Book 5 Execution Evidence

Thursday, June 2, 2016

2:57 PM

Advanced Evidence of Execution

- Prefetchparser: volatility, comb memory address space for prefetch files not on disk.
Scan virtual memory for prefetch headers.
Strong validation reduce false positives.
Internal metadata.
- ShimCache: Application compatibility cache
AppCompatCache registry key for compatibility.
Track EXE last modification date, file path, file size.
Registry entries are created => notify system.
Most recent events are on top, new entries are written on shutdown
InsertFlag in AppCompatCache entry.
ShimCacheParser.py
Metadata in data structure, when shutdown, data str is serialized into registry
Find registry path, determine format, return data in CSV format or STDOUT.
Search ControlSet and return unique entries by default. ExecFlag true
Shimcache volatility: parse app com shim cache registry key.
RecentFileCache.bcf: Application Experience <-> App Com Cache.
Check DB for known problems using UA.
ProgramDataUpdater uses registry file during process creation.
Maintained by Program Data Updater scheduled service.
Collect MS customer experience improvement program.
Reference to program copied/downloaded/executed on sustem.
Information is cleared when ProgramDataUpdater runs. (12:30AM).
Rfc.pl to extract data
Amcache.hve: replacement of RecentFileCache.bcf
Numeric keys = different exe file run.
Volume GUID and SYSTEM hive's MountedDevice key
- Cafae.exe automate registry extraction
Ntusr.dat hive and usrclass.dat hive for Vista.

Steinberg Page 1