Home Articles Windows 10 Forensics

Windows 10 Forensics

0
2
39,061

In this article, we are going to take a close look at the fundamentally new sources of digital evidences that are typical for the new version of the Windows 10 operating system, such as Notification center, new browser Microsoft Edge and digital personal assistant Cortana. Also, we will study some of the sources that were in the previous versions of the operating system, but format of which was changed, for example, Prefetch-files. We are going to study in details the important source of the digital evidences, which appeared in the Windows XP operating system and that is used in the new version of the operating system – Volume Shadow Copy Service.

Windows 10 Notification ĐĄenter

The Notification center that appeared in the new version of Windows allows programs to display messages on the screen just like it happens in the operating systems of mobile devices. These messages, of course, can contain valuable information for the forensic analysis.

These messages are stored at the file appd.dat, which is located in the following catalog:

<System_partition>\Users\<UserName>\AppData\Local\Microsoft\Windows\Notifications

The analysis of the file via hex-viewer shows that the records about notifications are kept in the XML format (ref. Figure 1).

Figure 1. Fragment of the file appdb.dat opened in the hex-viewer of the AccessData FTK Imager program

As it can be seen on the Figure 1, the XML markup version 1.0 and encoding UTF-8 are used. In this case, there is a notification about received message on the social network “Vkontakte”. The most valuable information is contained in the descriptors <image> and <text>. The descriptor <image> contains the link to the image of a user’s profile who sent the message. The descriptor <text> contains the name of the sender and text of the message. It worth mentioning that there is a set of meandering symbols instead of text on the Figure 1 as the hex-viewer does not support UTF-8 encoding. In order to decode text in <text> descriptors, you can use even some online services, for example https://www.artlebedev.ru/tools/decoder/.

 

Microsoft Edge web-browser

Starting from the Internet Explorer 10, Microsoft developers changed the format of data storing. They replaced index.dat, which was familiar to the most forensic experts, with the database in the ESE format that is stored in the file WebCacheV01.dat.

In spite of the fact that with the release of Windows 10 the developers introduced web-browser – Microsoft Edge, which had code name «Spartan», the traditional for Windows operating system browser Internet Explorer (version 11) still exists, its browsing history is stored in the following catalog:

<System_partition>\Users\<UserName>\AppData\Local\Microsoft\Windows\WebCache

File WebCacheV01.dat, which is stored in the abovementioned catalog, contains not only the browsing history of Internet Explorer, but also the browsing history of the new browser Microsoft Edge. Additionally it stores information about cookies. This database can be in the «Dirty Shutdown» state and it can be an obstacle for the forensic analysis of the data. In order to find out in what state it is, an expert can use the utility esentutl.exe that can be found in the following catalog:

<System_partition>\Windows\System32

In order to receive the information about the database an expert needs to copy the catalog \WebCache to the workstation then open it and put the following command in the command prompt:

esentutl /mh WebCacheV01.dat

On the Figure 2, it can be seen that command output contains, besides the rest of the information, information about current directory, in our case we can see that database is on the «Dirty Shutdown» state (ref. Figure 2).

Figure 2. The result of esentult using with the key /mh

In order to turn the database into the «Clean Shutdown» state, an expert needs to put log-files into it. It can be done by the following command:

esentutl /r V01 /d

The key /d is used in order to command the utility to look for the log-files only in the current directory. When the utility esentutl.exe will be run for the second time with the key /mh, the value of the “State” will be changed into «Clean Shutdown».

Software ESEDatabaseView developed by NirSoft can be used for browsing the database content. In order to get the general information about the types of information contained in the database, an expert needs to go to the table “Containers». In our case, the database contains 28 containers (ref. Figure 3).

Figure 3. Table «Containers» of the WebCacheV01.dat database opened with NirSoft ESEDatabaseView

As it can be seen on the Figure 3, the information about visited web-pages is contained in the containers 2, 14, 15 and 21. This table contains not only the information about the containers, but also the paths to the files with data.

The values of time stamps in this database have to be converted into hexadecimal form and then decoded via, for example, DCode program using the format «Windows: 64 bit Hex Value – Big Endian».

