KEMBAR78
OS Forensic Techniques Guide | PDF
Scribd
Upload
191 views30 pages

OS Forensic Techniques Guide

This document discusses operating system forensics and focuses on Windows and Mac forensics. It covers collecting volatile system information like logged on users, open files, and running processes from Windows systems. It also covers collecting non-volatile information such as the Windows registry, event logs, and page file. The document notes the importance of analyzing the clipboard contents, Windows search index, and hidden partitions when performing Windows forensics and mentions analyzing Mac systems as well.

Uploaded by

يُ يَ
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
191 views30 pages

OS Forensic Techniques Guide

This document discusses operating system forensics and focuses on Windows and Mac forensics. It covers collecting volatile system information like logged on users, open files, and running processes from Windows systems. It also covers collecting non-volatile information such as the Windows registry, event logs, and page file. The document notes the importance of analyzing the clipboard contents, Windows search index, and hidden partitions when performing Windows forensics and mentions analyzing Mac systems as well.

Uploaded by

يُ يَ
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 30

OS FORENSIC

OBJECTIVES
What is an OS?
Functions of an OS
OPERATING SYSTEM INTERFACE
What is OS Forensic?
Windows forensics
Collecting Volatile Information
System Time
LoggedOn Users
Open Files
Network Connections
Process Information
Process to Port Mapping
Network Status
Print Spool Files
Clipboard Contents

• • The clipboard is simply an area of memory where data can be


stored for later use.
• • Most Windows applications provide this functionality through the
Edit option on
• the menu bar.
• • Clicking Edit reveals a drop-down menu with choices like Cut, Copy,
and Paste
Collecting Non Volatile Information
Windows Registry Analysis
Event Logs
Slack Space
Virtual Memory
Page File
Windows Search Index
Collecting Hidden Partition Information
MAC FORENSICS

You might also like