An Ontology for Digital Forensics in IT Security Incidents - OPUS

22 CHAPTER 4. FORENSICS
4.2.3.1 Registry
Information about the registry data can be found in random access memory
and on the hard disk but there is a dierence. In the memory there are parts
of the registry that are only necessary at runtime and can therefore not be
found on the disk. Forensically interesting is the dierence of the data from
the two sources. One cause for dierences is that changes in the registry are
not always immediately written to disk respectively memory. Another one
is that malware tries to manipulate the computer by changing one or both
sources.
The naming of the dierent parts of the registry is inspired by the Microsoft
Windows registry structure. Other conguration stores can also be
mapped to this model even though the main target system is the Microsoft
Windows family.
The registry is made up of hives. Hives are the dierent les that contain
conguration information. One hive contains the data of both sources
to make it easier to spot dierences. The hives themselves have a tree structure,
so every entry in the tree, called key, can have hive-values, the nal
conguration data, and sub-keys. The keys can have a state-ag that tells
whether it can be found only in volatile memory or in both sources. The
hive-values are tuples with key, value and data type of the value. An example
hive is shown in gure 4.3.
As prior mentioned, the conguration of other systems can be mapped
to this structure. For example the conguration of the Gnome Desktop is
also structured as a tree[The GNOME Project, 2011].
4.2.3.2 Network
Similar to the registry data this data is acquired from one or more of the
sources above. Interesting network information include current IP addresses
and connections, gateways, and name server. If the malware for example
wants to redirect the user to manipulated or forged websites it may change
the name server as done by the DNSChanger[Federal Bureau of Investigation,
2011].
4.2.3.3 Other data on a computer
Of course there is more information stored on a computer. One example
are log les. These can provide information about events on the system and
when they occurred. From this perspective they are forensically interesting.
As mentioned in [Kruse and Heiser, 2001, pp 291f] they are not necessarily
trustworthy. At rst logging has to be enabled and working prior to the
incident. Then there is the question about authenticity of the log entries.
Some malware can create and/or edit log entries and thus obfuscate or delete
traces. If the log is for example a normal le on the computer, it is similarly