Windows
This provides a structured approach for digital forensic investigators to systematically collect, analyze, and preserve digital evidence from Windows-based operating systems.
What is Windows forensics methodology?
The Windows Registry is a hierarchical database that stores low-level settings for the Microsoft Windows OS and applications that use it. In the registry, data is stored in folders in tree-like structures.
What are hives?
A file system that records changes in a dedicated log before writing them to the main storage area
What is a Journaling File System (called a "journal")?
macOS relies on a ____________ combining the Mach microkernel and Berkeley Software Distribution (BSD) subsystems, forming the foundation of Apple’s Macintosh operating system.
What is hybrid kernel?
Windows provides robust security mechanisms such as BitLocker and EFS, which protect data.
What is encryption?
This hive contains information about all the currently active user profiles on the computer.
What is HKEY_USERS, abbreviated as HKU?
Linux file system that records changes in a dedicated log before writing them to the main storage area
What is a Journaling File System (Journal)?
This property list file details the macOS version and build number, aiding investigators in correlating system-specific vulnerabilities or behaviors.
What is SystemVersion.plist File
NTFS’s advanced capabilities, such as alternate data streams (ADS) and transaction logging, obscure forensic evidence, making hidden or deleted data harder to uncover. Additionally, ReFS (Resilient File System) poses challenges because of its unique metadata handling, checksums, and storage pools.
What is Complex File Systems?
Stores information about the current hardware profile of the system.
What is HKEY_CURRENT_CONFIG, abbreviated as HKCC?
System [----] indicates how long a Linux system has been operational since its last reboot. This information is critical for forensic investigators to establish a temporal context for an incident, correlate logs, and assess system stability. This data also includes metrics such as the number of currently logged-in users and system load averages over the past 1, 5, and 15 minutes, which reflect resource utilization.
What is Uptime?
This command retrieves timestamps, Modified, Accessed, and Changed (MAC) times for files, applications, and logs, enabling timeline construction.
What is stat?
Windows includes features like Windows Defender System Guard and Secure Boot to protect system integrity.
What are System Protection (Mechanisms)?
This hive contains most configuration information for installed software (including Windows OS) and information about the computer's physical state (including bus type, installed cards, memory type, startup control parameters, and device drivers).
What is HKEY_LOCAL_MACHINE, abbreviated as HKLM?
Digital files consist of a bit sequence, with each file type following a distinct encoding pattern called its file format, typically identified by the first 20 bytes of the file.
What is a file signature?
These special directories encapsulate application data executables, configurations, and caches often obscured from users.
What are application bundles?
This is Windows-specific functionality that helps the Windows OS speed up system boot and application launches. It records data for up to the first 10 seconds after the application process starts. Once the data is processed, it is written to a .pf file
What is Prefetching?
This subkey stores information on users, administrator accounts, guest accounts, cryptographic hashes of every user password, etc.
What is SAM (Security Account Manager)?
The total number of seconds that have elapsed since January 1, 1970, at 00:00:00 UTC (excluding leap seconds)
What is Epoch Time?
macOS’s search indexer maintains a metadata database, searchable for suspicious files or user activity traces, though indexing may not be exhaustive.
What is Spotlight?