step
3.) In addition, Ray looks for any discrepancy between the BIOS date and time and
the actual date and time.
date /t > j:\evidence\mdevidence.txt
time /t >> j:\evidence\mdevidence.txt

3. Obtain basic information about the target computer.

Ray runs a series of native Windows commands to obtain information about Mike’s
computer.
j:
cd tools
Chapter 5: Applied Scenario Example 29

psexec \\hqloan164 systeminfo >> j:\evidence\mdevidence.txt

psexec \\hqloan164 ipconfig /all >> j:\evidence\mdevidence.txt
psexec \\hqloan164 arp -a >> j:\evidence\mdevidence.txt
psexec \\hqloan164 netstat -b >> j:\evidence\mdevidence.txt
psexec \\hqloan164 schtasks >> j:\evidence\mdevidence.txt

Note PsExec gathers information remotely by using services that are already on the target
computer, such as Cmd and Ipconfig. PsExec can also be used to load services across the
network to run on the target computer. Ray does not want to install any applications on
Mike’s computer—he only runs services that are supported by the Windows XP operating
system on Mike's computer.

4. Run remote tools that use local application programming interfaces (APIs).
Ray now runs several tools to determine whether other computers have files open on
Mike’s computer, the processes that are running on the computer, and to obtain the
System and Security event logs from the computer.
psfile \\hqloan164 >> j:\evidence\mdevidence.txt
pslist -t \\hqloan164 >> j:\evidence\mdevidence.txt
psloglist -s \\hqloan164 >> j:\evidence\mdevidence.txt
psloglist -s sec \\hqloan164 >> j:\evidence\mdevidence.txt

 PsFile shows files opened remotely. This tool uses remote Windows APIs and
does not need to be loaded on the target computer.
 PsList shows information about running processes and threads on a computer.
This tool uses remote Windows APIs and does not need to be loaded on the
target computer.
 PsLogList dumps the contents of the computer's Event log by default—no
additional parameter is needed. Ray runs this command with the sec parameter
to obtain the Security event log.
5. Create a record of all tasks.
Windows automatically tracks all the commands that are executed at a command
prompt. Ray uses the Doskey command to capture this record and pipes the history
information into a file called mdevidence-doskey.txt.
doskey /h > j:\evidence\mdevidence-doskey.txt

6. Perform an MD5 checksum on the evidence files.

Ray uses the FCIV tool to perform an MD5 checksum on the evidence files.
fciv j:\evidence\mdevidence.txt >>
j:\evidence\md5mdevidence.txt

Notes Display limitations might cause the preceding command to display on more than one
line. It should be entered as a single line at the command prompt.
The FCIV tool computes and verifies cryptographic hash values. This tool is available through
Microsoft Knowledge Base article 841290, "Availability and description of the File Checksum
Integrity Verifier utility."
30 Fundamental Computer Investigation Guide For Windows

Ray wants to remotely review the folders on Mike Danseglio’s computer. To do so, he
uses PsExec to open a command prompt on Mike's computer. At the command prompt,
Ray enters the following commands:
psexec \\hqloan164 cmd
cd c:\documents and settings\mdanseglio\my documents
dir /s

Although all users are required to keep documents on the network server, Ray notices
that Mike Danseglio has a Personal folder on his computer. This folder includes a
spreadsheet and a \xxxpixset subfolder.
After remotely reviewing the folders on Mike's computer, Ray is ready to report his
findings and move to Mike’s computer to investigate locally.
Jill Shrader, the HR Department Manager, calls Ray on his cell phone and asks about the
status of Ray’s investigation. Ray explains that he has collected the following information:
 Mike Danseglio's user account had read and write permissions to the HR\Internal
folder because he was mistakenly added to the branch01mgrs group, which has
permissions to that folder and its subfolders.
 Mike's computer has a Personal folder on its hard disk that contains at least one
spreadsheet.
 Mike's computer contains two unauthorized programs that enable him to monitor
network traffic and scan the network for services and computers.
 Mike's computer has a large collection of image files on its hard disk that Ray
suspects are pornographic images.

