Brendan Dolan-Gavitt Georgia Institute of Technology - SANS

More documents

Recommendations

Info

Hivelist Example $ volatility hivelist -f image.dd -o 0x2837008 Address Name 0xe2610b60 \Documents and Settings\S----\Local Settings\[...]\UsrClass.dat 0xe25f0578 \Documents and Settings\S----\NTUSER.DAT 0xe1d33008 \Documents and Settings\LocalService\Local Settings\[...]\UsrClass.dat 0xe1c73888 \Documents and Settings\LocalService\NTUSER.DAT 0xe1c04688 \Documents and Settings\NetworkService\Local Settings\[...]\UsrClass.dat 0xe1b70b60 \Documents and Settings\NetworkService\NTUSER.DAT 0xe1658b60 \WINDOWS\system32\config\s<strong>of</strong>tware 0xe1a5a7e8 \WINDOWS\system32\config\default 0xe165cb60 \WINDOWS\system32\config\SAM 0xe1a4f770 \WINDOWS\system32\config\SECURITY 0xe1559b38 [no name] 0xe1035b60 \WINDOWS\system32\config\system 0xe102e008 [no name]
VolReg: Printkey • Given a hive address and a key, prints the key and its subkeys and values • Shows last modified time, formats values according to type • Includes volatile keys & values as well • Good for just looking around
Page 1 and 2: Registry Analysis and Memory Forens
Page 3 and 4: Overview
Page 5 and 6: • Registry Analysis • Memory Fo
Page 7 and 8: • Registry Analysis • Memory Fo
Page 9 and 10: Windows Registry (cont.) • Regist
Page 11 and 12: Registry Forensics Tools • RegLoo
Page 13 and 14: Memory Forensics Tools • Memoryze
Page 15 and 16: Combining Registry and Memory Analy
Page 17 and 18: Solution: VolReg • Suite of plugi
Page 19: VolReg: Hivelist • Given one of t
Page 23 and 24: VolReg: Hashdump • Local account
Page 25 and 26: Others (not shown) • Cachedump: d
Page 27 and 28: Solution: VolRip • Python→Perl
Page 29 and 30: VolRip Example: Tracking USB Keys $
Page 31 and 32: Caveats • Since analysis is done
Page 33: ? Thanks! • To you all, for liste

Brendan Dolan-Gavitt Georgia Institute of Technology - SANS

Create successful ePaper yourself

Delete template?

Save as template?