It should be mentioned that the information about web-pages that a user had visited in the «InPrivate» mode is contained in the same containers. These pages have value «8» in the column «Flags» [Muir 2015].

Information about user’s downloads is stored in the container 22 that has name «iedownload». Information in this container is in the hexadecimal form and has to be converted into ASCII.

Files that were cached by the browser are stored in the following catalog:

<System_partition>\Users\<UserName>\AppData\Local\Packages\Microsoft.MicrosoftEdge_***\AC\#!001\MicrosoftEdge\Cache\

Data extraction from the files for analysis in the automatic mode can be done via, for example, Belkasoft Evidence Center.

Cortana

Personal assistant Cortana was realized in the Windows 8 as an application. With the realize of the new version of the operating system Cortana became a part of the system. Even though, the personal assistant is not available in Russian now, an expert needs to understand what kind of artefacts can be found during the analysis.

Information about the usage of the digital personal assistant is stored in the databases in the ESE format – IndexedDB.edb and CortanaCoreDb.dat, which are located in the following catalogs:

<System_partition>\Users\<UserName>\AppData\Local\Packages\Microsoft.Windows.Cortana_xxxx\AppData\Indexed DB\

<System_partition>\Users\<UserName>\AppData\Local\Packages\Microsoft.Windows.Cortana_xxxx\LocalState\ESEDatabase_CortanaCoreInstance\

The first database contains information about data that was indexed by Cortana, the second one contains information about interaction between a user and assistant. It should be mentioned that time stamps of the second database are in the Google Chrome Value format and can be decoded via, for example, Digital Detective DCode.

Prefetch-files

As it is known, Prefetch-files contain metadata (data definitions), which are very important for a digital forensic analysis or computer forensic analysis. For example, these files contain information about the last run of the program and information about how many times it was run. Also by the analysis of prefetch-files, an expert can find out from which logical drive a program was run (including the information about the volume serial number), and get a list of DLL and other files that were used.

Prefetch-files in the Microsoft Windows 10 operating system are still contained in the catalog \Windows\Prefetch\ and have «.pf» extension, but as it was noticed by Francesco Picasso [Picasso 2015: Electronic resource], their format was changed.

Figure 4. Fragment of the VK.EXE-570D9FDD.pf file opened via hex-editor 0xED

As it can be seen on the Figure 4, the files have «MAM» signature and there are no strings. The fact is that the Xpress Huffman algorithm is used for compressing of the files. Francesco Picasso in his article shows the script that was written on the Python programming language and it allows to extract Prefetch-file of the new format. The script can be downloaded from the following link: https://gist.github.com/dfirfpi/113ff71274a97b489dfd.

It should be mentioned that the Microsoft Windows version 8.1 or higher has to be used in order to run the script. A specialized software, for example, Mitec Windows File Analyzer, can be used for extraction data from the file.

Volume Shadow Copy Service

As it is known, volume shadow copy service appeared with the release of the Windows XP operating system. In the Windows XP it allowed to make system recovery via so-called « recovery point» to the previous state of the operating system and it was a valuable source of the information in the context of the forensic analysis as it allowed to recover the previous state of the operating system register. With the release of Windows Vista operating system volume shadow copies start to contain not only the previous versions of the system files, but also they contained user’s data. In the new version of the operating system, this service is still a valuable source of the information for the forensic analysis.

The command prompt (with admin permission) can be used in order to check the list of the shadow copies on the working system. An expert needs to input the command vssadmin list shadows (ref. Figure 5).

Figure 5. Example of the vssadmin list shadows command output

There are programs with a graphical user interface, for example, Shadow Explorer (ref. Figure 6).

Figure 6. List of the shadow copies displayed via Shadow Explorer program

Of course an expert rarely has an access to the working system, usually it happens during crime scene investigation or search incident. Shadow copies can be extracted by VHD method that was offered by Harlan Carvey (ref. Carvey 2014).

First of all, it is required to convert the image (it is better to make bit-stream copy of a system partition separetly) into VHD format (Virtual Hard Disk), via utility vhdtool.exe.

This file has to be mounted in the mode « read-only» in the «Control panel».

An expert can check how many shadow copies there are via the utility vssadmin.exe (for example: vssadmin list shadows /for=n, where n is a letter of the mounted system partition image).

