Windows forensics, part 1 Flashcards
Explain the bootup process
When booting up a computer, the (hard coded ROM) BIOS firmware runs self tests, identifies connected devices and then locates the operating system on one of these devices
What two file systems are there for windows?
NTFS - modern and efficient
FAT - old and simple
What is the max file size for NTFS and FAT?
NTFS - 16 TB
FAT - 4 GB
What is FAT?
File Allocation Table, that allocated files in “data areas”, compatible file system for most operating systems.
DOSDATETIME, accesstime: 1 day
write time: 2 seconds
create time: 10 millieseconds (local time)
What is NTFS?
New Technolohies File System, a table that allocates files in “data areas”/ unallocated space
FILETIME,
access time: up to 1 hour
Write time: 100 nanoseconds
Create time: 100 nanoseconds (UTC)
What is $MFT in NTFS?
The master file table, functions like a table of contents for data in the Volume
What is the $Logfile in NTFS?
a transaction log, used for restoring system to a consistent state. Transactions are recorded as complete or not
What is the $Volume in NTFS?
a resident in MFT, only contains attributes, volume lables and ID.
note. might appear empty in forensic tools
What is the $Secure in NTFS?
Access control list, read-write-execute permissions.
Details of ownership and access information in the $DATA attribute
What is Standard Information Attribute (SIA) in NTFS $MFT?
A resident attribute identifier, contains (and updates) information about the date and timestamps displayed by Windows and most forensic tools.
extra:
Starts with hexadecimal sequence 10 00 00 00
What is Filename Attribute (FNA) in NTFS $MFT?
like SIA, also a resident attrubute. Containing reference to parent folder, filename, the file´s physical and logical size.
Usually not updated through system usage.
extra:
Starts with hexadecimal sequence 30 00 00 00
What is Data Attribute (DA) in NTFS $MFT?
An important attribute which holds the actual data (resident data) or point to the location were data resides (non resident data).
extra:
Starts with hexadecimal sequence 80 00 00 00
What is the difference between resident and non-resident data?
files smaller than 600 bytes are treated as resident data, DA points to the location for files bigger than 600 bytes
Whats is.. 1. Data compression
2. Sparse files .. in NTFS?
- NTFS can simply compress data and store it, to decompress it automatically when used
- Allocates non-zero data, it does not allocate “zero data”, instead number of zeros are specified in sparse file
What is Reparse Points in NTFS?
points to files or folders that act as links, contains timestamps, source and taget location. Hence useful for forensic investigators