Local Evidence Collection

Ideally, computer investigations should be conducted on hard disk images. In this
example, however, Ray runs a series of tools directly on Mike Danseglio’s computer.
These tools are run from a USB drive and do not require installation on the local
computer. However, as mentioned earlier in this chapter, the insertion of the USB drive
will leave a footprint in the registry.
Important If Mike Danseglio’s computer had Windows Firewall enabled with File and Printer
Sharing disabled, Ray would run the Systeminfo, Ipconfig, Arp, Netstat, Schtasks, PsFile, PsList,
and PsLogList tools locally on Mike’s computer. Ray would enter the commands listed in the
"Remote Evidence Collection" section earlier in this chapter but remove the reference to
\\hqloan164 before piping the results to the evidence2.txt file he creates in this section.

Ray plans to perform the following tasks on Mike’s computer:

 Search the drive for evidence of confidential files.
 Acquire copies of any suspect files.
 Examine the files.
Ray logs on to Mike’s computer using the Administrator account to access Mike’s
personal folder. Ray uses the following basic procedure after he connects the evidence
collection USB drive to Mike’s computer:
Chapter 5: Applied Scenario Example 31

1. Access Mike Danseglio’s Personal folder.

Ray accesses Mike's Personal folder with the following commands.
c:
cd "documents and settings\mdanseglio\my documents\personal"

2. Note examination start date and time.

Ray pipes the results of the Date and Time commands to record the start time of his
investigation. He pipes the results into a new mdevidence2.txt file that is created in
the \evidence folder on the USB drive.
date /t > f:\evidence\mdevidence2.txt
time /t >> f:\evidence\mdevidence2.txt

Note The USB drive is designated as drive F: on Mike’s computer.

3. Acquire directory structure information.

Ray uses the Dir command to examine the contents of Mike’s Personal folder. First,
Ray pipes the results to the screen to view the results and notices a spreadsheet file
and the \xxxpixset folder. Then Ray pipes the results of the Dir command to the
evidence file using three different parameters: /tc to show creation time, /ta to show
last accessed time and /tw to show last written time.
dir /ta >> f:\evidence\mdevidence2.txt
dir /tc >> f:\evidence\mdevidence2.txt
dir /tw >> f:\evidence\mdevidence2.txt

4. Access the USB drive.

Ray accesses the USB drive and the \tools folder that contains his command-line
tools.
f:
cd tools

5. Gather Mike Danseglio's file information.

Ray uses the Du utility to examine the contents of Mike Danseglio’s My Documents
folder and any subfolders. He uses the –l 5 parameter to search to a depth of five
folders. First, Ray examines the results on the screen (shown in the following screen
shot) before he pipes the evidence to the mdevidence2.txt file.
du –l 5
du –l 5 >> f:\evidence\mdevidence2.txt
32 Fundamental Computer Investigation Guide For Windows

Figure 5.6. Results of running the Du utility

6. Copy suspect files to the \evidence_files folder.

Although Ray created an image of Mike Danseglio’s entire drive, he decides to copy
the files in Mike Danseglio’s Personal folder to a new folder named evidence_files
that he creates on the USB drive. He will examine the folder and files during the
analysis process.
Note Ray obtained a copy of the original file during the imaging process. He can perform a
hash on the original file found on the live drive if he wishes to compare this file to the copy
of the file on his USB drive.

Ray uses the Xcopy command with the /s parameter to copy subfolders, the /e
parameter to copy subfolders even if they are empty, the /k parameter to retain the
read-only attribute on destination files if present on the source files, and the /v
parameter to verify each file as it is written to the destination file to make sure that the
destination files are identical to the source files.
f:
md evidence_files
c:
cd \documents and settings\mdanseglio\my documents\personal
xcopy *.* f:\evidence_files /s /e /k /v

7. Examine the contents of the Recycle Bin.

Ray quickly reviews the contents of the Recycle Bin on Mike Danseglio's computer,
which contains numerous deleted files as shown in the following figure. Ray knows
the drive image process obtained a copy of these files if he wants to review the files
later. After he notes the contents of the Recycle Bin, Ray is ready to review the
evidence he collected remotely and locally.
Chapter 5: Applied Scenario Example 33