In order to get an access to the files, an expert needs to create a link to the shadow copy that will be analysed. It can be done with a command mklink (for example, mklink /d C:\<mount point> \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy\, a value after mount point can be copied from vssadmin). Then an expert will be able to work with the files stored in the shadow copy.

In this article, we took a close look at the most valuable for forensic analysis artefacts, which appeared in the Microsoft Windows 10 operating system and those appeared in the previous versions of the operating system but still relevant.

References

1.  Muir, B. Windows 10 – Cortana & Notification Center Forensics. – 2015. – URL: http://bsmuir.kinja.com/windows-10-cortana-notification-center-forenics-1724511442

2.  Muir, B. Windows 10 – Microsoft Edge Browser Forensics. – 2015. – URL: http://bsmuir.kinja.com/windows-10-microsoft-edge-browser-forensics-1733533818

3.  Picasso, F. A first look at Windows 10 prefetch files. – 2015. – URL: http://blog.digital-forensics.it/2015/06/a-first-look-at-windows-10-prefetch.html

4.  Carvey, H. Windows Forensic Analysis Toolkit, 4th Edition. Advanced Analysis Techniques for Windows 8. – Waltham: Syngress, 2014. – 350 p.

Authors:

Igor Mikhaylov & Oleg Skulkin

Load More Related Articles
Load More In Articles

No Comments

  1. Brendanrop

    April 16, 2019 at 2:37 pm

    Your comment is awaiting moderation.

    You said this effectively.
    http://viagrawithoutadoctorsntx.com/
    buy cialis soft viagra india
    viagra without a doctors prescription
    average age of viagra users
    [url=http://viagrawithoutadoctorsntx.com/]viagra for sale uk[/url]

    Reply

  2. Brendanrop

    April 16, 2019 at 6:02 pm

    Your comment is awaiting moderation.

    Great write ups. Appreciate it!
    http://viagrawithoutadoctorsntx.com/
    the woman’s viagra cheap viagra discount viagra cialis levitra online canada [url=http://viagrawithoutadoctormsn.com/]generic viagra[/url]
    chewable viagra 100mg
    viagra on line pharmacy
    viagra nitrates
    viagra controindicazioni
    viagra damage
    viagra windsor

    Reply

  3. Brendanrop

    April 16, 2019 at 7:14 pm

    Your comment is awaiting moderation.

    Amazing a good deal of wonderful info!
    http://viagrawithoutadoctorsntx.com/
    side effects on viagra for women generic viagra 100mg vicodin viagra cialis [url=http://viagrawithoutadoctormsn.com/]generic viagra 100mg[/url]
    viagra mechanism
    liquid viagra porn industry
    chinese viagra pills
    cheap but effective alternative to viagra
    viagra bank fraud
    correct way to take viagra

    Reply

  4. Brendanrop

    April 16, 2019 at 7:23 pm

  5. Brendanrop

    April 16, 2019 at 7:26 pm

    Your comment is awaiting moderation.

    Really lots of valuable tips.
    http://viagrawithoutadoctorsntx.com/
    herbal viagra india buy viagra viagra canine prescription [url=http://viagrawithoutadoctormsn.com/]cheap viagra[/url]
    effects of viagra on child birth
    old man and viagra
    subaction showcomments viagra smile older
    viagra for diabetes
    fed oysters viagra
    blood pressure medications simular to viagra

    Reply

  6. Brendanrop

    April 16, 2019 at 7:38 pm

    Your comment is awaiting moderation.

    Thanks. Valuable information.
    http://viagrawithoutadoctormsn.com/
    epinephrine viagra contradiction viagra for sale uk half viagra [url=http://viagrapego.com/]viagra without a doctors prescription[/url]
    divide viagra three equal pieces
    viagra premature
    viagra meltabs softabs
    viagra pill sizes
    professional viagra discussions blogs
    viagra v lavrita

    Reply

  7. Brendanrop

    April 16, 2019 at 8:19 pm

    Your comment is awaiting moderation.

