windows forensic analysis dvd toolkit

363_Web_App_FM.qxd 12/19/06 10:46 AM Page ii
www.syngress.com
Syngress is committed to publishing high-quality books for IT Professionals and
delivering those books in media and formats that fit the demands of our cus-
tomers. We are also committed to extending the utility of the book you pur-
chase via additional materials available from our Web site.
SOLUTIONS WEB SITE
To register your book, visit www.syngress.com/solutions. Once registered, you
can access our Web pages. There you may find an assort-
ment of value-added features such as free e-books related to the topic of this
book, URLs of related Web sites, FAQs from the book, corrections, and any
updates from the author(s).
ULTIMATE CDs
Our Ultimate CD product line offers our readers budget-conscious compilations
of some of our best-selling backlist titles in Adobe PDF form. These CDs are the
perfect way to extend your reference library on key topics pertaining to your
area of expertise, including Cisco Engineering, Microsoft Windows System
Administration, CyberCrime Investigation, Open Source Security, and Firewall
Configuration, to name a few.
DOWNLOADABLE E-BOOKS
For readers who can’t wait for hard copy, we offer most of our titles in down-
loadable Adobe PDF form. These e-books are often available weeks before hard
copies, and are priced affordably.
SYNGRESS OUTLET
Our outlet store at syngress.com features overstocked, out-of-print, or slightly
hurt books at significant savings.
SITE LICENSING
Syngress has a well-established program for site licensing our e-books onto
servers in corporations, educational institutions, and large organizations. Contact
us at for more information.

CUSTOM PUBLISHING
Many organizations welcome the ability to combine parts of multiple Syngress
books, as well as their own content, into a single volume for their own internal
use. Contact us at for more information.
Visit us at
423_Win_Foren_FM.qxd 3/26/07 1:08 PM Page i
423_Win_Foren_FM.qxd 3/26/07 1:08 PM Page ii
Harlan Carvey
Windows
Forensic
Analysis
DVD Toolkit
423_Win_Foren_FM.qxd 3/26/07 1:08 PM Page iii
Elsevier, Inc., the author(s), and any person or firm involved in the writing, editing, or production (collec-
tively “Makers”) of this book (“the Work”) do not guarantee or warrant the results to be obtained from
the Work.
There is no guarantee of any kind, expressed or implied, regarding the Work or its contents.The Work is
sold AS IS and WITHOUT WARRANTY.You may have other legal rights, which vary from state to
state.
In no event will Makers be liable to you for damages, including any loss of profits, lost savings, or other
incidental or consequential damages arising out from the Work or its contents. Because some states do not
allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation
may not apply to you.
You should always use reasonable care, including backup and other appropriate precautions, when working
with computers, networks, data, and files.
Syngress Media®, Syngress®,“Career Advancement Through Skill Enhancement®,” “Ask the Author
UPDATE®,” and “Hack Proofing®,” are registered trademarks of Elsevier, Inc.“Syngress:The Definition
of a Serious Security Library”™, “Mission Critical™,” and “The Only Way to Stop a Hacker is to Think
Like One™” are trademarks of Elsevier, Inc. Brands and product names mentioned in this book are trade-
marks or service marks of their respective companies.

