הקשיח.
Windows ExplorerNot to be confused with Internet Explorer, Windows Explorer is the default GUI shell for Windows 7 / Vista / XP. It leaves all sorts of data in the registry and file system for a forensics investigation.
Description: Recently opened files from Windows Explorer
Location:
C:\Users\\AppData\Roaming\Microsoft\Windows\RecentWhy you care: It can be quite useful to know what files have been opened recently. Think someone is accessing records of embezzlement? Maybe there is a pointer to the Excel file here that can lead you to where the data has been stored. You may also see links to videos and images in here. I've had this lead to personal embarrassment before while doing a presentation for the ISSA. :)
Entry by: Irongeek, but thanks to Nir.
Description: Network Shortcuts
Location:
C:\Users\\AppData\Roaming\Microsoft\Windows\Network ShortcutsWhy you care: This could show an investigator what fileservers the person is accessing, or on a captured laptop a little about the internal network (useful for pen-testing).
Entry by: Irongeek, but thanks to Nir.
Description: Items recently ran from the "Run" bar
Location:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRUWhy you care: Useful to know what the person is running using the Windows Run bar, but in Vista and Windows 7 lots of folks use "Search programs and files" text box, which does not show up in this registry key.
Entry by: Irongeek, but thanks to Nir.
Description:ComDlg32 recently opened/saved files
Location:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRUWhy you care: This key has sub keys by file extension that can let you know what people have been opening/saving to when the common file save/open dialog comes up. Values are in HEX, but readable if you open them in ASCII view.
Entry by: Irongeek, but thanks to Nir.
Description: ComDlg32 recently opened/saved folders
Location:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRUWhy you care: Much like the entry above, but the last folders. Values are in HEX, but readable if you open them in ASCII view.
Entry by: Irongeek, but thanks to Nir.
Description: Recent Docs
Location:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocsWhy you care: It can be quite useful to know what files have been opened recently. Got to know where people as sticking their data. :)
Entry by: Irongeek, but thanks to Nir.
Description: EXE to main window title cache
Location:
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCacheWhy you care: Once again, it's useful to know what folks are running on a system, and this might give you an idea what an exe is before you run it yourself (in a VM of course).
Entry by: Irongeek, but thanks to Nir.
Description: User Assist
Location:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssistWhy you care: This key is suppose to contain information about programs and shortcuts accessed by the Windows GUI, including execution count and the date of last execution, but the way it's stored is less than obvious. Didier Stevens has a tool far parsing the data here:
http://blog.didierstevens.com/programs/userassist/The version I tested does not seem to work in Windows 7, but Mr. Stevens
is on the case.
Entry by: Irongeek, but thanks to Nir and Didier Stevens.
Windows GeneralEven more Windows Forensics goodness (or badness depending on your perspective).
Description: Temp folder
Location:
C:\Users\\AppData\Local\TempWhy you care: Lots of programs need a safe place, where the user has permissions, to dump temp data. This is the place to look. They may have wiped/shredded the main file, but there could be a version in this directory depending on how the application works.
Entry by: Irongeek, but thanks to Nir.
Description: Recycle Bin
Location:
C:\$Recycle.BinWhy you care: Do I really need to say?
Entry by: Irongeek, but thanks to Nir.
Description: Last logged on user
Location:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinlogonWhy you care: Lets you know who logged in last, and may also give you a user name to attack if you're a pen-tester.
Entry by: Irongeek, but thanks to Nir.
Description: Event logs
Location: Should be in
C:\Windows\System32\config or
C:\Windows\System32\winevt\Logs depending on OS
Why you care: These may be relocated, so do a desktop search for *.evt and *.evtx. Let you know all sorts of things about what is happening on the box.
Entry by: Irongeek.
Description: Last key edited by RegEdit
Location:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\RegeditWhy you care: Can be useful to know if the user was tweaking the registry for some purpose (like writing an article on Forensically interesting spots in the Windows 7 file system and registry).
