Q&A: Windows forensics
by Mirko Zorz - Monday, 17 August 2009.
Harlan Carvey, CISSP, is a computer security engineer and book author. He has conducted penetration tests and vulnerability assessments in support of corporate and federal government clients. He has also performed a wide range of incident response activities, and conducts computer forensics research, with specific attention to the Microsoft Windows family operating systems. In this interview, he discusses Windows forensics, forensics in general, as well as his latest book.

How has Windows forensics evolved since the days of Windows XP? What does Windows 7 bring to the table?

Microsoft has a well-established habit of changing things up for forensic analysts... look at how memory analysis changes not only between versions of Windows, but in some cases, between Service Packs. Between XP and Vista, there were changes in how some information is recorded in files on the system, in particular in the Registry and the Event Logs.

As Microsoft "evolves" the user experience and adds complexity and functionality to the operating system and applications, what we're seeing isn't necessarily that forensic artifacts are going away, but rather that they're moving. As such, there's been a great deal of research in the community to map those artifacts, but the fact remains that there needs to be a great deal more in order to understand what interactions lead to the creation or modification of an artifact.

In your opinion, what are the most important skills that aspiring forensic examiners should be working on?

Aspiring examiners should focus on the core basics of analysis. Too many experienced examiners fall into the trap of filling in gaps in analysis and knowledge with assumption and speculation, even doing so knowingly. From the beginning, examiners need to thoroughly understand the goals of their analysis, what questions need to be answered, and from there look for all information possible to support or refute their findings. Opinions serve a limited purpose in analysis when it comes to exploring other avenues, but replacing facts and analysis with speculation and assumption is just lazy.

Also, aspiring examiners should develop within themselves the desire to stay current in their field, regardless of what training is provided. One of the issues seen within the community is that business models for incident response and computer forensic analysis do not keep up with technology, in that hiring someone and providing no means whatsoever for regular, up-to-date training is still the unfortunate norm.

Develop your documentation skills now! Technical folks are known for not documenting what they do, but that's also the biggest obstacle to process improvement. Thoroughly documenting acquisitions, data collection and analysis lets you go back later and pull information out that is useful or critical in a current engagement.

Finally, pick a programming language and learn how to use it to meet your needs. Too often, there's a slow-down or gaps in an examination due to the shear volume of data, and some ability to program can help you perform a wide variety of tasks, including the ability to automate repetitive tasks and increase speed while reducing mistakes. Also, just learning to program helps you with your thought processes and breaking larger tasks down into smaller ones, in order to achieve an overall goal.


MagSpoof: A device that spoofs credit cards, disables chip-and-PIN protection

The device can wirelessly spoof credit cards/magstripes, disable chip-and-PIN protection, and predict the credit card number and expiration date of Amex cards after they have reported stolen or lost.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Thu, Nov 26th