KEY SERIAL NUMBER
001 HJIRTCV764
002 PO9873D5FG
003 829KM8NJH2
004 BPOQ48722D
005 CVPLQ6WQ23
006 VBP965T5T5
007 HJJJ863WD3E
008 2987GVTWMK
009 629MP5SDJT
010 IMWQ295T6T
PUBLISHED BY
Syngress Publishing, Inc.
Elsevier, Inc.
30 Corporate Drive
Burlington, MA 01803
Windows Forensic Analysis DVD Toolkit
Copyright © 2007 by Elsevier, Inc.All rights reserved. Printed in the United States of America. Except as
permitted under the Copyright Act of 1976, no part of this publication may be reproduced or distributed
in any form or by any means, or stored in a database or retrieval system, without the prior written per-
mission of the publisher, with the exception that the program listings may be entered, stored, and executed
in a computer system, but they may not be reproduced for publication.
Printed in the United States of America
1 2 3 4 5 6 7 8 9 0
ISBN 10: 1-59749-156-X
ISBN 13: 978-1-59749-156-3
Publisher: Amorette Pedersen Project Manager: Gary Byrne
Acquisitions Editor: Andrew Williams Page Layout and Art: Patricia Lupien
Technical Editors: Jesse Kornblum, Dave Kleiman Copy Editor: Darlene Bordwell
Cover Designer: Michael Kavish Indexer: Michael Ferreira

For information on rights, translations, and bulk sales, contact Matt Pedersen, Commercial Sales Director
and Rights, at Syngress Publishing; email m.peder

423_Win_Foren_FM.qxd 3/26/07 1:08 PM Page iv
To Te r r i
423_Win_Foren_FM.qxd 3/26/07 1:08 PM Page v
423_Win_Foren_FM.qxd 3/26/07 1:08 PM Page vi
vii
Author Acknowledgments
First, I’d like to thank God for the many blessings He’s given me in my life, for
which I am immensely and eternally grateful. My life has been a wonderful
bounty since I accepted Jesus into my heart and my life.
I’d like to thank the love and light of my life,Terri, and her beautiful
daughter, Kylie, for their patience and understanding in supporting me while I
wrote a second book (as if the first one wasn’t enough!). I know that I’ve left
them both wondering as I’ve stared off into space, reasoning and turning over
phrases in my mind as I attempted put them down on “paper.” It can’t be easy
for either of these two wonderful women to be living with a nerd.
I’d also like to thank a number of other people for their contributions, both
big and small, to this effort. Jesse Kornblum deserves a special thanks, not only
for being the technical editor for this book but also for being a friend and
sounding board for a number of ideas—many of which have been off the wall.
I’d also like to thank Jesse for his many contributions to the field of computer
forensics, from his FRED disk to his hashing tools to the many papers that he’s
authored. I’d like to thank Cory Altheide, as he was the one who approached
me with the idea of tracking artifacts left on Windows systems by the use of
USB removable storage devices. I’d like to thank Andreas Schuster for his many
current and future contributions to the field, including the area of Windows
memory analysis. Others who have contributed to the field, and hence this
book, in one way or another include Aaron Walters, the coauthor of FATKit;

Bill Harback, General Dynamics—Advanced Information Systems; George M.
Garner, Jr., President, GMG Systems, Inc.; Detective Richard F. McQuown,
Milwaukee Police Department; Detective Jon Evans, Gwent Police Hi-Tech
Crime Unit; and Don Lewis, Computer Forensic Analyst for the Lakewood,
CO, Police Department.
423_Win_Foren_FM.qxd 3/26/07 1:08 PM Page vii
423_Win_Foren_FM.qxd 3/26/07 1:08 PM Page viii
ix
Lead Author
Harlan Carvey (CISSP), author of the acclaimed Windows Forensics
and Incident Recovery, is a computer forensics and incident response
consultant based out of the Northern VA/Metro DC area. He cur-
rently provides emergency incident response and computer forensic
analysis services to clients throughout the U.S. His specialties
include focusing specifically on the Windows 2000 and later plat-
forms with regard to incident response, Registry and memory anal-
ysis, and post-mortem computer forensic analysis. Harlan’s
background includes positions as a consultant performing vulnera-
bility assessments and penetration tests and as a full-time security
engineer. He also has supported federal government agencies with
incident response and computer forensic services.
Harlan holds a bachelor’s degree in electrical engineering from
the Virginia Military Institute and a master’s degree in electrical
engineering from the Naval Postgraduate School.
Harlan would like to thank his wife,Terri, for her support,
patience, and humor throughout the entire process of writing his
second book.
423_Win_Foren_FM.qxd 3/26/07 1:08 PM Page ix
x
Jesse D. Kornblum is a Principal Computer Forensics Engineer