Entry by: Irongeek, but thanks to Nir.
Description: List of Installed USB devices, both connected and unconnected
Location:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBWhy you care: It can be useful to know what USB devices have be connected to a box, and even the vendor and serial number of the device in some cases. Think someone copied the data to a thumbdrive? This may help you trace down what thumbdrive. Think how useful it can be to help tie something a user physical possesses to a box.
Entry by: Irongeek.
Description: List of installed USB storage devices
Location:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTORWhy you care: Much like the installed USB devices entry, but just for USB storage. Think someone copied the data to a thumbdrive? This may help you trace down what thumbdrive. CleanAfterMe scrubs
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB but not USBSTOR when I tested last.Entry by: Irongeek.
Description: SetupAPI Device Log
Location:
C:\windows\inf\setupapi.dev.logWhy you care: Log that can help you find out what USB devices have been installed, including thumbdrives. CleanAfterMe scrubs
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB but not this file when I tested last.Entry by: Irongeek, but thanks to Nir.
Description: Windows Prefetch
Location:
C:\Windows\PrefetchWhy you care: Windows Prefetch is a feature in Windows XP and newer system (Including Windows 7) that is ment to speed up commonly executed application and boot load times by recording what on the system is accessed. Mark McKinnon
has a tool you might be interested in for parsing this data. Also, you may want to read the Wikipedia entry:
http://en.wikipedia.org/wiki/PrefetcherEntry by: Irongeek, but thanks to Nir and Mark McKinnon.
Internet ExplorerDescription: Internet Explorer Temp Folder (IE Cache)
Location:
C:\Users\\AppData\Local\Microsoft\Windows\Temporary Internet FilesWhy you care: Look at cached files to see what sort of content people are surfing around for. Also, a great place to start looking if you want to add to your pr0n collection.
Entry by: Irongeek, but thanks to Nir.
Description: IE Cookies
Location:
C:\Users\\AppData\Roaming\Microsoft\Windows\CookiesWhy you care: Let's you know where people have been surfing, and possibly a password or at least a session ID to a website they authenticate to.
Entry by: Irongeek, but thanks to Nir.
Description: Internet Explorer History
Location:
C:\Users\\AppData\Local\Microsoft\Windows\HistoryWhy you care: Again, useful to know what sites someone has visited, when, and how many times.
Entry by: Irongeek, but thanks to Nir.
Description: IE Typed URLs
Location:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedUrlsWhy you care: Despite the name, you can not be 100% sure they were typed into the Internet Explorer URL bar, but this can help you distinguished between sites that were manually entered, and ones accessed via a link. The presumption is that if a URL shows up in the TypedURLs key, the person really meant to go there. This is not necessarily the case, just do a search for what happened to poor Julie Amero.
Entry by: Irongeek, but thanks to Nir.
Description: Internet Explorer Forms AutoComplete
Location:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage1Why you care: This registry key stores autocomplete information for IE, but in an obfuscated form. For old versions of IE try Nir's
PSPV, for IE 7 and newer try
IE PassView to decode this data.
Entry by: Irongeek, but thanks to Nir.
Description: Internet Explorer Password AutoComplete
Location:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2Why you care: This registry key stores autocomplete password information for IE, but in an obfuscated form. For old versions of IE try Nir's
PSPV, for IE 7 and newer try
IE PassView.
Entry by: Irongeek, but thanks to Nir.
Description: Printer spool folder Location: C:\Windows\System32\spool\PRINTERS Why you care: Sometimes a print job will get stuck here, and we all know what useful information people sometimes print. To read these spl files you will need the right PCL/PostScript parser. Try some of the tool listed at the bottom of this page: http://www.undocprint.org/formats/winspool/splI had ok luck with O&K Printer Viewer and LBV SPLViewer.
Entry by: Irongeek.
לינק להורדה
