Computer Forensics: Investigations Procedures and Responses (Chapter 7)
How FireFox stores internet data
It uses cache folders
Internet history
Stores URLs of visited websites, searches, downloaded/opened files, emails that have been sent/viewed through Outlook History\History.IE5\index.dat
index.dat cookies
Stores data written by web sites to the computer system. This is basically a log of all cookies written.
NTUser.dat
Stores information about a particular user There is an NTUSER.dat file for each user Includes browser history
Private browsing
It isn't logged in the internet history, but evidence can still be found in the registry and cache (including images, etc.)
HKEY
short for "handler to key"
The creation date of a .lnk file
When the underlying file was first opened
EXIF Data
"Exchangeable Image File" standard mostly used for JPEG compressed images can also be viewed natively in hexadecimal format
What is the Windows registry made up of
"keys" which act like folders
Cookies
A cookie is a file created by a web browser that is saved to the client machine Cookies are often used to save settings and track usage Cookies\index.dat
3 types of logs displayed by the event viewer by default
Application log: This log contains events generated by applications. For example, a spreadsheet program might save a file missing or corrupted error in this log. Security log: The system administrator can specify which events to log. Login attempts are commonly logged here. File management may also be logged. System log This logs stores events relating to system components, such as errors produced by drivers
Index.dat location for Windows XP
C:\Documents and Settings\<username>\Cookies\index.dat C:\Documents and Settings\<username>\Local Settings\History\History.IE5\index.dat C:\Documents and Settings\<username>\Local Settings\History\History.IE5
Significant Points of Evidence in Windows Systems
Internet History LINK Files AKA "Recents" Thumbs.db/thumbcache.db Document/Image MetaData Activity logs Registry
Temporary Internet Cache
Cached webpages and multimedia content from websites visited by the user Previously cached websites are still available offline Allows websites to quicker the next time they are visited Temporary Internet Files\Content.IE5\index.dat
5 types of events logged by the Event Viewer
Error-a serious problem, such as a service that fails to start or data that has been lost. Warning-a possible problem, such as low space. Information-an event that is new or successful, such as loading a new driver. Success Audit-a security event, such as a login attempt, that succeeds. Failure Audit-a security event, such as a login attempt, that fails.
Three separate concepts that index.dat is based on
History Cookies Temporary Internet Files
Information contained on Windows Registry
Keeps track of user and system configuration and preferences - Search terms - Programs that were run or installed - Web addresses - Files/software that have been recently opened
Three types of index.dat files
Master - contains overall current history Daily - stored within folder containing date range. One folder for each day Weekly - Stored within folder containing date range. When week ends, a new folder is created and the dailies are deleted.
Thumbs.db
System-generated file that catalogues images/movies Used to view thumbnail representations of files Automatically generated when a user requests to see thumbnail view (or folder is defaulted as such)
How can internet history be reconstructed?
Temporary Internet Cache History files (index.dat)
Scienter
a legal term that refers to intent or knowledge of wrongdoing
index.dat Temporary Internet Cache
assists IE in loading cached pages to improve browsing speed Pages may be renamed when cached and that information is stored here may be a place to look for evidence of web based email
Analysis of the thumbs.db file
can assist in recreating the history of a folder; or track the movement of a file
Microsoft Management Console (MMC)
contains a number of tools for monitoring and managing systems - Windows Event Viewer
HKEY_CURRENT_CONFIG
contains configuration information regenerated when the system boots.
HKEY_USERS
contains subkeys corresponding to the HKEY_CURRENT_USER keys for each registered user on the machine
index.dat
file created by internet explorer which stores information about the internet history on a computer.
file header/signature
is at the beginning of the file and programs use this signature to associate files with programs - This is why a document file can be given a .LAM extension and Word will still open it as a document file when asked
LINK Files
shortcuts that point to other files can be created by the user or by the computer Files with a .lnk extension created when registered files are opened in Windows Listings in the Recent Documents are link files
Windows Registry
simply a database for configuration files Like the computer's central nervous system
HKEY_LOCAL_MACHINE
stores general settings for all users on the computer.
HKEY_CLASSES_ROOT
stores information about registered applications.
HKEY_CURRENT_USER
stores settings for the user currently logged in.