Bruce Nikkel OS_forensic_artifacts.pdf

0.0 (0)

Set of flashcards Details

Flashcards	10
Language	English
Category	Computer Science
Level	University
Created / Updated	21.06.2019 / 01.07.2020
Weblink	https://card2brain.ch/box/20190621_bruce_nikkel_osforensicartifacts_pdf
Embed	<iframe src="https://card2brain.ch/box/20190621_bruce_nikkel_osforensicartifacts_pdf/embed" width="780" height="150" scrolling="no" frameborder="0"></iframe>

Card list

Study

What does the forensic analysis of an OS include?

Keyboard commands:

= turn,

= for-/backward,

= scroll

boot and shutdown
scheduled tasks
installed software
user activity
system logs
system configuration
other OS related files

What information can be extracted from the system and kernel?

Keyboard commands:

= turn,

= for-/backward,

= scroll

OS version, kernel version
kernel config / parameters
boot sequence
startup services / daemons (systemd, launchctl)
old: init.d and rc.d scripts
boot up and shutdown times

Fo most of these, no special forensic tools are needed, just knowledge of the OS and files

Name some system components that handle scheduled tasks.

Keyboard commands:

= turn,

= for-/backward,

= scroll

Scheduled jobs / tasks:

cron / at
systemd timers
Windows schtasks
user and system jobs are separat

Name some things that can be looked at to identify useractivities.

Keyboard commands:

= turn,

= for-/backward,

= scroll

Human user activity:

users and groups
logins, logouts
home directories, user files
user permissions and security

It is always a challenge to separate human activity from system activity.

What is the problem with information in logs, and wher can logs be found?

Keyboard commands:

= turn,

= for-/backward,

= scroll

Logs tell you a lot (but can be tampered!)

Locations where logs can be found:

system logs (dmesg, syslog, journalctl)
MS Windows event logs (Linux tool: grokevt, libevtx)
log files (/var/log/*)

Name some locations where OS configuration is stored.

Keyboard commands:

= turn,

= for-/backward,

= scroll

OS configuration:

Traditional Unix/Linux: files in /etc
MS Windows registry (Linux tools: registry-tools, reglookup)
gconf/dconf, plist files, systemd units
dot files ~/.config
network configuration (DNS, proxy)
disk configuration (raid? encryption?)
automounted local and remote drives

Name some other interesting OS information.

Keyboard commands:

= turn,

= for-/backward,

= scroll

OS files that are interesting for forensics:

temporary files and directories (/tmp, /var/tmp)
cache fiesl, prefetch files
crash dumps, error report files
hibernation files

Name some application layer OS data that is forensically interesting.

Keyboard commands:

= turn,

= for-/backward,

= scroll

Application layer OS data:

clipboard data/history
last used documents
recycle bin, trash cans (these are not filesystem artifacts)
OS search queries, index, thumbnails

The difference between OS and applications is sometimes unclear.

Name some specialty items that are forensicaly interesting.

Keyboard commands:

= turn,

= for-/backward,

= scroll

OS specialty items:

Personal assistants (Cortana, Siri)
proprietary file transfer (Apple Airdrop)
Attached synced devices, backup (timemachine)
othe closely integrated OS applications

Name some cloud activities that could be forensicaly interesting.

Keyboard commands:

= turn,

= for-/backward,

= scroll

Cloud activity:

cloud sync, backup
Cached OS cloud artifacts
VM instances, distributed/cloud nodes
VDI instances
thin clients

1 / 10

Card list

Study

Bruce Nikkel OS_forensic_artifacts.pdf

Create or copy sets of flashcards

Create or copy sets of flashcards

Log in to see all the cards.

SWITCHaai

Office 365

Edulog

Apple ID

Google