Figure 5.7. Several image files located in the Recycle Bin

Analyze Collected Evidence

Ray has two evidence files: mdevidence.txt and mdevidence2.txt. He also has a copy
of Mike Danseglio’s Personal folder. Ray uses the following procedure on his own
computer to analyze the information contained in these files.
1. Analyze the process information.
Ray reviews the mdevidence.txt file. The results of PsList are very interesting,
because they indicate that Mike Danseglio is running some unauthorized
applications, including Wireshark and nMapWin, as shown in the following screen
shot.
Ray knows it is not unusual to find unrelated violations when performing an
investigation on a suspect computer. Ray also understands that not all applications
will be easily recognized (such as the ones listed in this scenario) and that it is also
possible they were installed without Mike's knowledge.
34 Fundamental Computer Investigation Guide For Windows

Figure 5.8. Results of running Pslist on Mike Danseglio's computer

2. Access the USB drive.

Ray accesses the USB drive and the \tools folder that contains his command-line
tools.
j:
cd tools

3. Look for suspect strings in the spreadsheet file.

Ray looks for the string “confidential” in his copies of the files from Mike’s Personal
folder. To do so, he uses the Find command with the /I parameter (this parameter
ignores the case of characters when searching for the string) and the /c parameter
(this parameter provides the number of lines that contain the string).
First, Ray pipes the results to the screen. It appears that the 090806PR-A139.xls file
contains a match, as shown in the following screen shot. Therefore Ray runs the
command a second time to pipe the results to an mdevidence-review.txt file.
j:
cd \evidence_files
find /i /c "confidential" *.*
find /i /c "confidential" *.* > j:\evidence\mdevidence-
review.txt

Note Display limitations might cause the preceding command to display on more than one
line. It should be entered as a single line at the command prompt.
Chapter 5: Applied Scenario Example 35

Figure 5.9. Results of the search for “confidential,” found in 090806PR-

A139.XLS

4. Ray first copies 090806PR-A139.xls to the \evidence_files folder and then uses the
Strings tool to list ASCII and Unicode strings contained in the spreadsheet file.
strings j:\evidence_files\090806PR-A139.xls

The results (shown in the following screen shot) indicate that the spreadsheet file
contains payroll information. Ray runs the Strings tool again and pipes the results into
his mdevidence-review.txt file.
strings j:\evidence_files\090806PR-A139.XLS >>
j:\evidence\mdevidence-review.txt

Note Display limitations might cause the preceding command to display on more than one
line. It should be entered as a single line at the command prompt.
36 Fundamental Computer Investigation Guide For Windows

Figure 5.10. Results of running the Strings utility on the spreadsheet file

Ray feels confident that he has located an unauthorized copy of an HR payroll file on
Mike Danseglio’s computer.

Report the Evidence

Ray analyzes and correlates the evidence and then writes a report that summarizes his
findings. A sample report is available in the materials that accompany this guide, which
are referenced in the "Worksheets" section of Appendix: Resources In his report, Ray
includes recommendations for securing confidential data from future breaches. Ray also
performs data integrity checking on the evidence files and then stores the files
appropriately by burning them and the final report to a CD.
Ray’s report includes the following information:
 Purpose of Report. The report's purpose is to advise Woodgrove Bank
management about the incident and state how the results of the investigation can be
used to prevent future security breaches.
 Author of Report. Ray identifies himself, provides his title, and states that he
performed technical lead responsibilities.
 Incident Summary. This section lists the initial suspicions and the business impact
of the incident.
 Evidence. This section includes the list of running processes, the personal directory
found on Mike Danseglio's computer, the explicit images that were found, the list of
unacceptable applications that were running, and the location of a confidential file
that contains payroll information.
Chapter 5: Applied Scenario Example 37

 Analysis. This section includes the results of the local and remote investigations,
which prove that sexually explicit images were downloaded, permissions were
incorrectly configured, and a confidential file that contains payroll information was
accessed.
 Conclusion. This section summarizes the outcome of the investigation and includes
recommendations to avoid similar incidents in the future.
 Supporting documents. This section includes network diagrams and a list of the
computer investigation procedures and technologies used in the investigation.
After submitting his report, Ray waits for the authorization to perform additional
investigatory steps or whatever other actions management might want him to perform.
Note Every investigation may be different. You should use tools that are appropriate for the
required task and that help you obtain the information you seek, but it is always a good idea to
gather more evidence than you might need.

