Harlan Carvey, CISSP, is a computer security engineer and book author. He has conducted penetration tests and vulnerability assessments in support of corporate and federal government clients. He has also performed a wide range of incident response activities, and conducts computer forensics research, with specific attention to the Microsoft Windows family operating systems. In this interview, he discusses Windows forensics, forensics in general, as well as his latest book.
How has Windows forensics evolved since the days of Windows XP? What does Windows 7 bring to the table?
Microsoft has a well-established habit of changing things up for forensic analysts... look at how memory analysis changes not only between versions of Windows, but in some cases, between Service Packs. Between XP and Vista, there were changes in how some information is recorded in files on the system, in particular in the Registry and the Event Logs.
As Microsoft "evolves" the user experience and adds complexity and functionality to the operating system and applications, what we're seeing isn't necessarily that forensic artifacts are going away, but rather that they're moving. As such, there's been a great deal of research in the community to map those artifacts, but the fact remains that there needs to be a great deal more in order to understand what interactions lead to the creation or modification of an artifact.
To Continue Reading: Click Here
----------------------------------------------------
Source: net-security.org
By: Mirko Zorz
Subscribe to:
Post Comments (Atom)
0 comments:
Post a Comment