c2b_default

Bruce Nikkel OS_forensic_artifacts.pdf

Bruce Nikkel OS_forensic_artifacts.pdf

Bruce Nikkel OS_forensic_artifacts.pdf

10
0.0 (0)
R. Z.
Study
R. Z.
This flashcard set covers university-level computer science topics related to forensic analysis of operating systems. It focuses on various OS components such as files, tools, logs, and configurations, including cloud activities, system layers, and user information. The set delves into specialty items, application layer data, and system components like scheduled tasks and kernel information. It is particularly useful for students and professionals in digital forensics who need to understand how to extract and analyze OS-related data for investigative purposes.
Flashcards
10
Students
2
Language
English
Category
Computer Science
Level
University
Created / Updated
21.06.2019 / 01.07.2020
  • 1  / 10

Flashcards

What does the forensic analysis of an OS include?

  • boot and shutdown
  • scheduled tasks
  • installed software
  • user activity
  • system logs
  • system configuration
  • other OS related files

What information can be extracted from the system and kernel?

  • OS version, kernel version
  • kernel config / parameters
  • boot sequence
  • startup services / daemons (systemd, launchctl)
  • old: init.d and rc.d scripts
  • boot up and shutdown times

Fo most of these, no special forensic tools are needed, just knowledge of the OS and files

Name some system components that handle scheduled tasks.

Scheduled jobs / tasks:

  • cron / at
  • systemd timers
  • Windows schtasks
  • user and system jobs are separat

Name some things that can be looked at to identify useractivities.

Human user activity:

  • users and groups 
  • logins, logouts
  • home directories, user files
  • user permissions and security

It is always a challenge to separate human activity from system activity.

What is the problem with information in logs, and wher can logs be found?

Logs tell you a lot (but can be tampered!)

Locations where logs can be found:

  • system logs (dmesg, syslog, journalctl)
  • MS Windows event logs (Linux tool: grokevt, libevtx)
  • log files (/var/log/*)

Name some locations where OS configuration is stored.

OS configuration:

  • Traditional Unix/Linux: files in  /etc
  • MS Windows registry (Linux tools: registry-tools, reglookup)
  • gconf/dconf, plist files, systemd units
  • dot files ~/.config
  • network configuration (DNS, proxy)
  • disk configuration (raid? encryption?)
  • automounted local and remote drives

Name some other interesting OS information.

OS files that are interesting for forensics:

  • temporary files and directories (/tmp, /var/tmp)
  • cache fiesl, prefetch files
  • crash dumps, error report files
  • hibernation files

Name some application layer OS data that is forensically interesting.

Application layer OS data:

  • clipboard data/history
  • last used documents
  • recycle bin, trash cans (these are not filesystem artifacts)
  • OS search queries, index, thumbnails

The difference between OS and applications is sometimes unclear.

Name some specialty items that are forensicaly interesting.

OS specialty items:

  • Personal assistants (Cortana, Siri)
  • proprietary file transfer (Apple Airdrop)
  • Attached synced devices, backup (timemachine)
  • othe closely integrated OS applications

Name some cloud activities that could be forensicaly interesting.

Cloud activity:

  • cloud sync, backup
  • Cached OS cloud artifacts
  • VM instances, distributed/cloud nodes
  • VDI instances
  • thin clients

Study