Shadow Warriors - SANS Computer Forensics

More documents

Recommendations

Info

Useful Data Wiped/Erased Files File Movements File Access Link Files Overwritten Files/Data Older Versions of Files Old Registry Entries Etc
<strong>Shadow</strong> File Creation
Page 1 and 2: Shadow Warriors Lee Whitfield & Mar
Page 3 and 4: • 19+ years in IT Mark McKinnon
Page 5 and 6: What are Volume Shadow Copies?
Page 7: What Does This Mean?
Page 11 and 12: 16KB Block 16KB Block = Occupied 4K
Page 13 and 14: File Carve
Page 16 and 17: Anatomy of Volume Shadow Copies
Page 18 and 19: Index Blocks
Page 20 and 21: 6B 87 08 38 76 C1 48 4E B7 AE 04 04
Page 22 and 23: Bytes 0-7 contain the volume logica
Page 24 and 25: Bytes 28-31 All zeroes unless prece
Page 27 and 28: 4520914944 % 16384 = 12288
Page 29: 00 00 00 C0 15 00 00 00 00 80 77 0D
Page 32 and 33: Deleted, unallocated, and corrupt V
Page 34 and 35: Current Files
Page 37 and 38: • View the contents of the hard d
Page 39 and 40: Will run on XP upwards, OS X, and L
Page 41: Thank you twitter.com/shadowanalyze

Shadow Warriors - SANS Computer Forensics

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?