000			02518nam a2200253 4500
001			393505
090			_a393505
100			_a20151008d2015 y0pory50 ba
101			_aeng
200			_aExposing vital forensic artifacts of USB devices in the Windows 10 registry _bRecurso eletrónico _fJason S. Shaver
210			_aMonterey _c[s.n.] _d2015
215			_a1 CD-ROM _d12 cm
300			_aTese submetida ao "Master of Science in Cyber Systems and Operations", "Naval Postgraduate School", tendo como orientador Neil Rowe. Ficheiro de 734 KB em formato PDF (63 p.).
330			_aI. Introduction. A. Problem statement. B. Research methodology. Ii. Windows registry artifacts. A. Commonly used operating systems. B. What is the Windows registry?. C. Link files. Iii. Windows registry information gathering. A. Why use a forensic approach?. B. Usb artifacts point to interesting activity. C. Tools of the trade in Windows registry forensic analysis. 1. Regshot. 2. Regripper. 3. Sysinternals suite. 4. Encase enterprise. D. Cross tool validation. Iv. Forensic methodology for obtaining relevant registry records. A. Windows registry observation goals. B. System set up considerations. 1. Forensic wipe requirements. 2. Windows 10 master copy installation. 3. Encase evidence file. 4. Master copy forensic image creation. 5. Evidence file restoration and external device introduction observations. C. Registry file review. 1. Procmon version 3.10 active monitoring. 2. Encase enterprise observation methodology. 3. Regshot and regripper data collection methodology. V. Identified usb artifacts within the windows 10 registry. A. Procmon findings. 1. Usb artifacts identified. 2. Registry changes documented upon usb removal. B. Regshot and regripper results. C. Encase analysis results. 1. Encase inspection of procmon and regripper identified directories. 2. Directories identified through encase indexed searches. 3. Encase hash analysis results justify the need for index searches. 4. Indexed searches and the identification of deleted values. D. Summary of results. Vi. Conclusions and future work. A. Impact. B. Future work. C. Concluding remark. List of references.
606			_aINFORMÁTICA FORENSE _9326850
606			_aCRIME INFORMÁTICO _9301395
606			_aSISTEMA OPERATIVO _9308981
606			_aTESE _9334284
606			_aESTADOS UNIDOS _9334103
700			_aSHAVER _bJason S. _9357864
955			_xOferta