    Nicely put, Many thanks!
    http://viagrawithoutadoctormsn.com/
    file viewtopic t 71 viagra viagra generic cnn watermelon viagra [url=http://viagrapego.com/]viagra for women[/url]
    shop for viagra
    tobacco edinburgh search thought viagra pages
    generic viagra online cashiers check
    chocolate viagra for women
    viagra email
    viagra sales growth chart for 2011

    Reply

  8. Brendanrop

    April 16, 2019 at 9:24 pm

    Your comment is awaiting moderation.

    Kudos. A good amount of facts!

    http://viagrapego.com/
    viagra sub lingua viagra for sale uk buy viagra in perth [url=http://viagrawithoutadoctorsntx.com/]buy viagra online[/url]
    viagra sale buy
    cialis levitra strong strong viagra
    what is generic viagra called
    max raabe viagra
    apcalis vs viagra
    sending viagra emails

    Reply

  9. Brendanrop

    April 16, 2019 at 10:34 pm

  10. Brendanrop

    April 16, 2019 at 11:51 pm

    Your comment is awaiting moderation.

    You actually expressed it very well!
    http://viagrawithoutadoctorsntx.com/
    order viagra softtabs viagra for women viagra headquarters in toronto canada [url=http://viagrapego.com/]generic viagra 100mg[/url]
    viagra and prostate cancer
    cheap geneirc viagra 50 cents
    free viagra powered by vbulletin
    cutting viagra pill in half
    ordering generic viagra in canada
    viagra suppliers in the uk

    Reply

  11. Brendanrop

    April 17, 2019 at 2:11 am

  12. Kennethtof

    April 17, 2019 at 5:32 am

    Your comment is awaiting moderation.

    You said it very well..
    http://viagrapego.com/
    cialis tadalafil beter dan viagra viagra pills girl rides viagra cock [url=http://viagrapego.com/]cheap viagra[/url]
    where to get viagra or cialis
    order genuine viagra online consultation
    does viagra effect a womans libido
    allentown viagra
    viagra purchases
    search viagra viagra find edinburgh pages

    Reply

  13. Kennethtof

    April 17, 2019 at 5:49 am

  14. Kennethtof

    April 17, 2019 at 7:14 am

    Your comment is awaiting moderation.

    Good info. Many thanks!
    http://viagrawithoutadoctormsn.com/
    diet when taking viagra viagra generic rx viagra lexington [url=http://viagrawithoutadoctorsntx.com/]buy viagra online[/url]
    viagra protester
    viagra trials private instruction
    duct tape instad of viagra
    viagra mechanism of action
    vipps approved viagra
    presidents in viagra commercial

    Reply

  15. Kennethtof

    April 17, 2019 at 7:17 am

    Your comment is awaiting moderation.

    Appreciate it, Lots of data.

    http://viagrawithoutadoctormsn.com/
    viagra cialis levitra cheep drugs viagra without a doctor prescription does viagra give better orgasm [url=http://viagrawithoutadoctorsntx.com/]viagra 100mg[/url]
    increased cost of viagra
    hiden camera gay video druged viagra
    viva viagra play list
    viagra name order viagra
    viagra auxiliary labels
    how is priapism treated from viagra

    Reply

  16. Kennethtof

    April 17, 2019 at 7:30 am

    Your comment is awaiting moderation.

    Thank you! Loads of forum posts.

    http://viagrapego.com/
    forced feminization viagra story viagra pills viagra pills without a prescription [url=http://viagrawithoutadoctorsntx.com/]generic viagra[/url]
    viagra purchase uk
    viagra wisecracks
    oysters viagra
    order viagra softtabs
    compare cialis and viagra
    herbal viagra in the uk

    Reply

  17. Kennethtof

    April 17, 2019 at 8:13 am

    Your comment is awaiting moderation.

    Very good knowledge. Thank you.
    http://viagrapego.com/
    viagra online without perscription buy generic viagra viagra large items [url=http://viagrawithoutadoctorsntx.com/]viagra for sale uk[/url]
    using less viagra
    what is the generic for viagra
    tramadol and viagra interaction
    sex after taking viagra
    viagra free sites computer find search
    viagra trh pharmacy

    Reply

  18. Kennethtof

    April 17, 2019 at 9:21 am

    Your comment is awaiting moderation.

