AN OVERVIEW OF WINDOWS

FORENSICS

Things to look out for when investigating a windows machine

-by 4dsec
 AGENDA

~ Fundamentals of Windows Forensics

~ Registries and File paths
~ Browser forensics
~ Tools to support forensic investigations
~ Conclusion
~ Contact and About
 BASICS OF WINDOWS FORENSICS

• Understanding of windows registries aka registry hives.

• Understanding the default file structure of the operating system.
• Default locations of files and common file paths.
• Using tools to parse information.
 FILE FORMAT REVERSE ENGINEERING

• Reading through hex dumps

• Understanding magic bytes
• Being able to detect broken files and recover them
• And so on…..
WINDOWS REGISTRY

HKCU

HKLM
 WINDOWS REGISTRY

• Information that could be possibly recovered

* System configuration
* Devices on the system
* Usernames, Personal settings and Browser preferences
* Files opened
* Programs Executed
* Passwords
STRUCTURE OF WINDOWS REGISTRY
CHEAT SHEET
 BROWSER FORENSICS

• Data from browsers constitute a sizeable wealth of valuable information.

BROWSER FORENSICS
 HOW DO SAVED PASSWORDS WORK

• Windows data protection API aka DPAPI

• Commonly used by offensive tools such as mimikatz
• Usually symmetric encryption
• Now lets see how the key and password blob is retrieved
SANS POSTER
 TOOLS FOR FORENSIC INVESTIGATIONS

Image Forensics Memory Forensics

 AUTOPSY VS X-WAYS

• Advanced functionality • Relatively older

• Lesser support for file system forensics
• Ingest modules can take a lot of time to
load
• Mostly open source
• Well supported for file system forensics
• Faster in preprocessing data
• Fully licensed
WHY RED TEAMERS NEED TO KNOW
ABOUT FORENSICS
 CONTACT AND ABOUT

• Abishek M
• Ex Blue teamer at Scottish Government
• Data Science/Anything cyber

• Linkedin.com/abishekmani
• 4thdsec@gmail.com
• Discord: 4dsec#4966

• Ask your questions