1. Real Forensics The hard way

2. Data Recovery What data/evidence can you retrieve from a hard drive. Usually dd is good enough Sometimes real help is needed

3. Real Help Hard Drive recovered from Columbia Shuttle accident February 1, 2003 400 Mbyte http://www.sciam.com/article.cfm?id=hard-drive-recovered-from-columbia 99% of the data was recovered from a Xenon shear thinning experiment

4. Hard Drive Mounted on Plate

5. HDD Internals

6. Ontrack Data Recovery Probably: –Remove the platters and cleaned them. –Rebuilt the Spindle assembly –Mounted in a new case –Exercised in a clean room

7. Hard Drive Architecture

9. HDD Capacity 10,000 `2015

10. MRU Lists Most Recently Used Lists

11. Best Known HKEY_CURRENT_USER\Software\Micro soft\Windows\CurrentVersion\Explorer\Rec entDocs A MRU list for about every application Used by the app to list your last accessed docs from that app.

12. PowerPoint

13. Which was the last one? FirstSecond

14. RunMRU Most recently run programs the the Run Command. cmd regedit msconfig

15. Typed URLs HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs

16. Opened and Saved MRUs Chronological list of Opened/Saved files

17. Opened and Saved MRUs Via File Extensions

18. .exe’s

19. Apps Associated with a File Extension

20. ComDlg32

21. Search Assistant Subkeys are for different search approaches: 5001 – Internet Search Assistant 5603 – XP file search 5604 – “word or phrase in a file”

22. System Restore Points Restore the system to a previous state Restore Points built in the background –Trigged by installation of apps/drivers (unsigned) –Done once a day by default

23. What gets restored Registry Local profiles COM+ database WFP DLL cache WMI database IIS database

24. What doesn’t. DRM WPA settings SAM hive User-created data stored in the user profile Contents of redirected folders

25. System Restore Configuration Restore Point updates in seconds = 1 day Retention of Restore Points in seconds

26. Lab 6.1 Determine MRUs Typed URLs Recent files opened/viewed by app »Order viewed Latest searches What apps were recently run from cmd.exe