NETS1032

Working with Microsoft Filesystems Images

Introduction

This lesson provides some conceptual and practical information on processes, tools, and considerations for working with captured images of Microsoft Filesystems.

For your lab work, ensure you have access to both a Linux desktop environment with root, and a Windows desktop with Administrator. You will be showing your work to the professor throughout the semester, so you will need to be able to share your lab system screen, and the lab system you use will need to be clearly identified as your own (you should use your own name for the login, or at least something unique to you). No marks will be given for showing work on a lab system which is not your own.

Learning Objectives

At the end of this lesson, students will:

• Understand what Microsoft Filesystems Contain, including metadata
• Begin to explore the kinds of artifacts that might be of interest in Microsoft Filesystems
• Begin using tools for Analyzing Microsoft Filesystem Images
• Demonstrate using Autopsy to work with metadata and deleted files
• Demonstrate using ProDiscover to find evidence
• Demonstrate finding information in a Microsoft filesystem image using Access Data’s registry viewer

These objectives are in support of Learning Outcomes 2, 3, 4, and 6 in the Course Outline.

To do List

• Read through the presentation
• Watch the videos described in the presentation
• Watch the recorded video of the presentation found in the general chat of the Microsoft Team for this course if you did not attend the class when it was presented
• Review the lesson materials linked below
• Perform the learning activities as described below
• Do the quiz found under Tests on Blackboard for this topic

Lesson Material

• Working with Microsoft Filesystems Presentation in PDF format
• See Blackboard for any available prerecorded video of this presentation under Weekly Learning

Learning Activity

Watch the videos from the presentation, as well as the videos listed under additional resources. Briefly review the materials available at the other websites listed under Additional Resources. Do the Microsoft Filesystem Analysis Assignment

Additional Resources

Videos

• 16 minute video showing filtering in BEC for artifacts of interest in a disk image
• Video demo of viewing registry artifacts using BEC

Software Tools for Microsoft filesystems forensic analysis

• Autopsy
• RegRipper
• Belkasoft Evidence Center
• AccessData Registry Viewer Download
• FTK demo
• How to examine Microsoft LNK files
• RDPieces script for reconstructing RDP session images

General resources

• Digital Forensics Tool Testing image investigations examples
• SANS Windows Forensics Poster
• Belkasoft Evidence Center tutorial videos

Standards references, a starting point

• FAT12/16/32 and VFAT technical description
• FAT/NTFS technical descriptions, discussion, resources, and uses
• Microsoft Technet FAT reference

Graded Activity

The lab instructions tell you what parts of the lab activity are graded, and when you need to be capturing screenshots during the lab.

Quiz

The quiz is found on Blackboard under Assignments and Tests.

Test

There is no separate test for this topic. The quiz will count for your testing mark in this topic.

Summary

In this module, you have been introduced to working with Microsoft filesystems images. You should now be:

• Aware of the uses and limitations of selected forensic tools for investigating Microsoft Filesystem Images
• Familiar with the kinds of evidence that can be found in a Microsoft filesystem
• Capable of selecting tools for working with Microsoft filesystems images, both hardware and software

Completing the quiz will provide you with a measure of your knowledge in these areas. For the next class you should have your computing environment available with access to both Linux and Windows.