Applied Scenario Lab Configuration

To emulate this applied scenario in a test lab environment, you will need to complete the
following steps:
1. Deploy computers and create an Active Directory® directory service domain.
2. Create users and groups in Active Directory.
3. Create folders and files on specific computers.
4. Assign sharing and permissions.
5. Configure auditing.

Deploy Computers and Create Domain

The following table lists the computers and operating systems you will need:
Table 5.1. Computers and Operating Systems Used in the Applied Scenario Lab
Computer name Operating system
WNB-HQ-DC Windows Server® 2003 R2
WNB-HQ-FS1 Windows Server 2003 R2
HQ-IT-PC10 Windows XP Professional SP2
HQLOAN164 Windows XP Professional SP2

After you install the operating system on each computer, run Dcpromo on WNB-HQ-DC
to install Active Directory and DNS.

Create Users and Groups

The following table lists the groups and users that need to be defined in the Active
Directory Users and Computers Microsoft Management Console (MMC):
38 Fundamental Computer Investigation Guide For Windows

Table 5.2. Groups and Users Referenced in the Applied Scenario Lab
Groups Users
Enterprise System Administrator Ray Chow
Domain Admins Ray Chow
HR MGRS Jenny Gottfried, Roland Winkler, Jill Shrader
Branch01Mgrs Mike Danseglio, Nuria Gonzalez

On the file server WNB-HQ-FS1, the Domain Admins group is added as a member of the
local Administrators group.

Create Folders and Files

The following table lists device names, directory structures, and included files that you
will need:
Table 5.3. Devices, Folders, and Files Used in the Applied Scenario Lab
Device Folders Files
(computer or
USB stick)
WNB-HQ-FS1 \HR\Internal\Benefits 090806PR-A139.xls
(file server)
\HR\Internal\Payroll (This folder contains all
SysInternal tools and the FCIV
\HR\Internal\Review
tool as listed in the "Tools"
\Tools section in Appendix:
Resources.)
HQLOAN164 \Documents and 090806PR-A139.xls
(Mike Settings\mdanseglio\My
(This folder contains several
Danseglio's Documents\Personal
.jpg files that include xxx as
computer)
\Documents and part of the file name. Several
Settings\mdanseglio\My xxx*.* files were deleted from
Documents\Personal\xxxpixset this folder and reside in the
Recycle Bin.)
HQ-IT-PC10 \Tools (This folder contains all
(Ray Chow's SysInternal tools and the FCIV
computer) tool as listed in the "Tools"
section in Appendix:
Resources.)
USB stick (Ray \Evidence (This folder contains all
Chow's USB SysInternal tools and the FCIV
\Evidence_Files
stick) tool as listed in the "Tools"
\Tools section in Appendix:
Resources.)
Chapter 5: Applied Scenario Example 39

Assign Sharing and Permissions

The following table lists the file folders and share permissions that are needed for file
server WNB-HQ-FS1:
Table 5.4. Folders and Share Permissions in the Applied Scenario Lab
Folder Share permissions
\HR Branch01Mgrs (Full Control, Change, Read)
HR MGRS (Full Control, Change, Read)
\Tools Not shared; only for local use by users who have administrative credentials on
the server.

Configure Auditing
On the domain controller WNB-HQ-DC, the Audit object access policy is configured to
audit both Success and Failure. This configuration is set through the Domain Security
Policy MMC and the Domain Controller Security Policy MMC.
On the file server WNB-HQ-FS1, auditing is configured for the Domain Users group on
the \HR\Internal folder. To achieve this configuration, right-click the folder and select
Properties, Security, Advanced, and then Auditing. Then enter the Domain Users
group.
Appendix: Resources
This appendix provides information about various resources that you can use to conduct
a computer investigation.

