Scribd
Upload
186 views15 pages

Windows Forensics: Dr. Phil Polstra @ppolstra PHD, Cissp, Ceh

Uploaded by

karla

Copyright:

© All Rights Reserved
Download as PDF, TXT or read online from Scribd
Download as pdf or txt

Windows Forensics: Dr. Phil Polstra @ppolstra PHD, Cissp, Ceh

Uploaded by

karla
186 views15 pages

Original Title

001-windows001

Copyright

© © All Rights Reserved

Available Formats

PDF, TXT or read online from Scribd

Did you find this document useful?

Is this content inappropriate?

Copyright:

© All Rights Reserved
Download as PDF, TXT or read online from Scribd
Download as pdf or txt
186 views15 pages

Windows Forensics: Dr. Phil Polstra @ppolstra PHD, Cissp, Ceh

Uploaded by

karla

Copyright:

© All Rights Reserved
Download as PDF, TXT or read online from Scribd
Download as pdf or txt
You are on page 1/ 15

Windows Forensics

Dr. Phil Polstra @ppolstra


PhD, CISSP, CEH http://philpolstra.com
Certifications:
http://www.securitytube-training.com

Pentester Academy: http://www.PentesterAcademy.com


©SecurityTube.net
About Me
●
Frequent conference speaker
●
Repeat performances at DEFCON, BlackHat, GrrCON, 44CON, B-sides,
ForenSecure, ...
●
BruCON, SecTOR, ShakaCON, ...
●
Author
●
Hacking and Penetration Testing with Low Power Devices
●
Linux Forensics
●
USB Forensics
●
Associate Professor of Digital Forensics, Bloomsburg University of
Pennsylvania
●
Programming from age 8 (in Assembly at 10)
●
Hacking hardware from age 12
●
Aviator and plane builder with a dozen ratings

©SecurityTube.net
Course Contents
Live Response
●
Human interactions
●
Creating a live response kit
●
Transporting data across a network
●
Collecting volatile data
●
Determining if dead analysis is justified
●
Dumping RAM
©SecurityTube.net
Course Contents (cont.)
Acquiring filesystem images
●
Using dd
●
Using dcfldd & dc3dd
●
Write blocking
●
Software blockers
●
Udev rules
●
Forensic Linux distros
●
Hardware blockers

©SecurityTube.net
Course Contents (cont.)
Analyzing filesystems
●
Mounting image files
●
Finding the strange
●
Searching tools
●
Authentication related files
●
Recovering deleted files
●
Finding hidden information
©SecurityTube.net
Course Contents (cont.)
The Sleuth Kit (TSK) and Autopsy
●
Volume information
●
Filesystem information
●
FAT 12/16/32
●
NTFS
●
Directory entries
●
Constructing timelines
©SecurityTube.net
Course Contents (cont.)
Timeline Analysis
●
When was system installed, upgraded,
booted, etc.
●
Newly created files (malware)
●
Changed files (trojans)
●
Files in the wrong place (exfiltration)

©SecurityTube.net
Course Contents (cont.)
Digging deeper into Windows filesystems
●
Disk editors
●
Active@ Disk Editor
●
Autopsy
●
FAT 12/16/32
●
NTFS
●
Searching unallocated space
©SecurityTube.net
Course Contents (cont.)
Network forensics
●
Using snort on packet captures
●
Using tcpstat
●
Seperating conversations with tcpflow
●
Tracing backdoors with tcpflow

©SecurityTube.net
Course Contents (cont.)
File forensics Unknown files
●
Using file signatures
●
Comparing hashes to
●
Searching through know values
swap space ●
File and strings
●
Web browsing commands
reconstruction ●
Log files
●
Cookies ●
Recycle bin
●
Search history ●
Prefetch files
●
Browser caches ●
Alternate data streams
©SecurityTube.net
Course Contents (cont.)
Registry forensics ●
Past & present
●
RegRipper mounted devices
●
Python ●
User activity
●
System information ●
System restore
●
Autostart programs points
●
USB Devices
●
User info
©SecurityTube.net
Course Contents (cont.)
Memory Forensics
●
Retrieving process information
●
Windows objects
●
Looking for malware
●
Event logs
●
Registry in memory
●
Reconstructing network artifacts
●
Windows services
●
Windows GUI
●
Filesystems in memory
●
Detecting kernel rootkits
●
Creating timelines
©SecurityTube.net
Course Contents (cont.)
Reversing Windows ●
Command line analysis
Malware tools
●
Windows executables
●
strings
●
Headers ●
Running malware
●
Imports (carefully)
●
Exports
●
Virtual machine setup
●
Capturing network
●
Resources
traffic
●
Obfuscation ●
Leveraging debuggers
●
Dynamic linking
©SecurityTube.net
Course Contents (cont.)
Writing the reports
●
Autopsy
●
Dradis
●
OpenOffice

©SecurityTube.net
Overall Goals
●
Leverage open source (or at least free)
software
●
Hands on practical exercises and demos
throughout
●
Provide the most comprehensive
Windows forensics course available

©SecurityTube.net

You might also like