    Point nicely taken!!
    http://viagrapego.com/
    generic viagra soft-100 chewable viagra without a doctors prescription patient responses to viagra [url=http://viagrawithoutadoctormsn.com/]buy viagra[/url]
    wiki viagra
    is generic viagra real
    viagra 3
    taking viagra after cialis
    viagra homepage
    viagra and metoprotol interaction

    Reply

  19. Kennethtof

    April 17, 2019 at 10:34 am

  20. Kennethtof

    April 17, 2019 at 1:24 pm

    Your comment is awaiting moderation.

    Fantastic content. Cheers.
    http://viagrapego.com/
    3generic sildenafil viagra viagra generic buy uk viagra [url=http://viagrapego.com/]cheap viagra[/url]
    viagra positive effects
    search viagra viagra find edinburgh sites
    sales online viagra sale
    viagra soft tabs next day
    viagra use for women
    viagra from canadian pharmacy

    Reply

  21. Kennethtof

    April 17, 2019 at 1:27 pm

    Your comment is awaiting moderation.

    You actually revealed it effectively!
    http://viagrawithoutadoctorsntx.com/
    fill pussy with viagra viagra pills viagra and schedule [url=http://viagrapego.com/]viagra 100mg[/url]
    generaic viagra
    viagra photo woman
    wanda sykes viagra
    cheap prescription viagra
    smell sensitivity with viagra
    soft tabs viagra

    Reply

  22. Kennethtof

    April 17, 2019 at 1:41 pm

    Your comment is awaiting moderation.

    Cheers. I appreciate it!
    http://viagrawithoutadoctorsntx.com/
    pc100 viagra viagra pills medications that interfere with viagra [url=http://viagrawithoutadoctormsn.com/]viagra 100mg[/url]
    viagra for womenhot
    online viagra prescriptions
    spam viagra
    half a 100mg viagra
    home grown viagra
    has anyone injected viagra

    Reply

  23. Kennethtof

    April 17, 2019 at 2:25 pm

    Your comment is awaiting moderation.

    Thank you. An abundance of information!

    http://viagrawithoutadoctorsntx.com/
    interferes with viagra cheap viagra cialis viagra on line [url=http://viagrawithoutadoctormsn.com/]buy generic viagra[/url]
    buy viagra from canada
    u id password viagra
    milked after viagra
    alchole and viagra
    viagra usage reviews
    viagra patent up

    Reply

  24. Kennethtof

    April 17, 2019 at 3:34 pm

    Your comment is awaiting moderation.

    Seriously plenty of good tips.
    http://viagrawithoutadoctormsn.com/
    how many men take viagra buy viagra viagra dosage effects [url=http://viagrawithoutadoctormsn.com/]viagra without a doctor prescription[/url]
    affiliate generic viagra
    aspirin and viagra
    viagra kamagra cialis aneros
    diseases and conditions impotence viagra
    what is female viagra
    viagra and statins

    Reply

  25. Kennethtof

    April 17, 2019 at 4:49 pm

    Your comment is awaiting moderation.

    Nicely put, Thanks.
    http://viagrawithoutadoctorsntx.com/
    viagra insurance 2005 generic viagra online viagra experiences from real people [url=http://viagrawithoutadoctormsn.com/]buy viagra[/url]
    prescription for ordering viagra
    kamagra kamagra kamagra lovegra uk viagra
    viagra fsa
    does viagra work under the tongue
    bignickandsons viagra
    viagra and weight lifting

    Reply

  26. Kennethtof

    April 17, 2019 at 5:56 pm

    Your comment is awaiting moderation.

    Nicely put. Appreciate it!
    http://viagrawithoutadoctormsn.com/
    viagra sildenafil viagra generic viagra online canda [url=http://viagrawithoutadoctorsntx.com/]viagra without a doctor prescription[/url]
    improve viagra effectiveness
    viagra movie
    medicaid coverage viagra
    viagra by overnight delivery
    viagra galloway
    viagra email list

    Reply

  27. Kennethtof

    April 17, 2019 at 6:14 pm

    Your comment is awaiting moderation.