Preparing Your Organization for a Computer

Investigation
To prepare your organization for an internal computer investigation, you should assemble
a readily available computer investigation toolkit that includes software and devices you
can use to acquire evidence. Such a toolkit might contain a laptop computer with
appropriate software tools, different operating systems and patches, application media,
backup devices, blank media, basic networking equipment, and cables. Preparing this
toolkit can be an ongoing task as you find the need for various tools and resources,
depending upon the investigations you need to conduct.
Use the following guidelines when building and using a computer investigation toolkit:
 Decide which tools you plan to use before you start the investigation. In addition to
the Microsoft® Windows® Sysinternals and other Windows tools discussed in this
document, the toolkit will typically include dedicated computer forensics software,
such as Encase by Guidance Software, The Forensic Toolkit (FTK) by AccessData,
or ProDiscover by Technology Pathways.
 Ensure that you archive and preserve the tools. You might need a backup copy of the
computer investigation tools and software that you use in the investigation to prove
how you collected and analyzed data.
 List each operating system that you will likely examine, and ensure you have the
necessary tools for examining each of them. For example, you can use Windows
Sysinternals tools (described later in this appendix) such as PsInfo, PsLogList, and
ProcessExplorer to examine computers that run Windows XP and Windows Server®
2003.
 Include a tool to collect and analyze metadata.
 Include a tool for creating bit-to-bit and logical copies.
 Include tools to collect and examine volatile data, such as the system state. Some
examples from Windows Sysinternals include ListDLLs, LogonSessions, PendMoves,
Autoruns, and ProcessExplorer. Windows tools include Systeminfo, Ipconfig, Netstat,
and Arp.
 Include a tool to generate checksums and digital signatures on files and other data,
such as the File Checksum Integrity Validator (FCIV) tool. This tool is available
through Microsoft Knowledge Base article 841290, Availability and description of the
File Checksum Integrity Verifier utility.
 If you need to collect physical evidence, include a digital camera in the toolkit.
In addition, ensure that your toolkit meets the following criteria:
42 Fundamental Computer Investigation Guide For Windows

 Data acquisition tools are shown to be accurate. Proving accuracy is generally easier
if you use well-known computer forensics software.
 The tools do not modify the access time of files.
 The examiner's storage device is forensically sterile, which means the disk drive
does not contain any data, before it is used. You can determine whether a storage
device is forensically sterile by running a checksum on the device. If the checksum
returns all zeros, it does not contain any data.
 The examiner's hardware and tools are used only for the computer investigation
process and not other tasks.

Worksheets and Samples

The following table provides a list of worksheets and samples you can use during your
computer investigation. Some of these resources are available as separate Word
documents, and are included in the Microsoft Download Center file from which you
extracted this guide. Others are available through a link to the Web site of the National
Institute of Justice.
Table A.1. Worksheets and Samples
Document Name Location

Worksheet - Chain of Link to the Fundamental Computer Investigation Guide for

Custody Log Windows on the Microsoft Download Center
Documentation.doc
Worksheet - Impact
Analysis.doc
Sample - Internal
Investigation Report.doc
Computer Evidence Appendix C. Sample Worksheets in Forensic Examination
of Digital Evidence: A Guide for Law Enforcement by the
Hard Drive Evidence
National Institute of Justice, an agency of the U.S.
Removable Media Department of Justice.

Reporting Computer-Related Crimes

Note Much of the information in this section is from the Reporting Computer, Internet-Related,
or Intellectual Property Crime page in the Computer Crime & Intellectual Property Section of the
United States Department of Justice Web site.

You should first consult with your legal advisors to determine whether it is necessary to
report specific computer-related crimes to appropriate authorities at the local, state,
federal, or international level, depending on the scope of the crime. Most likely, your local
or state authorities would be the first ones to contact. If it is a computer-related federal
crime, then you might need to report the crime to local offices of federal law enforcement.
As noted earlier, this guidance is only intended for use in the United States.
Appendix: Resources 43

United States law enforcement agencies that investigate Internet-related crime include
the following:
 Federal Bureau of Investigation (FBI)
 United States Secret Service (USSS)
 U.S. Immigration and Customs Enforcement (ICE)
 U.S. Postal Inspection Service
 Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF)
 U.S. Drug Enforcement Administration (DEA)
These agencies have offices throughout the United States, and contact information is
available in local telephone directories or through Internet searches. Generally, federal
crimes can be reported by telephoning the local office of an appropriate law enforcement
agency and requesting the Duty Complaint Agent. If the organization has joined the
Electronic Crimes Task Force (ECTF), InfraGard, or the International High Technology
Crime Investigation Association (HTCIA), then the appropriate contact person may
already be known. Contacting someone who is known and knows your organization
simplifies the reporting process.
Many agencies have trained agents who specialize in computer hacker cases.

