WINDOWS SYSTEMS AND ARTIFACTS John P. Abraham Professor UTPA

Windows file systems FAT (file allocation table) and NTFS (new technology file system) NTFS has the ability to set access control lists on file objects, journaling, and compression. MFT (master file table) – every file and directory has an MFT entry. The location of the starting sector of MFT can be found in the boot sector of the disk. More info: us/library/windows/desktop/aa365230(v=vs.85).aspxhttp://msdn.microsoft.com/en- us/library/windows/desktop/aa365230(v=vs.85).aspx

NTFS Alternate data streams This was included to support Macintosh hierarchical file system. Intruders can hide files using this without you detecting it with dir commands. Use dir /r Tutorial:

Windows Registry Windows configuration database It records information specific to users and tracks an user’s activity. Regedit is the utility we can use to view. Registry files are located in the config directory of the windows system. User profiles are found in NTUSER.DAT and USRCLASS.DAT More info: us/library/windows/desktop/ms724946(v=vs.85).aspxhttp://msdn.microsoft.com/en- us/library/windows/desktop/ms724946(v=vs.85).aspx

Windows registry Forensics Here is a tutorial: analysis-windows-registryhttp:// analysis-windows-registry Instead of reading papers (next two) I am assigning you to read this 16 page tutorial and write a summary of each page. RegRipper is a utility that Harlan Carvey (one of the authors of your lab book)

Event Logs Windows has a built-in event viewer. ( Additional event log viewers can be downloaded from google.) To launch: Right click on computer, manage, event viewer. OR Start, Run, type in: eventvwr.msc You will see APPLICATION, SECURITY, SETUP AND SYSTEM categories. Click on each and look at the events. There are several tutorials available on the web to help you understand these logs.

Prefetch files Windows keeps tracks of programs used during the session and saves it to a prefetch file located in the windows\prefetch directory. It allows to load regularly used programs faster. When an application is launched a prefetch file for that application is created. The name of the appliation along with a hashed path where the program is actually located is stored in the name of the file. For forensic examination, when a prefetch file is found, it means that program was run on that computer and can provide last run date and time.

Shortcut files File extension.lnk (LNK files) This can be used to demonstrate access to files, particularly those on the network.