Windows Forensics - Registry Advanced Three-Day Instructor-Led Course

Transcription

1 Windws Frensics - Registry Advanced Three-Day Instructr-Led Curse Fr mre infrmatin cntact: inf@syntricate.cm This advanced Syntricate training curse prvides the knwledge and skills necessary t use AccessData prducts t cnduct frensic investigatins n the Micrsft Windws registry. Participants will learn where and hw t lcate registry artifacts using Frensic Tlkit (FTK ), FTK Imager, Registry Viewer and Passwrd Recvery Tlkit (PRTK ). Prerequisites: This hands-n curse is intended fr frensic investigatrs with experience in frensic case wrk and a basic wrking knwledge f FTK, FTK Imager, Registry Viewer, and PRTK. Prir familiarity with the Micrsft Regedit utility is als helpful. T btain the maximum benefit frm this curse, yu shuld meet the fllwing requirements: Able t understand curse curriculum presented in English Attendance at the AccessData Frensic BtCamp and Windws Frensics curse r equivalent experience with FTK and PRTK Previus investigative experience in frensic case wrk Knwledge f Micrsft Windws envirnment Class Materials and Sftware: Yu will receive the assciated materials prir t the curse. During this three-day curse, participants will review the fllwing: Use FTK Imager t btain a clean cpy f the Windws registry Backup individual registry keys, registry files, and whle registry sets Use a Regular Expressin t carve registry key names frm unallcated space Identify and lcate ptential trace evidence in the regf and hbin blcks Use the SAM file t identify system user accunts, user infrmatin and prperties, user lgn passwrd infrmatin, user prfiles, and grup membership Use the SYSTEM file t identify cmputer name, time zne, last shutdwn time, netwrk cnnectins, and hardware infrmatin Use the SECURITY file t identify current and archived system passwrds, if present. Break the SECURITY file passwrds in PRTK Use the SOFTWARE file t identify USB vlume serial numbers in Windws Vista, recycle bin settings, user prfiles, wireless cnnectins, printer infrmatin, evidence f uninstalled sftware, applicatin restrictins, autlgn settings, and cached passwrd settings Identify individual applicatin settings such as Internet Explrer (IE) main settings; IE use cunt; Internet Accunt Manager; URL histry; IE5 histry settings; MSN accunts; munt pints and mapped drives; and FTP site settings (Cntinued n ther side) Sme tpics and items in this class syllabus are subject t change. This dcument is fr infrmatin purpses nly. Syntricate makes n warranties, express r implied, in this dcument. AccessData, AccessData Certified Examiner, ACE, Distributed Netwrk Attack, DNA, Frensic Tlkit, FTK, LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the AccessData, Inc. in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.

2 Windws Frensics - Registry Advanced Three-Day Instructr-Led Curse Fr mre infrmatin cntact: inf@syntricate.cm Mdule (Cntinued) 1: Intrductin Tpics: Intrductins Class materials and sftware Prerequisites Class utline Helpful Infrmatin Use the Windws registry, rather than Windws Explrer, t cnfigure Explrer settings Install the fllwing AccessData sftware: FTK Imager Registry Viewer PRTK Mdule 2: Registry Utilities Use Regedit r Regedit32 t view and edit Registry settings List fur ways t back up the Registry Backup individual keys and values List fur ways t restre.reg files Create a hive backup Exprt Registry keys and values t a text file Create a set f restre pints Mdify subkey permissins Exprt Registry files frm FTK Use FTK Imager t harvest live Registry files Use Registry Viewer t search Registry values Generate Registry reprts in Registry Viewer Backup the registry using Windws utilities Create a restre pint Use FTK Imager t btain a clean cpy f the wrkstatin s registry files Use Regedit t back up, delete, and restre subkeys Use Regedit t edit subkey permissins Mdule 3: Registry 201 Define the Windws Registry structure and functin List Registry issues that can cause prblems with individual applicatins and in bting the system List the frensic benefits f the Registry Identify the hives that make up the Registry and list the types f infrmatin assciated with each hive Identify where the user s NTUSER.DAT file is lcated Identify the standard Registry data types Navigate the Registry in regedit32 Navigate the Registry in Registry Viewer Define the Registry blck structure Identify the seven data structures in the hbin blcks that define the Registry keys, subkeys, and values Track a subkey t its values Recver deleted data in the Registry and Registry slack Cmpare registry structure in Registry Viewer and Regedit Lcate and view registry files in FTK Imager Navigate thrugh the regf and hbin blcks in the SAM file t lcate key values Use FTK Imager t search fr a user in the registry via key name Use FTK Imager t search fr a value in the registry Sme tpics and items in this class syllabus are subject t change. This dcument is fr infrmatin purpses nly. Syntricate makes n warranties, express r implied, in this dcument. AccessData, AccessData Certified Examiner, ACE, Distributed Netwrk Attack, DNA, Frensic Tlkit, FTK, LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the AccessData, Inc. in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.