Local Law Enforcement Agencies

In some situations, the best choice is to contact a local law enforcement agency. Such
agencies or high technology crimes task forces might have trained personnel who can
investigate an incident. Agencies that have trained personnel include the REACT Task
Force, which serves the San Francisco Bay area, the CATCH Team, which serves the
San Diego region, and other police agencies.
Information in the following table can help you determine which federal agency to contact
for certain types of crime.
Table A.2. Law Enforcement Agencies for Different Types of Crime
Type of crime Appropriate agencies
Child exploitation and Internet fraud U.S. Postal Inspection Service
matters that have a mail nexus
Internet Crime Complaint Center
Child pornography or exploitation Local police agency
Your local FBI office
If imported, U.S. Immigration and Customs
Enforcement
Internet Crime Complaint Center
44 Fundamental Computer Investigation Guide For Windows

Type of crime Appropriate agencies

Computer intrusion (hacking) Your local FBI office
United States Secret Service
Internet Crime Complaint Center
Local high technology crimes task force or
police agency
Copyright (software, movie, sound Your local FBI office
recording) piracy
If imported, U.S. Immigration and Customs
Enforcement
Internet Crime Complaint Center
Local high technology crimes task force or
police agency
Counterfeiting of currency United States Secret Service
Identity theft or theft of customer data Your local FBI office
Unites States Secret Service (Financial Crimes
Division)
FTC Consumer Complaint Form
Internet Crime Complaint Center
Local high technology crimes task force or
police agency
Internet bomb threats Your local FBI office
Local ATF field division office
Local high technology crimes task force or
police agency
Internet fraud and SPAM Your local FBI office
United States Secret Service (Financial Crimes
Division)
FTC Consumer Complaint Form
If securities fraud or investment-related SPAM
e-mail, SEC Center for Complaints and
Informant Tips
Internet Crime Complaint Center
Local high technology crimes task force or
police agency
Appendix: Resources 45

Type of crime Appropriate agencies

Internet harassment Your local FBI office
Local high technology crimes task force or
police agency
Password trafficking Your local FBI office
United States Secret Service
Internet Crime Complaint Center
Local high technology crimes task force or
police agency
Theft of trade secrets Your local FBI office
Local high technology crimes task force or
police agency
Trademark counterfeiting Your local FBI office
If imported, U.S. Immigration and Customs
Enforcement
Internet Crime Complaint Center
Local high technology crimes task force or
police agency
Trafficking in explosive or incendiary Your local FBI office
devices or firearms over the Internet
Local ATF field division office

Training
Have at least some incident response team members attend formal computer
investigation training. Without relevant training, it is unlikely that the team will be effective
in the investigation. In fact, unskilled examiners could negatively affect the investigation
by accidentally destroying volatile evidence.
For a list of nonprofit agencies, organizations, Federal law enforcement agencies, and
academic institutions that provide computer forensic training, see "Appendix G. Training
Resources List" in Forensic Examination of Digital Evidence: A Guide for Law
Enforcement by the National Institute of Justice, an agency of the U.S. Department of
Justice.

Tools
Every investigation will likely be different. The tools you use should be appropriate for
obtaining the information you seek, but it is always a good idea to gather more evidence
than you might need.
46 Fundamental Computer Investigation Guide For Windows

This section provides information about the Windows Sysinternals tools and other
Windows tools that can help you conduct an internal computer investigation. Tool types
are represented by icons in the first column of the following table:
Table A.3. Tool Types
Icon Description
This icon represents a command-line tool.

This icon represents a tool with a GUI interface that requires installation and
alters the target drive.

The following tables provide information about numerous tools that you can use in
computer investigations.

Windows Sysinternals Tools

Table A.4. Windows Sysinternals Tools Information
Tool Name Description
type

AccessChk v2.0 Display access to files, registry keys, or Windows services

by the user or group you specify.

AccessEnum Display who has access to which directories, files, and

v1.3 registry keys on a computer. Use it to find places where
permissions aren't properly applied.

Autoruns v8.53 Display programs that are configured to start up

automatically when a computer boots and a user logs in
(also displays the full list of registry and file locations where
applications can configure auto-start settings).
Autorunsc v8.53 The command-line version of the Autoruns program
(described in the previous entry).

Diskmon Capture all hard disk activity. Acts like a software disk
activity light in your system tray.