    Valuable data. Cheers.
    http://viagrawithoutadoctorsntx.com/
    viagra and masterbation generic viagra 100mg levitracialis comparison levitra viagra [url=http://viagrapego.com/]generic viagra 100mg[/url]
    combining viagra and cialis
    viagra alternive
    combining viagra and regalis
    emphysema primary pulmonary hypertension viagra
    english viagra
    irish viagra

    Reply

  28. Kennethtof

    April 17, 2019 at 7:45 pm

    Your comment is awaiting moderation.

    Many thanks, Quite a lot of posts.

    http://viagrawithoutadoctorsntx.com/
    where to purchase viagra viagra 100mg when to take viagra [url=http://viagrawithoutadoctormsn.com/]viagra 100mg[/url]
    indian viagra
    citrulline viagra
    viagra ads
    viagra drug scams
    viagra oster
    viagra drug company

    Reply

  29. Kennethtof

    April 17, 2019 at 8:01 pm

    Your comment is awaiting moderation.

    Thank you! Useful information.
    http://viagrawithoutadoctorsntx.com/
    viagra ginko generic viagra viagra direct [url=http://viagrawithoutadoctormsn.com/]viagra generic[/url]
    free coupons viagra
    rush limbaugh dominican republic viagra
    hosta rosedale viagra
    dad viagra
    viagra dose for juniors
    is viagra safe for diabetics

    Reply

  30. Kennethtof

    April 17, 2019 at 8:47 pm

    Your comment is awaiting moderation.

    Thanks, Helpful information.
    http://viagrapego.com/
    viagra official site spam cheap viagra awesome viagra bull [url=http://viagrawithoutadoctormsn.com/]generic viagra[/url]
    natural viagra alternative
    viagra alternative natural suplements
    safe to take viagra with phentermine
    required medical checkup for viagra
    viagra 3
    cheap viagra from mexico

    Reply

  31. Kennethtof

    April 17, 2019 at 9:59 pm

  32. Kennethtof

    April 18, 2019 at 12:25 am

    Your comment is awaiting moderation.

    You actually stated that terrifically.
    http://viagrawithoutadoctorsntx.com/
    subaction showcomments viagra smyle older buy viagra online buy viagra in las vegas [url=http://viagrapego.com/]viagra pills[/url]
    viagra addiction
    viagra search find edinburgh sites pages
    viagra patents
    elvis and viva viagra
    does viagra work for women
    seduced amanda and viagra

    Reply

  33. Kennethtof

    April 18, 2019 at 12:44 am

    Your comment is awaiting moderation.

    Nicely put, Thanks a lot!
    http://viagrawithoutadoctorsntx.com/
    pro viagra viagra online viagra partial dose [url=http://viagrawithoutadoctorsntx.com/]viagra for women[/url]
    viagra and recommended dosage
    can viagra aggravate hemorrhoids
    viagra side effects long term
    viagra and dieting
    viagra uk chemist non prescription
    what does viagra cost at walgreens

    Reply

  34. Kennethtof

    April 18, 2019 at 2:16 am

    Your comment is awaiting moderation.

    With thanks, Good information.
    http://viagrapego.com/
    viagra and watermelon viagra 100mg pepsi viagra joke mount and dew [url=http://viagrawithoutadoctormsn.com/]viagra without a doctor prescription[/url]
    online drug stores viagra
    subaction showcomments viagra start from watch
    purchase viagra on line
    videos viagra
    viagra propecia propecia xenical xenical celebrex
    bodybuilding viagra

    Reply

  35. Kennethtof

    April 18, 2019 at 2:19 am

    Your comment is awaiting moderation.

    You said it very well.!
    http://viagrapego.com/
    canadian viagra costs viagra online sample viagra packages [url=http://viagrapego.com/]generic viagra online[/url]
    viagra usage reviews
    viagra leicester po box
    viagra discussion board
    contents of viagra
    second best to viagra
    viagra mouse virus

    Reply

  36. Kennethtof

    April 18, 2019 at 3:20 am

    Your comment is awaiting moderation.

    Nicely put. Appreciate it.
    http://viagrawithoutadoctormsn.com/
    compra viagra italia buy viagra murphy viagra [url=http://viagrawithoutadoctorsntx.com/]generic viagra 100mg[/url]
    viagra frequency of priapism
    renova viagra renova
    pfizer viagra trial offer
    viagra scam emails
    slogans for viagra joke
    viagra supplier in the uk

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *