Cartes-fiches

Cartes-fiches 15 Cartes-fiches
Utilisateurs 2 Utilisateurs
Langue English
Niveau Université
Crée / Actualisé 20.06.2019 / 01.07.2020
Attribution de licence Non précisé
Lien de web
Intégrer
0 Réponses exactes 15 Réponses textes 0 Réponses à choix multiple
Fermer la fenêtre

Name some common user applications.

  • web browser
  • email client
  • office suite
  • file managers
  • media players
  • photo / piv vieweres/managers
  • social media apps, cloud sync/connect apps

 

Fermer la fenêtre

name some examples of professional applications that leave artifacts

  • financial software
  • company developted fat clients
  • scientific, engineering apps
  • industrial control apps
Fermer la fenêtre

what are some special intrest apps that leave traces?

  • bitcoin wallets and clients
  • file-sharing apps
  • TOR clients
  • hack/crack/exploit tools
  • malware binaries
Fermer la fenêtre

application forensic analysis involves the examination of what?

Application forensic analysis involves examination of:

  • installation date, last used
  • configuration, plugins, user preferences
  • log data, and audit trails
  • persistent data (cookies, cache, objects, recents [eg. recent files in word])
  • user activity over time
  • application data/content
  • additional application meta-data in data/content
  • abuse or misuse of an application
  • correlate timestamps with other times (logs,physical access logs, CCTV, etc)
Fermer la fenêtre

What are some charecteristics of application data files?

  • use open standards or proprietry formats
  • magic string (#!/bin/bash)
  • some files containers may be compressed or encrypted
  • dome files may have many nested files (emails with attachments)
Fermer la fenêtre

what does the linux file command do?

The linux file command is used to identify file formats

Fermer la fenêtre

What should you always do when viewing typical files (office documents, pictures, music, etc...) with a standard viewers?

Always use a write-blocker or read only image to prevent data being writen do the image by viewers.

Fermer la fenêtre

What are the problems when dealing with proprietary formats?

Proprietary formats:

  • need reverse engineering to access the file
  • pay for licenses to access the file 
  • use existing proprietary tools to extract data
  • commercial forensic tools are very good with proprietary data