DiskView Graphical disk sector utility; disk viewer.

Appendix: Resources 47

Tool Name Description

type

Du v1.3 Display disk usage by directory.

Filemon v7.03 Display all file system activity in real-time.

Handle v3.2 Display open files and the process that opened those files.

ListDLLs v2.25 Display all the DLLs that are currently loaded, including
where they are loaded and their version numbers (prints the
full path names of loaded modules).

LogonSessions List active logon sessions

v1.1

PendMoves v1.1 Display file rename and delete commands that will be
executed the next time the computer is started.

Portmon v3.02 Display serial and parallel port activity (will also show a
portion of the data being sent and received).

Process Explorer Display files, registry keys, and other objects that processes
v10.2 have open, which DLLs they have loaded, owners of
processes, etc.

PsExec v1.72 Execute processes remotely.

PsFile v1.01 Display open files.

PsInfo v1.71 Display information about a computer.

48 Fundamental Computer Investigation Guide For Windows

Tool Name Description

type

PsList v1.27 Display information about processes and threads.

PsLoggedOn Display users logged on to a computer.

v1.32

PsLogList v2.63 Dump event log records.

PsService v2.2 View and control services.

Regmon v7.03 Display all registry activity in real time.

RootkitRevealer Scan for rootkit–based malware.

ShareEnum v1.6 Scan file shares on a network and view their security
settings to eliminate improperly applied settings.

Streams v1.53 Reveal NTFS alternate data streams.

Strings v2.3 Search for ANSI and UNICODE strings in binary images.

TCPVcon v2.34 Display active sockets.

TCPView v2.4 Display all open TCP and UDP endpoints and the name of
the process that owns each endpoint.
Appendix: Resources 49

Tool Name Description

type

TDIMon v1.01 Display TCP/IP information.

Tokenmon v1.01 Display security-related activity, including logon, logoff,

privilege usage, and impersonation.

Windows Tools
Table A.5. Windows Tools Information
Tool Name Description
type

Arp Display Address Resolution Protocol (ARP) tables.

Date Display current date setting.

Dir Display a list of files and subdirectories.

Doskey Display command history for an open CMD.EXE shell.

Ipconfig Display local computer configuration.

Net Update, fix, or view the network or network settings.

Netstat Display protocol statistics and current connection information.

Time Display current time setting.

50 Fundamental Computer Investigation Guide For Windows

Tool Name Description

type

Find Search file(s) to find a string.

Schtasks Display scheduled tasks.

Systeminfo Provide general information about the computer.

Vol Display the disk volume label and serial number, if they exist.

Hostname Display the host name portion of the full computer name of the
computer.

Openfiles Query, display, or disconnect open files or files opened by network

users.

FCIV File Checksum Integrity Verifier. Use to compute a MD5 or SHA1

cryptographic hash of the content of a file.

Notepad Use to examine metadata associated with a file.

Reg Use to view, modify, export, save or delete, registry keys, values,
and hives.

Netcap Gather network trace information from the command line.

Sc Use to communicate with the Service Controller and services. (Sc

query is useful for dumping all services and their states.)

Assoc View or modify file name extension associations.

Appendix: Resources 51

Tool Name Description

type

Ftype View or modify file types used in file name extension associations.

Gpresult Determine resulting set of policies.

Tasklist List running processes and loaded modules.

MBSA Determine security patch status and other known vulnerabilities.

Rsop.msc Show resulting set of policies.

