System State Backup

The Windows system state backup is in effect a backup of the complete system. Everything that is present within the system will be copied as backup so that no data or information is lost whenever there is a system crash or corruption of the driver files, if certain system files stop the system from functioning properly. To perform a forensic analysis of evidence on a Windows system, backing up a system's registry is insufficient. An extensive backup of data is essential so that the system can be secured against any malfunctions.

This is most commonly an issue when conducting a live analysis.

A full system state backup saves the:

• Active Directory (NTDS),
• Windows Boot files,
• COM+ class registration database,
• Registry,
• System volume (SYSVOL), and
• The IIS metabase.

The process to create a System State Backup is simple:

• Go to Start > Programs > Accessories > System Tools > Backup,
• In the Backup tab, check the System State box,
• Select the Schedule Job tab and Select Add Job button,
• Select Yes and choose the following "media options"
  • Media Type
  • Location 
  • Backup name 
• Select Next and check that the Normal option is selected, and then Select Next again.
• When backing-up to disk there is no need to verify data. Select Next.
• Choose if you want to append to or replace an existing backup. Select Next.
• Schedule the backup. Select Next.
• Set the account to one that has the required permission to run the backup.
• Select Finish.

A good deal of information is available from and is stored within the Windows system state. Don't overlook it.

Craig Wright is a Director with Information Defense in Australia. He holds both the GSE-Malware and GSE-Compliance certifications from GIAC. He is a perpetual student with numerous post graduate degrees including an LLM specializing in international commercial law and ecommerce law as well as working on his 4^th IT focused Masters degree (Masters in System Development) from Charles Stuart University where he is helping to launch a Masters degree in digital forensics. He is engaged in his second doctorate, a PhD on the quantification of information system risk at CSU.