3. Common Forensic Artifacts to Analyze

Account logins, downloads, access history

Browser history and cookies are vital artifacts in digital forensics because they provide a record of user behavior on the internet. Browser history tracks the websites that a user has visited, including timestamps, which can show when an account was accessed or a download was completed. Cookies, on the other hand, store information about user sessions and preferences, which can also indicate account logins and other interactions with web applications.

Think of browser history like a digital diary of where you’ve been online. Just like a diary can show what you were doing on specific days, your browser history records when you visited certain websites or were logged into your accounts.

Persistence methods, installed programs

In Windows operating systems, the registry is a database that stores low-level settings for the operating system and for applications that opt to use the registry. Registry keys can reveal what programs are installed, what settings have been changed, and methods used by malware to maintain persistence on a system. Analyzing registry keys can help forensic investigators uncover how a system was compromised and what actions the malicious software might be taking.

Imagine the Windows registry as the control panel of a store. Each setting in the registry is like a shelf where specific items (like programs) are kept. Investigators visit this control panel to see what items (programs) are available and how things are organized, helping them understand how the store (the computer system) operates.

Login attempts, system changes, audit trails

Event logs are records created by an operating system that document system-level events, including login attempts, system changes, and application operations. By analyzing these logs, forensic analysts can reconstruct actions taken on the system, understand user behavior, and identify any unauthorized or suspicious activity. This is crucial for validating claims of breaches or unauthorized access.

Think of event logs as a security camera system for your computer. Just like a video camera records who enters and exits a building, event logs keep track of what actions were taken on the computer, helping investigators to visualize the timeline of any incidents.

Programs recently run on Windows

Prefetch files in Windows are used to speed up the loading of applications by storing data about how frequently and when they are used. For forensic analysis, these files can indicate what programs were run, including their execution times. This information can be useful in pinpointing when a malicious activity occurred or what software was involved in an attack.

You can think of prefetch files like a planner that helps someone remember which classes they attended. Just as a planner notes down when classes were attended, prefetch files record what applications were run and when, giving forensic analysts insights into user activity.

File creation, deletion, and modification times

The Master File Table (MFT) in NTFS file systems contains information about all files and directories on a volume, including creation, deletion, and modification times. The USN Journal (Update Sequence Number) provides a log of changes made to files. Together, these artifacts are paramount for understanding the history of a file, determining when it was created or altered, and even uncovering files that have been deleted, which can provide evidence of malicious activities.

You can visualize the MFT as a detailed inventory list for a library, where every book (file) has a record of when it was added, moved, or removed. If a book goes missing, looking at this list can help figure out exactly when and how that happened, much like how MFT and USN Journal provide forensic analysts with a timeline of file activity.

--