Guidance Encase Enterprise Architecture GSI SAFE Server Authentication, Logging, Role based permissions, The Examiner is where the Analysts Workstation and User Interface. The SAFE can be administered remotely by someone with the “Keymaster” credentials through the Encase Enterprise Examiner Encase Servlet Remote Computers with GSI Servlet Installed Encase Enterprise Examiner

Run Threat Analyzer Enscript Module Threat Analyzer Enscript WPMA.DLL INTEGRATION Run Threat Analyzer Enscript Module Threat Analyzer Enscript Enter Machines, IP Addresses, or Ranges to Scan 10.10.10.1 – 10.10.20.255 Zeus1 Finance Department Workstations Research & Development Machines Web Servers Encase Examiner with WPMA.dll Click Next

Threat Analyzer Enscript Select Scan Configuration Options - WPMA.DLL INTEGRATION Threat Analyzer Enscript Select Scan Configuration Options - Run Threat Analyzer Enscript Module Processes Processes_Sweep Drivers Threads Devices SSDT IDT Network_Handles File_Handles Registry_Handles VADS Image_Imports Image_Exports DDNA Signatures Handle_Tables Memory_Pools Heaps x X Encase Examiner with WPMA.dll Click Next

WPMA.DLL INTEGRATION Threat analyzer starts to have the servlet send portions of remote physical memory back to the enterprise examiner across the network Encase Examiner then passes the physical memory to WPMA.DLL for analysis… WPMA.DLL starts to parse the physmem, then tells Encase what specific addresses it needs from the servlet to complete each SCAN FLAG OPTION After Completing the SCAN, WPMA.DLL provides Encase with a Threat Score of 1 or Zero. 1 if it’s suspicious and Zero if it is not…

All Scan Flags for WPMA.DLL IMAGE_IMPORTS IMAGE_EXPORTS FILE_HANDLES – requires HANDLE_TABLES REGISTRY_HANDLES requires HANDLE_TABLES IDT MEMORY_POOLS HEAPS DIGITAL_DNA SIGNATURES PROCESSES PROCESS_SWEEP DEVICES DRIVERS SSDT VADS THREADS NETWORK_HANDLES – requires HANDLE_TABLES HANDLE_TABLES – *** This scan is required for: FILE_HANDLES REGISTRY_HANDLES NETWORK_HANDLE **** This scan extends the capabilities of:

Scan Flag Details for WPMA.DLL PROCESSES Performs a scan using kernel structures to locate processes PROCESS_SWEEP Performs a search of memory for process objects (memory intensive) THREADS Performs a scan using kernel structures to locate threads DEVICES Performs a scan using kernel structures to locate devices DRIVERS Performs a scan using kernel structures to locate drivers HANDLE_TABLES Performs a scan using kernel structures to locate active handles This scan is required for: FILE_HANDLES REGISTRY_HANDLES NETWORK_HANDLES This scan extends the capabilities of: DRIVERS DEVICES FILE_HANDLES Performs a scan using the handle tables to locate open files REGISTRY_HANDLES Performs a scan using the handle tables to locate open registry keys NETWORK_HANDLES Performs a scan using the handle tables to locate open network connections VADS Performs a scan using kernel structures to locate virtual address descriptors IMAGE_IMPORTS Analyzes the import tables for all known images (memory intensive) IMAGE_EXPORTS Analyzes the export tables for all known images (memory intensive) SSDT Performs a scan of the System Service Descriptor Table IDT Performs a scan of the Interrupt Descriptor Table MEMORY_POOLS Performs a scan of the system allocated memory pools HEAPS Performs a scan of each process's heap segments DIGITAL_DNA Generates DDNA hashes of all images (memory, cpu, intensive) SIGNATURES Compare all results to known signatures (cpu intensive)

Quick Scan Flags for WPMA.DLL PROCESSES PROCESS_SWEEP DEVICES DRIVERS SSDT VADS