Windows 7 was released this past week. A lot of work by the SANS community has been accomplished at uncovering digital forensic artifacts from it. First off, Windows 7 is really Windows VISTA release 2. Many of the features that are found in Windows Vista will be found in Windows 7.
First of all, all the SANS Digital Forensic Courses have already included up-to-date material fully covering Windows 7 and Vista unlike anyone has done before. In fact, our challenge for SEC408, Computer Forensic Essentials is strictly based off of a Windows Vista case. We have details in SEC408, Computer Forensic Essentials, that are not as covered in peer courses.
Here is just a few things we have helped document regarding Windows 7.
With the release of Vista/Win7, Microsoft significantly changed the folder structure and mechanisms used by the operating system for user profiles. One of these changes was to make roaming profiles more explicit. Roaming profiles allow users to log onto other systems in the domain and have their profile information follow them. They have been around for many years, and in Vista/Win7, Microsoft decided to make what follows a user, and what doesn’t follow a user much more explicit. Hence within a user profile in Vista/Win7, there are now two different set of folders: Roaming and Local. For our purposes, we want to be able to determine where our browser artifacts will be located in this new file structure. Traditionally Microsoft has included cookies in a roaming profile and excluded cache and history files by default. Thus, cookies are now found under the Roaming folder and history and cache can be found within the Local folder.
The major change within Vista/Win7 that affects us when performing browser forensics is the newly implemented “Protected Mode”. The idea is that if malicious code is run in the browser, it will not have the necessary privileges to cause harm to the operating system. Since not all activities using the browser will be unprivileged, a duplicate set of directories were necessary to store files from unprivileged use, called Low folders. An example of what this looks like in the file system is:
%userprofile%\AppData\Local\Microsoft\Windows\History\Low\History.IE5 (for the IE history files)
“Protected Mode” conducts web browsing as an unprivileged user
We discussed full Windows 7 USB Key Analysis in this post: http://blogs.sans.org/computer-forensics/2009/09/09/updated-computer-forensic-guide-to-profiling-usb-thumbdrives-on-win7-vista-and-xp/
We discussed how to perform Windows 7 USB Drive Enclosure Analysis in this post: http://blogs.sans.org/computer-forensics/2009/09/09/usb-key-analysis-vs-usb-drive-enclosure-analysis/
Chad Tilbury discussed detecting defrag analysis here: http://blogs.sans.org/computer-forensics/2009/08/17/de-mystifying-defrag-identifying-when-the-windows-defragmenter-has-been-used-for-anti-forensics-part-2-vista/
Kristinn Guðjónsson developed and released a full scope timeline creation tool called log2timeline that is able to parse many Windows Vista and Windows 7 artifacts in a single simple tool.
Troy Larson from Microsoft has done a wonderful job continuing to discuss the Shadow Volume Copy and ways you can examine them in an investigation. We posted back in 2008 on many of his techniques.
http://blogs.sans.org/computer-forensics/2008/10/10/shadow-forensics/
The work continues: There are many artifacts yet to be uncovered and more work is being done. Keep your eyes peeled on this site and additional sites like Harlan Carvey’s http://windowsir.blogspot.com/ as he is publishing many details as well.
If you have any sites that contains Windows 7 artifact information please post them in comments and Ill update the post as we move forward.
Fonte: http://blogs.sans.org/computer-forensics/2009/10/27/windows-7-computer-forensics/
