Week 3 - Case Examination
Live and Dead examination
- Dead examination involves checking the suspect machine in a non-booted fashion.
- Case Management software (e.g. FTK/Encase) mounts the suspect’s file system - changes are cached by the tool - the analysis remains ‘dead’
- Benefits
- The integrity of the suspect’s data is ensured
- no instant decision is required
- Analysis can be repeated
- Tools that can manage the complete forensics process
- Process a wide range of data types (e.g. emails); Analyse the registry; decrypt files; crack passwords; and build a report.
- Reduce the time required to identify and document evidence
- Live analysis utilizes the suspect machine in a booted fashion for examination
- bespoke applications where it is not possible to obtain a (Licensed) Version
- Understanding how a piece of malware is behaving
- Case Dependent
- Order of Volatility
- Main physical memory
- virtual memory
- network state
- running processes
- hard drive
- backup media
- external storage
- Tools
- Regshot
- WinDirStat
- net file
- net session
