Harlan Carvey, CISSP, is a computer security engineer and book author. He has conducted penetration tests and vulnerability assessments in support of corporate and federal government clients. He has also performed a wide range of incident response activities, and conducts computer forensics research, with specific attention to the Microsoft Windows family operating systems. In this interview, he discusses Windows forensics, forensics in general, as well as his latest book.

How has Windows forensics evolved since the days of Windows XP? What does Windows 7 bring to the table?

Microsoft has a well-established habit of changing things up for forensic analysts... look at how memory analysis changes not only between versions of Windows, but in some cases, between Service Packs. Between XP and Vista, there were changes in how some information is recorded in files on the system, in particular in the Registry and the Event Logs.

As Microsoft "evolves" the user experience and adds complexity and functionality to the operating system and applications, what we're seeing isn't necessarily that forensic artifacts are going away, but rather that they're moving. As such, there's been a great deal of research in the community to map those artifacts, but the fact remains that there needs to be a great deal more in order to understand what interactions lead to the creation or modification of an artifact.


In your opinion, what are the most important skills that aspiring forensic examiners should be working on?

Aspiring examiners should focus on the core basics of analysis. Too many experienced examiners fall into the trap of filling in gaps in analysis and knowledge with assumption and speculation, even doing so knowingly. From the beginning, examiners need to thoroughly understand the goals of their analysis, what questions need to be answered, and from there look for all information possible to support or refute their findings. Opinions serve a limited purpose in analysis when it comes to exploring other avenues, but replacing facts and analysis with speculation and assumption is just lazy.

Also, aspiring examiners should develop within themselves the desire to stay current in their field, regardless of what training is provided. One of the issues seen within the community is that business models for incident response and computer forensic analysis do not keep up with technology, in that hiring someone and providing no means whatsoever for regular, up-to-date training is still the unfortunate norm.