LAB1_Digital Forensics Technology and Practices_WORKSHEET Kwadwo Antwi

docx

School

University of Maryland, University College *

*We aren’t endorsed by this school

Course

640

Subject

Information Systems

Date

Dec 6, 2023

Type

docx

Pages

Uploaded by joespady4u25

Name: XXXX Semester: Summer Year: 2023 Section Number: 7621 Lab 1 Worksheet Digital Forensics Technology and Practices Table of Contents Introduction ............................................................................................................................................................... 2 Screenshot 1 – Creating Your First Name Account ..................................................................................................... 3 Screenshot 2 – Create a YOURNAME User account ................................................................................................... 4 Screenshot 3 – Create a YOURNAME Service ............................................................................................................. 5 Screenshot 4 – Add Yourname.EXE to the Starup Folder for Administrator ............................................................... 6 Screenshot 5 – Your First Folder with the Registry Files with Date Modified ............................................................. 7 Screenshot 6– Windows Computer Name Date Pulled from the Registry ................................................................. 8 Screenshot 8– Yourname Service Pulled from the Registry ........................................................................................ 9 Screenshot 8 – SAM (Security Accounts Manager) with Yourname ......................................................................... 10 Screenshot 9 – Access the Startup Folder ................................................................................................................ 11 Screenshot 10 – Autoruns with Yourname. EXE running at Startup ......................................................................... 12 Conclusion ............................................................................................................................................................... 13 APA References ........................................................................................................................................................ 14 1

Introduction Students: In the box below, please explain the purpose of using the Windows Registry and explain how it is relevant to Digital Forensics Technology and Practices. Introduction The windows registry is a repository for artifacts essential to digital forensics investigations and offers forensic analysts access to possible evidence they may need to gather to pursue legal action. To store keys, subkeys, and values that may monitor user data, the Windows registry employs a system of hives and supporting files (Dimov, 2021). A user's program settings, desktop, and use environment, including their network connections, may all be determined using user data. Registry keys are initially kept as negative values that cannot be rewritten; however, once they are destroyed, they are converted to positive values that may be overwritten (Dimov, 2021). Tolls are tools that forensic investigators can employ to analyze data stored in the Windows registry and connect illegal activity to certain deeds. User action often interacts with the Windows registry through installs, applications, and programs rather than directly. Registry keys provide Last Write time information that enables the forensic analyst to determine when the keys were last modified. No extension, extension. Alt, extension.log, and extension. Sav are just a few of the commands forensic analysts employ to browse through the Windows registry to make it simpler for them to gather their evidence (Dimov, 2021). The forensic analyst's toolkits can do replication, duplication, record listing, and backups using these commands. Credit card fraud, the hunt for criminals in possession of child pornography, and users who have stolen sensitive data from companies, including their clients' personally identifiable information (PII) or intellectual property, are some examples of how the windows registry has been used in the real world. specialized applications in digital forensics investigations and extra tools for searching the windows registry for proof. Because they don't want to take the chance of compromising the integrity of the original information, forensic investigators utilize duplicates of the original files they find. Forensic analysts should make use of the FTK imager, command prompt, and windows registry recovery when catering to their demands and requirements to make sure the investigation doesn't mess with original file integrity. 2

Your preview ends here