with ManTech SMA. He currently develops new computer forensics
tools and techniques for members of the Intelligence Community.
Based in the Washington, DC, area, he has pioneered several areas of
the field, including automated incident response, fuzzy hashing, and
Windows memory analysis. In addition, he is the author of several
widely used computer forensics tools, such as md5deep and fore-
most. Jesse currently sits on the Editorial Board for the journal
Digital Investigation and is a major contributor to the ForensicsWiki
Project. His background includes serving as a Computer Crime
Investigator with the U.S.Air Force Office of Special Investigations.
Dave Kleiman (CAS, CCE, CIFI, CISM, CISSP, ISSAP, ISSMP,
MCSE) has worked in the information technology security sector
since 1990. Currently, he is the owner of SecurityBreach
Response.com and is the Chief Information Security Officer for
Securit-e-Doc, Inc. Before starting this position, he was Vice
President of Technical Operations at Intelliswitch, Inc., where he
supervised an international telecommunications and Internet service
provider network. Dave is a recognized security expert. A former
Florida Certified Law Enforcement Officer, he specializes in com-
puter forensic investigations, incident response, intrusion analysis,
security audits, and secure network infrastructures. He has written
several secure installation and configuration guides about Microsoft
technologies that are used by network professionals. He has devel-
oped a Windows operating system lockdown tool, S-Lok (www.s-
doc.com/products/slok.asp ), which surpasses NSA, NIST, and
Microsoft Common Criteria Guidelines.
Dave was a contributing author to Microsoft Log Parser Toolkit
(Syngress Publishing, ISBN: 1-932266-52-6). He is frequently a
speaker at many national security conferences and is a regular
Technical Editors

423_Win_Foren_FM.qxd 3/26/07 1:08 PM Page x
xi
contributor to many security-related newsletters, Web sites, and
Internet forums. Dave is a member of several organizations,
including the International Association of Counter Terrorism and
Security Professionals (IACSP), International Society of Forensic
Computer Examiners® (ISFCE), Information Systems Audit and
Control Association® (ISACA), High Technology Crime
Investigation Association (HTCIA), Network and Systems
Professionals Association (NaSPA),Association of Certified Fraud
Examiners (ACFE),Anti Terrorism Accreditation Board (ATAB), and
ASIS International®. He is also a Secure Member and Sector Chief
for Information Technology at The FBI’s InfraGard® and a Member
and Director of Education at the International Information Systems
Forensics Association (IISFA).
Troy Larson is a Senior Forensic Engineer in Microsoft’s Network
Security team, where he enjoys analyzing Microsoft’s newest tech-
nologies in a constant race to keep forensics practice current with
Microsoft technology.Troy is a frequent speaker on forensics issues
involving Windows and Office, and he is currently focused on
developing forensic techniques for Vista and Office 2007. Prior to
joining Microsoft’s forensics team,Troy served tours of duty with
Ernst & Young’s national forensics practice and Attenex, Inc.Troy is
member of the Washington State Bar and received his undergrad-
uate and law degrees from the University of California at Berkeley.
Technical Reviewer
423_Win_Foren_FM.qxd 3/26/07 1:08 PM Page xi
423_Win_Foren_FM.qxd 3/26/07 1:08 PM Page xii
xiii
Contents

Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xix
Chapter 1 Live Response: Collecting Volatile Data . . . . . . 1
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2
Live Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2
Locard’s Exchange Principle . . . . . . . . . . . . . . . . . . . . . .4
Order of Volatility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6
When to Perform Live Response . . . . . . . . . . . . . . . . . . .8
What Data to Collect . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10
System Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12
Logged-on Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14
Psloggedon . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14
Net Sessions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14
Logonsessions . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15
Open Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16
Network Information (Cached NetBIOS Name Table) . .17
Network Connections . . . . . . . . . . . . . . . . . . . . . . . . . .18
Netstat . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19
Process Information . . . . . . . . . . . . . . . . . . . . . . . . . . . .21
Tlist . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23
Tasklist . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24
Pslist . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24
Listdlls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24
Handle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .25
Process-to-Port Mapping . . . . . . . . . . . . . . . . . . . . . . . .28
Netstat . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .28
Fport . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .29
Openports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .30
Process Memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31
Network Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .32
Ipconfig . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .32

Promiscdetect and Promqry . . . . . . . . . . . . . . . . . . .32
Clipboard Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . .35
Service/Driver Information . . . . . . . . . . . . . . . . . . . . . .36
423_Win_Foren_TOC.qxd 3/26/07 1:05 PM Page xiii
xiv Contents
Command History . . . . . . . . . . . . . . . . . . . . . . . . . . . .38
Mapped Drives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .39
Shares . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .40
Nonvolatile Information . . . . . . . . . . . . . . . . . . . . . . . . . .40
Registry Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .41
ClearPageFileAtShutdown . . . . . . . . . . . . . . . . . . . . .41
DisableLastAccess . . . . . . . . . . . . . . . . . . . . . . . . . . .41
AutoRuns . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .42
Event Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .45
Devices and Other Information . . . . . . . . . . . . . . . . . . .46
A Word about Picking Your Tools… . . . . . . . . . . . . . . . .46
Live-Response Methodologies . . . . . . . . . . . . . . . . . . . . . . .48
Local Response Methodology . . . . . . . . . . . . . . . . . . . .48
Remote Response Methodology . . . . . . . . . . . . . . . . . .50
The Hybrid Approach . . . . . . . . . . . . . . . . . . . . . . . . . .52
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .56
Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .56
Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .59
Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . .61
Chapter 2 Live Response: Data Analysis. . . . . . . . . . . . . . 63
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .64
Data Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .64
Example Case 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .67
Example Case 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .71
Agile Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .75

Expanding the Scope . . . . . . . . . . . . . . . . . . . . . . . . . . .78
Reaction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .80
Prevention . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .82
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .84
Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .84
Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .85
Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . .86
Chapter 3 Windows Memory Analysis . . . . . . . . . . . . . . . 87
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .88
A Brief History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .88
423_Win_Foren_TOC.qxd 3/26/07 1:05 PM Page xiv
Contents xv
Dumping Physical Memory . . . . . . . . . . . . . . . . . . . . . . . .89
Hardware Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . .90
FireWire . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .90
Crash Dumps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .92
Virtualization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .94
Hibernation File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .96
DD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .96
Analyzing a Physical Memory Dump . . . . . . . . . . . . . . . . . .99
Process Basics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .100
EProcess Structure . . . . . . . . . . . . . . . . . . . . . . . . .100
Process Creation Mechanism . . . . . . . . . . . . . . . . . .102
Parsing Memory Contents . . . . . . . . . . . . . . . . . . . . . .103
Lsproc.pl . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .104
Lspd.pl . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .107
Parsing Process Memory . . . . . . . . . . . . . . . . . . . . . . .109
Extracting the Process Image . . . . . . . . . . . . . . . . . . . .111
Memory Dump Analysis and the Page File . . . . . . . . . .114
Determining the Operating System of a Dump File . . .115

Pool Allocations . . . . . . . . . . . . . . . . . . . . . . . . . . . . .117
Collecting Process Memory . . . . . . . . . . . . . . . . . . . . . . . .117
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .120
Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .120
Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .122
Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .123
Chapter 4 Registry Analysis . . . . . . . . . . . . . . . . . . . . . . . 125
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .126
Inside the Registry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .127
Registry Structure within a Hive File . . . . . . . . . . . . . .130
The Registry As a Log File . . . . . . . . . . . . . . . . . . . . .135
Monitoring Changes to the Registry . . . . . . . . . . . . . .137
Registry Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .139
System Information . . . . . . . . . . . . . . . . . . . . . . . . . . .140
TimeZoneInformation . . . . . . . . . . . . . . . . . . . . . .142
Shares . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .142
Audit Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .143
Wireless SSIDs . . . . . . . . . . . . . . . . . . . . . . . . . . . .144
Autostart Locations . . . . . . . . . . . . . . . . . . . . . . . . . . .145
423_Win_Foren_TOC.qxd 3/26/07 1:05 PM Page xv
xvi Contents
System Boot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .148
User Login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .148
User Activity . . . . . . . . . . . . . . . . . . . . . . . . . . . . .149
Enumerating Autostart Registry Locations . . . . . . . . . .153
USB Removable Storage Devices . . . . . . . . . . . . . . . . .155
USB Device Issues . . . . . . . . . . . . . . . . . . . . . . . . .158
Mounted Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . .160
Finding Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .164
Tracking User Activity . . . . . . . . . . . . . . . . . . . . . . . . .167

The UserAssist keys . . . . . . . . . . . . . . . . . . . . . . . .168
MRU Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .172
Search Assistant . . . . . . . . . . . . . . . . . . . . . . . . . . . .175
Connecting to Other Systems . . . . . . . . . . . . . . . . .176
IM and P2P . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .177
Windows XP System Restore Points . . . . . . . . . . . . . .178
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .184
DVD Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .184
Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .185
Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .187
Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .188
Chapter 5 File Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . 191
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .192
Event Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .192
Understanding Events . . . . . . . . . . . . . . . . . . . . . . . . .193
Event Log File Format . . . . . . . . . . . . . . . . . . . . . . . . .198
Event Log Header . . . . . . . . . . . . . . . . . . . . . . . . . . . .198
Event Record Structure . . . . . . . . . . . . . . . . . . . . . . . .200
Vista Event Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . .204
IIS Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .206
Internet Explorer Browsing History . . . . . . . . . . . . . . .210
Other Log Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .211
Setuplog.txt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .211
Setupact.log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .213
SetupAPI.log . . . . . . . . . . . . . . . . . . . . . . . . . . . . .213
Netsetup.log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .214
Task Scheduler Log . . . . . . . . . . . . . . . . . . . . . . . . .214
XP Firewall Logs . . . . . . . . . . . . . . . . . . . . . . . . . .216
423_Win_Foren_TOC.qxd 3/26/07 1:05 PM Page xvi
Contents xvii

Dr. Watson Logs . . . . . . . . . . . . . . . . . . . . . . . . . . .219
Crash Dump Files . . . . . . . . . . . . . . . . . . . . . . . . . .220
Recycle Bin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .221
System Restore Points . . . . . . . . . . . . . . . . . . . . . . . . .224
Rp.log Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .224
Change.log.x Files . . . . . . . . . . . . . . . . . . . . . . . . .225
Prefetch Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .226
Shortcut Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .229
File Metadata . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .230
Word Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . .232
PDF Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . .238
Image Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .239
File Signature Analysis . . . . . . . . . . . . . . . . . . . . . . . . .240
NTFS Alternate Data Streams . . . . . . . . . . . . . . . . . . .241
Creating ADSes . . . . . . . . . . . . . . . . . . . . . . . . . . .243
Enumerating ADSes . . . . . . . . . . . . . . . . . . . . . . . .244
Using ADSes . . . . . . . . . . . . . . . . . . . . . . . . . . . . .247
Removing ADSes . . . . . . . . . . . . . . . . . . . . . . . . . .249
ADS Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . .250
Alternative Methods of Analysis . . . . . . . . . . . . . . . . . . . . .250
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .255
Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .255
Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .257
Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .258
Chapter 6 Executable File Analysis . . . . . . . . . . . . . . . . . 261
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .262
Static Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .262
Documenting the File . . . . . . . . . . . . . . . . . . . . . . . . .263
Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .265
The PE Header . . . . . . . . . . . . . . . . . . . . . . . . . . .268

