Identifying Malicious Code Infections Out of Network

Best practices have evolved within the forensic industry over the past few years to address an emerging need for organizations to properly handle malicious code incidents. While this area of forensics is increasingly strong, the industry at large struggles with how to approach forensic analysis of images that are not from one's own network (e.g. image sent to consultant for analysis). Furthermore, many forensic practitioners lack tools and tactics to exhaustively research and report on malicious code infections that may exist on such media. Real-world case studies (sanitized) are used in this report to identify challenges that forensic analysts face given such tasks and best practices for researching malicious code events on Windows computers.