3 Windws Frensics - Registry Advanced Three-Day Instructr-Led Curse Fr mre infrmatin cntact: inf@syntricate.cm (Cntinued) Mdule 4: Preliminary Reprts Generate a preliminary case reprt (PCR) List the Registry infrmatin that shuld be included in a PCR Describe hw data is added t standard reprts List the types f infrmatin that can be included in summary reprts List the benefits f summary reprts Create a Standard Reprt in Registry Viewer Create a Summary Reprt in Registry Viewer Create a Summary Reprt in Registry Viewer using wildcards Create a preliminary reprt in FTK Navigate the fllwing subkeys in the NTUSER.DAT file: Internet Explrer Office 2007 MRUs UserAssist Viewing TypedURLsTime anmalies Use registry data t break a user s lgn passwrd Use munt pint data and the NTUSER.DAT file t determine which user accessed a USB drive Recver lcal search terms thrugh Windws 8.1 Assciating lcal searches with the IE webcache Mdule 5: NTUSER.DAT Artifacts Use the fllwing registry cmpnents t track patterns f user behavir: NTUSER.DAT Recently typed URLs in the brwser Recently viewed dcuments Prtected strage infrmatin that ptentially cntains Web lgin names, passwrds, frm data, and search queries Internet Explrer infrmatin Munt pints and mapped drives Micrsft Office artifacts Office MRUs Date and time f file access Trusted lcatins Resiliency and aut recver Lcatin in file last visited UserAssist Uninstalled sftware Lcal search terms $Recycle.Bin BitLcker T G Mdule 6: SAM Artifacts Describe the functin f the SAM file Describe the Windws management f accunt permissins Describe the cmpnents that make up the Security Identifier (SID) Describe the cmpnents f the Relative Identifier (RID) Identify Registry artifacts assciated with users and grups Assciate users t grups Use the SAM file t translate SIDs Recver user accunt infrmatin frm the SAM file including Windws 8 Live Accunts Use the SAM file t break a user s lgn passwrd Use the SAM file t recver grup infrmatin Sme tpics and items in this class syllabus are subject t change. This dcument is fr infrmatin purpses nly. Syntricate makes n warranties, express r implied, in this dcument. AccessData, AccessData Certified Examiner, ACE, Distributed Netwrk Attack, DNA, Frensic Tlkit, FTK, LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the AccessData, Inc. in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.