Import Tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . .275
Export Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .278
Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .279
Obfuscation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .281
Dynamic Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .287
Testing Environment . . . . . . . . . . . . . . . . . . . . . . . . . .288
Virtualization . . . . . . . . . . . . . . . . . . . . . . . . . . . . .288
423_Win_Foren_TOC.qxd 3/26/07 1:05 PM Page xvii
xviii Contents
Throwaway Systems . . . . . . . . . . . . . . . . . . . . . . . .290
Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .291
Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .295
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .301
Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .301
Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .304
Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .305
Chapter 7 Rootkits and Rootkit Detection . . . . . . . . . . . 307
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .308
Rootkits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .308
Rootkit Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .314
Live Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .314
RootkitRevealer . . . . . . . . . . . . . . . . . . . . . . . . . . .316
GMER . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .317
Helios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .318
MS Strider GhostBuster . . . . . . . . . . . . . . . . . . . . . . . .320
ProDiscover . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .320
F-Secure BlackLight . . . . . . . . . . . . . . . . . . . . . . . . . .321
Sophos Anti-Rootkit . . . . . . . . . . . . . . . . . . . . . . . . . .322
AntiRootkit.com . . . . . . . . . . . . . . . . . . . . . . . . . . . . .323
Post-Mortem Detection . . . . . . . . . . . . . . . . . . . . . . . .323

Prevention . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .326
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .328
Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .328
Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .329
Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .330
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333
423_Win_Foren_TOC.qxd 3/26/07 1:05 PM Page xviii
The purpose of this book is to address a need. One thing that many computer
forensic examiners have noticed is an overreliance by investigators on what
forensic analysis tools are telling them, without really understanding where this
information is coming from or how it is being created or derived.The age of
“Nintendo forensics” (i.e., loading an acquired image into a forensic analysis
application and pushing a button) is over.As analysts and examiners, we can no
longer expect to investigate a case in such a manner. Cybercrime has increased
in sophistication, and investigators need to understand what artifacts are avail-
able on a system, as well as how those artifacts are created and modified.With
this level of knowledge, we come to understand that the absence of an artifact
is itself an artifact. In addition, more and more presentations and material are
available regarding anti-forensics, or techniques used to make forensic analysis
more difficult. Moreover, there have been presentations at major conferences
that discuss the anti-forensic technique of using the forensic analysts’ training
and tools against them.This book is intended to address the need for a more
detailed, granular level of understanding. It attempts not only to demonstrate
what information is available to the investigator on both a live Windows system
and in an acquired image but also to provide information on how to locate
additional artifacts that may be of interest.
My primary reason for writing this book has been so that I can give back
to a community and field of endeavor that has given so much to me. Since I
started in the information security field over 10 years ago (prior to that, I was
in the military and involved in physical and communications security), I’ve met

a lot of great people and done a lot of really interesting things. Over time,
people have shared things with me that have been extremely helpful, and some
xix
Preface
423_Win_Foren_Pre.qxd 3/26/07 12:44 PM Page xix
of those things have served as stepping stones into further research. Some of
that research has found its way into presentations I’ve given at various confer-
ences, and from there, others have asked questions and provided insight and
answers that have helped push that research forward.The repeated exchanging
of information and engaging in discussion have moved the interest and the
level of knowledge forward, thus advancing the field.
This book is intended to address the technical aspects of collecting and ana-
lyzing data during both live and post-mortem investigations of Windows sys-
tems. It does not cover everything that could possibly be addressed.There is still
considerable room for research in several areas, and a great deal of information
needs to be catalogued. My hope is that this book will awaken the reader to the
possibilities and opportunities that exist within Windows systems for a more
comprehensive investigation and analysis.
Intended Audience
This book focuses on a fairly narrow technical area,Windows forensic analysis,
but it’s intended for anyone who does, might do, or is thinking about per-
forming forensic analysis of Windows systems.This book will be a useful refer-
ence for many, and my hope is that any readers who initially feel that the book
is over their heads or beyond their technical reach will use the material they
find as a starting point and a basis for questions and further study.When I
started writing this book, it was not intended to be a second or follow-on edi-
tion to my first book, Windows Forensics and Incident Recovery, which was pub-
lished by Addison-Wesley in July 2004. Rather, my intention was to move away
from a more general focus and provide a resource not only for myself but also
for others working in the computer forensic analysis field.

In writing this book, my goal was to provide a resource for forensic ana-
lysts, investigators, and incident responders. My hope is to provide not only
useful material for those currently performing forensic investigations but also
insight to system administrators who have been faced with incident response
activities and have been left wondering,“What should I have done?” On that
front, my hope is that we can eventually move away from the misconception
that wiping the hard drive and reinstalling the operating system from clean
media are acceptable resolutions to an incident. Even updating the patches on
the system does not address configuration issues and in many cases will result in
reinfection or the system being compromised all over again.
www.syngress.com
xx Preface
423_Win_Foren_Pre.qxd 3/26/07 12:44 PM Page xx
Preface xxi
www.syngress.com
This book is intended for anyone performing forensic analysis of Windows
systems—be they corporate or government investigators, law enforcement offi-
cers, or consultants. My hope is that this book will also serve as a useful refer-
ence for those developing or attending computer forensic programs at colleges
and universities.
Throughout this book, the terms investigator, first responder, examiner, and
administrator are used interchangeably because the same person often may be
wearing all of these hats. In other cases, the investigator may come into the cor-
porate infrastructure and work very closely with the administrator, even to the
point of obtaining an administrator-level account within the domain in order
to perform data collection. In some cases, the administrator may escort the
investigator or first responder to a compromised system, and the user account
may have administrator privileges on that system. Please don’t be confused by
the use of the terms; they are synonymous in most cases.
Reading through this book, you’ll likely notice a couple of things. First,

there is a heavy reliance on Perl as a scripting language.There’s nothing magical
about this choice: Perl is simply a very flexible and powerful scripting language
that I like to use because I can make changes to the code and run it immedi-
ately without having to recompile the program. And with regard to compiling,
if you’re not familiar with Perl and have never used it, you have nothing to
worry about.With only a few exceptions, the Perl scripts presented in the book
and provided on the accompanying DVD have been “compiled” into stand-
alone Windows executable files using Perl2Exe.These executable files enable
you to run the Perl scripts without having to install Perl (the version of Perl
used throughout this book is freely available from ActiveState.com) or anything
else. Simply extract the necessary files from the archive on the DVD and run
them.Another useful feature of Perl is that, with some care, Perl scripts can be
written to be platform independent. Many of the Perl scripts included on the
DVD perform data extraction (and to some degree, analysis) from binary files,
and where possible, I have tried to make them as platform independent as pos-
sible.What this means is that the Perl script (and the accompanying Windows
executable) will run on the Windows platform, but the Perl script itself can be
run on Linux or even Mac OS X. Many of the Perl scripts on the DVD
(although admittedly not all) have been tested and run successfully within the
Perl environment on Linux.Therefore, the examiner is not restricted to any
particular analysis platform. Some of the scripts will require the installation of
423_Win_Foren_Pre.qxd 3/26/07 12:44 PM Page xxi
additional modules.You can install these modules by using the Perl Package
Manager (PPM) application. PPM is part of the ActiveState distribution of Perl,
which is available for Windows, Linux, Mac OS X, and a number of other plat-
forms.Another very useful aspect of using Perl is to meet the needs of automa-
tion. I often find myself doing the same sorts of things (data extraction,
translation of binary data into something human-readable, etc.) over and over
again, and like most folks, I’m bound to make mistakes at some point. However,
if I can take a task and automate it in Perl, I can write the code once and not

