Quick Win Data Forensics prioritizes locating, extracting, and processing the 1 percent of digital evidence you need to move a case forward.
Given that 99 percent of the necessary evidence typically will exist in 1-2 percent of the data acquired, it is easy to see how a great deal of time can be wasted following the normal procedures in today's digital forensics world. Instead, let us focus on this 1-2 percent and perform a very rapid triage collection that can be used to start our investigation sooner!
Far too often, computers are seized in an "on" state, and immediately powered down because, "that is how we've always done it." With today's computers, this means you are throwing away (essentially destroying) many gigabytes of data. The RAM in a computer holds a treasure trove of data, from keystrokes to network connections, running services, and, quite importantly, passwords and decryption keys. With the vastly increasing spread of file-less malware, in many cases the only place that evidence will exist is in memory. Another often-overlooked factor is full disk encryption. In cases like this, "live" acquisition will be your only hope.
In these episodes you will learn:
Top 5 “Quick Win” files in Battlefield Forensics
"Quick Win” files #1 - The Registry
“Quick Win” files #2 - Jumplists
Setting CLI tools to run from any path in Windows 10
“Quick Win” files #3 - .LNK file
“Quick Win” files #4 - Shellbags
“Quick Win” files #5 - Prefetch
The topics covered in the videos below are just excerpts of what the FOR498: Battlefield Forensics & Data Acquisition course teaches. For more information or to register for the course visit here