1. Guidance Encase Enterprise Architecture
GSI SAFE Server
Authentication, Logging, Role based permissions,
The Examiner is where the Analysts Workstation and User Interface. The SAFE can be administered remotely by someone with the “Keymaster” credentials through the Encase Enterprise Examiner
Encase Servlet
Remote Computers with GSI Servlet Installed
Encase Enterprise Examiner

2. Run Threat Analyzer Enscript Module Threat Analyzer Enscript
WPMA.DLL INTEGRATION
Run Threat Analyzer Enscript Module
Threat Analyzer Enscript
Enter Machines, IP Addresses, or Ranges to Scan –
Zeus1
Finance Department Workstations
Research & Development Machines
Web Servers
Encase Examiner with WPMA.dll
Click Next

3. Threat Analyzer Enscript Select Scan Configuration Options -
WPMA.DLL INTEGRATION
Threat Analyzer Enscript
Select Scan Configuration Options -
Run Threat Analyzer Enscript Module
Processes
Processes_Sweep
Drivers
Threads
Devices
SSDT
IDT
Network_Handles
File_Handles
Registry_Handles
VADS
Image_Imports
Image_Exports
DDNA
Signatures
Handle_Tables
Memory_Pools
Heaps x X
Encase Examiner with WPMA.dll
Click Next

4. WPMA.DLL INTEGRATION
Threat analyzer starts to have the servlet send portions of remote physical memory back to the enterprise examiner across the network
Encase Examiner then passes the physical memory to WPMA.DLL for analysis…
WPMA.DLL starts to parse the physmem, then tells Encase what specific addresses it needs from the servlet to complete each SCAN FLAG OPTION
After Completing the SCAN, WPMA.DLL provides Encase with a Threat Score of 1 or Zero. 1 if it’s suspicious and Zero if it is not…

5. All Scan Flags for WPMA.DLL
IMAGE_IMPORTS
IMAGE_EXPORTS
FILE_HANDLES – requires HANDLE_TABLES
REGISTRY_HANDLES requires HANDLE_TABLES
IDT
MEMORY_POOLS
HEAPS
DIGITAL_DNA
SIGNATURES
PROCESSES
PROCESS_SWEEP
DEVICES
DRIVERS
SSDT
VADS
THREADS
NETWORK_HANDLES – requires HANDLE_TABLES
HANDLE_TABLES –
*** This scan is required for:
FILE_HANDLES
REGISTRY_HANDLES
NETWORK_HANDLE
**** This scan extends the capabilities of:

6. Scan Flag Details for WPMA.DLL
PROCESSES Performs a scan using kernel structures to locate processes PROCESS_SWEEP Performs a search of memory for process objects (memory intensive) THREADS Performs a scan using kernel structures to locate threads DEVICES Performs a scan using kernel structures to locate devices DRIVERS Performs a scan using kernel structures to locate drivers HANDLE_TABLES Performs a scan using kernel structures to locate active handles This scan is required for: FILE_HANDLES REGISTRY_HANDLES NETWORK_HANDLES This scan extends the capabilities of: DRIVERS DEVICES FILE_HANDLES Performs a scan using the handle tables to locate open files REGISTRY_HANDLES Performs a scan using the handle tables to locate open registry keys NETWORK_HANDLES Performs a scan using the handle tables to locate open network connections VADS Performs a scan using kernel structures to locate virtual address descriptors IMAGE_IMPORTS Analyzes the import tables for all known images (memory intensive) IMAGE_EXPORTS Analyzes the export tables for all known images (memory intensive) SSDT Performs a scan of the System Service Descriptor Table IDT Performs a scan of the Interrupt Descriptor Table MEMORY_POOLS Performs a scan of the system allocated memory pools HEAPS Performs a scan of each process's heap segments DIGITAL_DNA Generates DDNA hashes of all images (memory, cpu, intensive) SIGNATURES Compare all results to known signatures (cpu intensive)

7. Quick Scan Flags for WPMA.DLL
PROCESSES
PROCESS_SWEEP
DEVICES
DRIVERS
SSDT
VADS