have to be concerned with making a mistake regardless of how many times I
perform that same task. It’s easy to correct a process if you actually have a pro-
cess—I find it extremely difficult to correct what I did if I don’t know what it
was that I did!
You’ll notice that the forensic analysis application used throughout this
book is ProDiscover Incident Response Edition, from Technology Pathways.
Thanks to Chris Brown’s generosity, I have worked with ProDiscover since
Version 3, and I have found the interface to be extremely intuitive and easy to
navigate.When it comes to examining images acquired from Windows systems,
ProDiscover is an excellent tool to use. It has many useful and powerful fea-
tures. Chris and Alex Augustin have been extremely responsive to questions and
updates, and Ted Augustin has been an excellent resource when I’ve met him at
conferences and had a chance to speak with him (Chris,Alex, and Ted are with
Technology Pathways). ProDiscover itself is an excellent analysis platform, and
the Incident Response Edition has made great strides into the live response
arena, providing an easy, effective means for collecting volatile data.Also, in my
opinion, Chris made an excellent decision in choosing Perl as the scripting lan-
guage for ProDiscover because Perl enables the investigator to perform func-
tions (e.g., searches, data extraction, a modicum of data analysis, etc.) within the
image via Perl “ProScripts.”The accompanying DVD contains several
ProScripts that I’ve written and used quite regularly during examinations
(please note that though the ProScripts are Perl scripts, they are not “compiled”
with Perl2Exe, as the ProScripts must be scripts to be used with ProDiscover).
Organization of This Book
This book is organized into seven chapters.
www.syngress.com
xxii Preface
423_Win_Foren_Pre.qxd 3/26/07 12:44 PM Page xxii
Chapter 1: Live Response: Data Collection
This chapter addresses the basic issues of collecting volatile data from live sys-

tems. Because of several factors (an increase in sophistication of cybercrime,
increases in storage capacity, etc.), live response has gained a great deal of
interest.This increase in interest has not been restricted to consultants (such as
myself) either; law enforcement professionals are also beginning to see the need
for collecting volatile information from live systems in order to support an
investigation.This chapter lists tools and methodologies that you can use to col-
lect volatile information. It also presents the current incarnation of the Forensic
Server Project.
Chapter 2: Live Response: Data Analysis
I’ve separated data collection and data analysis as I see them as two separate
issues. In many cases, the data that you want to collect doesn’t change, as you
want to get a snapshot of the activity on the system at a point in time.
However, how you interpret that data is what may be important to your case.
Also, it’s not unusual to approach a scene and find that the initial incident
report is only a symptom of what is really happening on the system or has
nothing to do with the real issue at all. During live response, how you analyze
the data you’ve collected, and what you look for, can depend on whether
you’re investigating a fraud case, an intrusion, or a malware infection.This
chapter presents a framework for correlating and analyzing the data collected
during live response in order to develop a cohesive picture of activity on the
system and make analysis and identification of the root cause a bit easier and
more understandable.
Chapter 3: Windows Memory Analysis
Windows memory analysis is an area of study that has really taken off since its
formal introduction to the community during the summer of 2005. In the past,
if the contents of physical memory (i.e., RAM) were collected from a live
system, they were searched for strings (i.e., passwords), IP addresses, and e-mail
addresses.The contents were then archived. Unfortunately, any information
found in this manner had little context.Thanks to research that has been done
since the DFRWS 2005 Memory Challenge, methods of obtaining RAM dumps

have been investigated, and data within those RAM dumps can be identified and
www.syngress.com
Preface xxiii
423_Win_Foren_Pre.qxd 3/26/07 12:44 PM Page xxiii