Rasdiag Collect diagnostic information about remote services and place

that information in a file.
Acknowledgments
The Solution Accelerators - Security and Compliance group (SA-SC) would like to
acknowledge and thank the team that produced the Fundamental Computer Investigation
Guide for Windows. The following people were either directly responsible or made a
substantial contribution to the writing, development, and testing of this solution.
Authors, Contributors, and Writers
Valentine Boiarkine - Wadeware LLC
Ross Carter
Laura Chappell - Protocol Analysis Institute
Paul Cullimore
Thomas Quilty - BD Consulting and Investigations, Inc.
Paul Slater - Wadeware LLC
Ken Stavinoha
Editor
Steve Wacker - Wadeware LLC
Reviewers
John Addeo - Dimension Data
Technical Sergeant Eric Apple - Washington State Patrol
Curt Bryson - Washington Mutual
Harlan Carvey - Windows Forensics and Incident Recovery
Fred Cotton - Defense Computer Investigations Training Program
Stacia L. Jackson - Lockheed Martin Information Technology
Detective Sergeant Scott Jarmon - Washington State Patrol
Mark Menz - Digital Evidence Scientist
Mike Menz - Hewlett Packard
Martin Novak - National Institute of Justice
John Redd VII – Infinite Consulting
James Sibley - Deputy District Attorney, County of Santa Clara, CA
Detective Todd Taylor - Washington State Patrol
Reviewers (Microsoft)
Shawn Aebi, Kate Baroni, Rich Benack, Christopher Budd, Derick Campbell,
Chase Carpenter, Tom Cloward, Jason Cooper, Greg Cottingham, Mike Danseglio,
54 Fundamental Computer Investigation Guide For Windows

Charles Denny, Karl Grunwald, John Howie, Christopher Johnsen, Lesley Kipling,
Troy Larson, Mark Miller, Bob McCoy, Craig Nelson, Sanjay Pandit,
Alexandre Hollanda Silva, Mike Smith-Lonergan
Product Managers
Alain Meeus
Jim Stuart
Program Manager
Vlad Pigin
Release Manager
Karina Larson
Testers
Gaurav Singh Bora
Thammarai Selvi Rajendran - Infosys Technologies Ltd.
Vijayanand Senniappan - Infosys Technologies Ltd.
Index

-A- -F-
AccessData, 13, 17, 41 File Checksum Integrity Verifier (FCIV), 13, 28, 29,
38, 41, 50
AccessEnum, 46
Filemon, 47
Acquire the data, 2, 3, 5, 9, 11, 15, 16, 19, 25, 30,
31 Find, 34, 50
Analyze the data, 2, 3, 8, 15, 16, 19, 33 Firewall, 20, 28, 30
Arp, 28, 30, 41, 49
Assess the situation, 2, 3, 5, 7, 9, 19, 24
Autoruns, 41, 46
-G-
Autorunsc, 46 Guidance Software, 13, 17, 41

-B- -H-
Handle, 47
BIOS, 28
Hostname, 50

-C-
Cryptographic hash, 13, 28, 29, 50
-I-
Intrusion detection system (IDS), 12, 15
Ipconfig, 25, 28, 29, 30, 41, 49
-D-
Date, 31, 49
Dir, 31, 49
-L-
Documentation, 14, 42 ListDLLs, 41, 47

Doskey, 29, 49 LogonSessions, 41, 47

Du, 31, 32, 47

-N-
-E- Net, 49
Netstat, 25, 28, 30, 41, 49
EFS (Encrypting File System), 16
Encase, 17, 41
Encryption, 16 -O-
Online analysis, 15
Openfiles, 50
56 Fundamental Computer Investigation Guide For Windows

-P- Sysinternals, 8, 16, 17, 25, 27, 28, 29, 30, 31, 32,
33, 35, 36, 41, 46, 47, 48, 49

Packet sniffer, 8 Systeminfo, 25, 28, 30, 41, 50

PendMoves, 41, 47 Systinernals, 41, 46

Portmon, 47
ProcessExplorer, 16, 41
-T-
PsExec, 28, 29, 30, 47
TCPVcon, 48
PsFile, 8, 25, 28, 29, 30, 47
TCPView, 48
PsInfo, 41, 47
TDIMon, 8, 49
PsList, 28, 29, 30, 33, 48
The Forensic Toolkit, 17, 41
PsLoggedOn, 25, 27, 48
Time, 9, 31, 49
PsLogList, 28, 29, 30, 41, 48
Tokenmon, 49
PsService, 48
Tools, 8, 11, 12, 13, 16, 17, 24, 25, 27, 28, 38, 39,
PsTools, 8 41, 45, 46, 49
Training, 45, 53

-R-
Regmon, 48 -V-
Report the investigation, 2 Vol, 50

-S- -W-
Schtasks, 28, 30, 50 Windows Command Line Tools, 9, 25, 28, 29, 30,
ShareEnum, 8, 48 31, 34, 41, 49, 50

Streams, 17, 48 Windows Network Monitor (NetMon), 8

Strings, 16, 35, 36, 48