4 Windws Frensics - Registry Advanced Three-Day Instructr-Led Curse Fr mre infrmatin cntact: inf@syntricate.cm (Cntinued) Mdule 7: SYSTEM Registry File Part 1 Identify where the SYSTEM file is lcated in the Registry Describe the functin f the SYSTEM file List what type f data is stred in the SYTEM file Identify the fur subkeys that make up the SYSTEM cntrl set Use the SYSTEM file t recver the fllwing infrmatin: The crrect time zne setting n a Windws XP r Vista machine Whether a Vista system s default setting that disables the last accessed date/time has nt been turned back n The cmputer name The last shutdwn time Munted devices fr HDDs Hardware infrmatin, including flppydisks, hard disk drives, mass strage devices, and printers Services available t the system Hw memry is cnfigured, where the swap file is lcated, and Prefetch settings Link a USB device t a specific cmputer Use the SYSTEM file t identify time zne infrmatin, cmputer name, and last shutdwn time Use the SYSTEM file, link files and lg files t identify infrmatin n specific USB drives Use the SYSTEM file t identify a system s DHCP name server, DHCP IP address, and Hstname Mdule 8: SYSTEM Registry File Part 2 USB device tracking USB drive identificatin thrugh Windws Munted Devices Manager Date and time drive last munted Date and time drive first munted Lgged n user wh inserted device Windws Prtable Devices key Use f link files t identify devices Identificatin f USB external drives Behavir f cameras and ther devices Windws 2000 and XP USB cnnectins Determining the rder f USB drive insertin USB event lgs Simulate real wrld tracking f devices Track a device frm Windws t all f the available dates and times and assciatins in Windws 2000, Windws XP, Vista, Windws 7 and Windws 8 Track device behavir f different devices such as cameras, ipads, iphnes, and ther devices Viewing Windws event lgs fr assciated devices in Windws Vista, Windws 7 and Windws 8 Mdule 9: SECURITY Artifacts Identify where the SECURITY file is lcated Describe the functin f the SECURITY file List what type f data is stred in the registry Distinguish between permissins, plicies, and rights Identify what types f passwrds can be recvered frm the SECURITY file Recver cached passwrds Use the SECURITY file t identify infrmatin n a target system Use PRTK t recver passwrds stred in the SECURITY file Sme tpics and items in this class syllabus are subject t change. This dcument is fr infrmatin purpses nly. Syntricate makes n warranties, express r implied, in this dcument. AccessData, AccessData Certified Examiner, ACE, Distributed Netwrk Attack, DNA, Frensic Tlkit, FTK, LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the AccessData, Inc. in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.

5 Windws Frensics - Registry Advanced Three-Day Instructr-Led Curse Fr mre infrmatin cntact: inf@syntricate.cm (Cntinued) Mdule 10: SOFTWARE Artifacts Identify where the SOFTWARE file is lcated in the Registry Describe the functin f the SOFTWARE file List what type f data is stred in the SOFTWARE file Describe the functin f the Vista ReadyBst feature and identify what infrmatin it stres in the SOFTWARE file Use the SOFTWARE file t recver the fllwing infrmatin: Evidence f uninstalled sftware Startup lcatins used t lad applicatins r executable files during the bt prcess The Class Identifiers (CLSIDs) fr perating system bjects such as applicatins and ActiveX cntrls The Service Set Identified (SSID) used t identify the user s wireless cnnectins Winlgn and Autlgn infrmatin Recycle Bin prperties Printer infrmatin Create a File Types reprt in Registry Viewer List the tw types f wireless artifacts fund in Windws XP Identify where wireless artifacts are fund in Windws Vista Determinatin f installed Metr Apps Tracking launch f prtable applicatins in Windws 8 Use the SOFTWARE file t identify user infrmatin n a target system such as the last lgged n user and the time the user shut dwn the system Use the SOFTWARE file t identify uninstalled sftware, wireless cnnectins, recycle bin settings, and printer infrmatin Mdule 11: Other Registry Files Use the UsrClass.dat file t recver infrmatin n launched executables Use the Amcache.hve file frm Windws 8 t find the fllwing infrmatin n the target system: Launched executables Drive infrmatin frm launched binaries Identificatin infrmatin frm launched binaries Determining use f prtable apps Checking applicatin cmpatibility settings by the user Check fr launched applicatins in the event lgs Check individual settings.dat applicatin registry files in Windws 8 fr ptential artifacts Tracking launched executables in the MuiCache (UsrClass.dat) Fllwing applicatin assciatins in the Windws 8 Amcache.hve registry file Dcumenting launched applicatin details f drive and lcatin Drive assciatins with Munted Devices Hash tracking f launched executables Sme tpics and items in this class syllabus are subject t change. This dcument is fr infrmatin purpses nly. Syntricate makes n warranties, express r implied, in this dcument. AccessData, AccessData Certified Examiner, ACE, Distributed Netwrk Attack, DNA, Frensic Tlkit, FTK, LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the AccessData, Inc. in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.