Tese submetida ao "Master of Science in Cyber Systems and Operations", "Naval Postgraduate School", tendo como orientador Neil Rowe. Ficheiro de 734 KB em formato PDF (63 p.).

I. Introduction. A. Problem statement. B. Research methodology. Ii. Windows registry artifacts. A. Commonly used operating systems. B. What is the Windows registry?. C. Link files. Iii. Windows registry information gathering. A. Why use a forensic approach?. B. Usb artifacts point to interesting activity. C. Tools of the trade in Windows registry forensic analysis. 1. Regshot. 2. Regripper. 3. Sysinternals suite. 4. Encase enterprise. D. Cross tool validation. Iv. Forensic methodology for obtaining relevant registry records. A. Windows registry observation goals. B. System set up considerations. 1. Forensic wipe requirements. 2. Windows 10 master copy installation. 3. Encase evidence file. 4. Master copy forensic image creation. 5. Evidence file restoration and external device introduction observations. C. Registry file review. 1. Procmon version 3.10 active monitoring. 2. Encase enterprise observation methodology. 3. Regshot and regripper data collection methodology. V. Identified usb artifacts within the windows 10 registry. A. Procmon findings. 1. Usb artifacts identified. 2. Registry changes documented upon usb removal. B. Regshot and regripper results. C. Encase analysis results. 1. Encase inspection of procmon and regripper identified directories. 2. Directories identified through encase indexed searches. 3. Encase hash analysis results justify the need for index searches. 4. Indexed searches and the identification of deleted values. D. Summary of results. Vi. Conclusions and future work. A. Impact. B. Future work. C. Concluding remark. List of references.