Tales from the Crypt - TrueCrypt Analysis - SANS
Tales from the Crypt - TrueCrypt Analysis - SANS
Tales from the Crypt - TrueCrypt Analysis - SANS
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Evidence of<br />
File<br />
Download<br />
Evidence of<br />
File Opening/<br />
Creation<br />
Evidence of<br />
File<br />
Knowledge<br />
Evidence of<br />
Program<br />
Execution<br />
XP Search – ACMRU<br />
(REG)<br />
Recent Files<br />
(REG)<br />
Don't Give Up!<br />
Open/Save MRU Open/Run MRU<br />
UserAssist<br />
Win7 Search –<br />
WordWheelQuery<br />
(REG)<br />
LastVisited<br />
MRU<br />
Recent Files<br />
(*.ext)<br />
(REG)<br />
Thumbs.db (Artifact)<br />
RunMRU<br />
Start->Run<br />
E-mail<br />
Attachment<br />
Office<br />
Recent Files<br />
(REG)<br />
Vista/Win7<br />
Thumbnails (Artifact)<br />
MUI<br />
Cache<br />
Skype History<br />
Link Files<br />
(Artifact)<br />
Recycle Bin (Artifact) Browser Artifacts<br />
Win7<br />
Jump Lists<br />
Browser<br />
Forensics<br />
• Index.dat/<br />
Places.sqlite<br />
Index.dat<br />
file:// (IE)<br />
File/Folder Access<br />
(EVT)<br />
Prefetch<br />
Firefox<br />
• Downloads.sqlite<br />
Win7 Jump<br />
Lists<br />
ShellBags MRU<br />
Services<br />
(EVT)
Change language