Vistaceic2007 from CEIC 2007

First Looks: Basic Investigations of Windows Vista Lance Mueller [email_address]

Example Evidence File ,[object Object],[object Object],[object Object],[object Object],[object Object]

Introduction ,[object Object],[object Object],[object Object],[object Object]

Agenda ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Agenda ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Agenda ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

NTFS Version November 2006 6.0 Windows Vista NTFS 3.1 April 2003 5.2 Windows 2003 NTFS 3.1 September 2001 5.1 Windows XP NTFS 3.1 February 2000 5.0 Windows 2000 NTFS 3.0 August 1996 4.0 Windows NT4.0 NTFS v 1.2 July 1993 3.51 Windows NT3.51 NTFS v 1.2 Released Date OS Version OS Name NTFS Version

Volume Boot Record Common location for VBR using a hard drive with 63SPT. (PS63) New location of VBR in Vista (PS2048)

Symbolic Links ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Last Access Dates ,[object Object],[object Object]

Operating System Versions ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Directory Structure Changes ,[object Object]

Directory Structure Changes ,[object Object],[object Object],[object Object],[object Object]

Directory Structure Changes ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Public Folders ,[object Object]

Volume Shadow Service / Previous Version ,[object Object]

Registry ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Registry ,[object Object],[object Object]

Registry virtualization ,[object Object],[object Object],[object Object]

Virtual Folders ,[object Object],[object Object],[object Object]

RECYCLE BIN ,[object Object],[object Object],[object Object]

Event Logs ,[object Object],[object Object],There are now approximately 30 different event logs that Windows Vista reports events to. Currently these logs can only be read by the native Windows Vista Event Viewer (eventvwr), although an EnCase EnScript is under development.

Windows Search Engine (Indexing) ,[object Object],[object Object]

Windows Search Engine (Indexing) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Windows Photo Gallery ,[object Object]

Contact Manager ,[object Object]

Windows Mail ,[object Object],[object Object]

Windows Firewall ,[object Object],[object Object]

Thumbnail cache ,[object Object],[object Object]

ReadyBoost ,[object Object],[object Object]

Accessing Physical Memory ,[object Object]

Vistaceic2007 from CEIC 2007

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Andere mochten auch

Andere mochten auch (20)

Ähnlich wie Vistaceic2007 from CEIC 2007

Ähnlich wie Vistaceic2007 from CEIC 2007 (20)

Mehr von KarlFrank99

Mehr von KarlFrank99 (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Vistaceic2007 from CEIC 2007