What Evidence Can Be Recovered From A Windows Computer (1)

WINDOWSFORENSICS · AGUIDEFORUKLAWYERS What Evidence Can Be Recovered from a Windows Computer? Deleted Files, USB History, Logins, Browsing, Execution Traces and the Timeline They Build COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM 35 and CrimPR Part 19. Its eDiscovery arm, e-discovery.uk , integrates device-level findings into disclosure-scale COURT-EXPERIENCED EXPERT WITNESSES § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the machine remembers 03 Deleted files and where they hide 04 USB devices and external media history 05 Logins, accounts and who was at the keyboard 06 Files opened, folders browsed: the recency artefacts 07 Programs run: the execution artefacts 08 Browsing, searching and the online record 09 Event logs and the system's own diary 10 Building the timeline: from artefacts to narrative 11 Worked examples 12 Common mistakes and technical limitations 13 Questions to ask · Suggested wording 14 Checklist and red flags · When to involve a digital forensic expert 15 Frequently asked questions 16 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : WINDOWSRECORDSFARMORETHANUSERSCREATE § 0 2 · FIRSTPRINCIPLES The problem in plain English: the machine remembers § 0 3 · WHATDELETIONLEAVES Deleted files and where they hide § 0 4 · THEPLUG - INRECORD USB devices and external media history § 0 5 · WHOWASSIGNEDIN Logins, accounts and who was at the keyboard § 0 6 · WHATWASOPENED Files opened, folders browsed: the recency artefacts § 0 7 · WHATWASRUN Programs run: the execution artefacts § 0 8 · THEONLINERECORD Browsing, searching and the online record § 0 9 · THESYSTEM ' SDIARY Event logs and the system's own diary § 1 0 · ASSEMBLY Building the timeline: from artefacts to narrative § 1 1 · INTHEWILD Worked examples EXAMPLE1 · THELEAVER , THESTICKANDTHEFIFTEENMINUTES EXAMPLE2 · THEDELETIONTHATPROVEDMORETHANTHEDOCUMENTSWOULDHAVE EXAMPLE3 · THESHAREDOFFICECOMPUTERANDTHEACCOUNTTHATWASNOTHIM § 1 2 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 3 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · INSTRUCTIONFORAWINDOWSEXAMIN AT ION § 1 4 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The Windows evidence checklist Red flags When to involve a digital forensic expert 35 / CrimPR Part 19 report that presents convergence a court can act on. Defensively, instruct an examiner § 1 5 · COMMONQUESTIONS Frequently asked questions Can deleted files really be recovered, and for how long? Can the computer prove who was using it, rather than which account? If someone used a wiping tool, is the evidence gone? The laptop has been used for months since the events. Is examination pointless? Does any of this work on a Mac, or on cloud-stored files? What does a Windows examination cost and how long does it take? § 1 6 · REFERENCE Glossary SRUM Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY