CHFI · Domain 4
Digital Forensics
About 29% of the exam
Windows registry hives
- SYSTEM
- devices, services, time zone
- SOFTWARE
- installed programs and system settings
- SAM
- local accounts and logon counts
- SECURITY
- policy and cached secrets
- NTUSER.DAT
- per user preferences and activity
- UsrClass.dat
- shell bags and class registrations
- Key write time
- keys carry it, values do not
Execution artifacts
- Prefetch
- ran, run count, recent times
- Amcache
- path, size and hash
- ShimCache
- presence, file modified time only
- UserAssist
- interactive launches and focus data
- Background activity keys
- last execution time per account
- Resource monitor database
- hourly bytes and processor use
- Service and task records
- installed persistence with timestamps
Only some artifacts prove execution; presence in a compatibility cache proves the file was seen, not run
User activity trail
- Shortcut files record target path and volume
- Jump lists rank recent and frequent items
- Shell bags record folders that were browsed
- Recent document keys list opened files
- Recycle metadata keeps the original path
- Search history captures typed terms
- Thumbnail caches survive the original image
Windows event essentials
- 4624 and 4625
- logon success and failure
- Logon type
- interactive, network or remote
- 4648
- explicit credentials used
- 4688
- process creation with parent
- 7045
- service installed on the host
- 1102 and 104
- logs cleared, two channels
- Remote session logs
- connect, disconnect and reconnect
Artifacts by operating system
Windows
- Registry hives and transaction logs
- Event logs in the modern format
- Hibernation file and page file
- Shadow copies preserve earlier states
- Search index database
Linux
- Authentication log records logons
- System log aggregates daemon messages
- Shell history without reliable times
- Cron and unit files for persistence
- Immutable attribute protects planted files
macOS
- Unified logs stored compressed with retention
- Property lists hold application state
- Metadata index knows file history
- Launch agents and daemons persist
- Keychain guards stored credentials
Name the artifact family before the tool: every platform has execution, persistence, logon and file knowledge sources
Web and browser forensics
Browser stores
- History databases hold visits and counts
- Cache retains page objects and scripts
- Cookies show sessions and preferences
- Downloads list source and destination
- Saved credentials protected by the platform
Server logs
- Address, method, path and status
- Agent string identifies scanners and tools
- Referrer reveals how they arrived
- Response size hints at data returned
Attack patterns in logs
- Sequential names show forced browsing
- Traversal sequences target system files
- Timing delays reveal blind injection
- One password across many accounts is spraying
- Upload then request shows a planted shell
Private browsing and remnants
- Private windows still write downloaded files
- Resolver cache records recent lookups
- Memory and swap hold page fragments
- Session restore keeps open tabs only
- Document which locations were checked and empty
Email header analysis
- Read the received chain from the bottom
- The lowest hop is the origin
- Compare claimed date against relay times
- Reply address may differ from the sender
- Envelope sender differs from the display sender
- Timestamps must be normalized before comparison
Out of order hop times mean forgery or serious clock skew, and either one is a finding
Email authentication
- Sender policy
- is this address allowed to send
- Signature
- headers and body cryptographically signed
- Alignment policy
- checks must match the visible domain
- Soft fail
- unauthorized but do not reject
- Pass without trust
- authentic domain, still malicious content
- Look alike domain
- passes checks, imitates a brand
Mail stores and cloud mail
- Single file archives separate messages by delimiter
- Client databases hold folders and attachments
- Export the raw message and hash it
- Server logs trace the queue identifier
- Webmail lives remotely and needs legal process
- Local traces sit in cache and memory
Mobile forensics
Acquisition levels
- Manual review of the screen
- Logical extraction of supported categories
- File system extraction with more paths
- Physical extraction of the whole storage
- Invasive methods when ports fail
Handling rules
- Shield the device from networks
- Keep it powered and charged
- Record locked or unlocked at seizure
- Never connect it to the internet
- Document any passcode provided
Where the data sits
- Message and call databases per platform
- Application caches and notification history
- Location history from several sources
- Backups on computers and in the cloud
- Write ahead logs hold recent records
Encryption state decides everything: before first unlock, most user data stays sealed whatever the tool claims
Cloud and virtual forensics
Infrastructure
- Snapshot volumes and capture memory
- No hardware seizure or write blocker
- Encrypt snapshots before sharing
- Preserve into an isolated account
Software services
- Use the audit and compliance export
- Admin browsing is not defensible collection
- Record parameters, counts and hashes
- Legal process reaches the provider
Ephemeral workloads
- Functions leave no host to image
- Rely on invocation and platform logs
- Containers need runtime telemetry
- Virtual disks need the whole chain
Correlating across sources
- Normalize every clock
- Anchor on a known event
- Match user to device
- Match device to network
- Match network to account
- Write the narrative
- One artifact is a lead, two make a finding
- Device attribution needs more than an address
- Cloud records outlive local deletion
- State the confidence for every inference
Attribution is a chain: account to device to session to action, and every link needs its own artifact
Key artifacts
- Shortcut file
- path, volume serial, host name
- Jump list
- recent items with access counts
- Recycle pair
- metadata record plus recovered content
- Browser history
- visits, counts and timestamps
- Received chain
- true path an email traveled
- Write ahead log
- recent database rows not yet merged
- Snapshot
- earlier state preserved by the platform
Know the order
- Verify the image
- Profile the system
- Establish user accounts
- Prove execution and access
- Extend to network and cloud
- Correlate and report
Establish who the users were before deciding what any artifact means about a person
Reference strip: artifacts by platform
Windows
- Registry hives and event logs
- Prefetch, cache and inventory artifacts
- Shortcut, jump list and shell bags
- Shadow copies and page file
Linux and macOS
- Authentication and system logs
- Shell history and scheduled jobs
- Property lists and unified logs
- Metadata index and keychain
Web
- History, cache, cookies, downloads
- Server access and error logs
- Agent, referrer and status codes
- Injection and traversal patterns
- Received chain read upward
- Envelope versus display sender
- Authentication and alignment results
- Archive formats and server queue logs
Mobile and cloud
- Extraction levels and shielding
- Application databases and backups
- Audit exports and snapshots
- Provider legal process
Quick exam traps
- Trap: Private browsing leaves no recoverable trace at all
- Trap: Passing authentication checks proves the email is trustworthy
- Trap: The topmost received header identifies the sender
- Trap: A physical extraction always defeats device encryption
- Trap: Cloud data can be seized the same way a laptop is
- Trap: Browser history absence proves the site was never visited
- Trap: An address in a log identifies the person who acted
cybercertprep.com · original revision sheet written from the public body of knowledge