Artifacts

Archive for March, 2011


Windows Operating System Version

Posted by:

Author Name
Joe Garcia

Artifact Name
Windows Operating System Version

Artifact Location
SOFTWARE Registry Hive

Registry Keys
SOFTWARE\Microsoft\Windows NT\CurrentVersion

Description
What version of the Windows Operating System is installed on a suspect computer is important. When Microsoft went from XP to Vista/Win7, certain artifacts were moved to new locations. This knowledge can help a Forensic Examiner/Analyst streamline their examinations. It can also help determine who the registered owner of the computer is and when the OS was installed.

Let’s look at this artifact using AccessData’s Registry Viewer:

Windows OS Version in Registry Viewer



Here we can see the following important information (Owner & ProductID redacted in image):
Install Date
Registered Organization
Registered Owner
Product Name
ProductID
CSDVersion (Version of the OS)

Registry Viewer was nice enough to parse out the Install Date, but if you are like me you like to verify your findings. To do this I used the DCode utility by Digital Detective:




Forensic Programs of Use
FTK Registry Viewer
RegRipper
DCode

Google Chrome Browser Profile (Mac OS X)

Posted by:  /  Tags: , , , , ,

Author Name
Joe Garcia

Artifact Name
Google Chrome Browser Profile Folder (Mac OS X)

Artifact/Program Version
Mac OS X

Description
As part of a lot of Digital Forensics investigations, obtaining information of the user’s browsing habits is an important step.  Safari is the browser de facto on OS X & Firefox has a large user base, but what about Google’s Chrome Browser? Like Firefox before it, Chrome is steadily gaining ground in the browser market share. This post looks to point out where to find the Chrome user’s Profile folder on a Mac hard drive. Most times, the Profile will be saved as “Default”, but be on the look out for multiple profiles. Once you locate and extract the Chrome Profile folder (listed below) from your image, you will need to bring it over to a Windows forensics box so that you can use tools like ChromeAnalysis or ChromeForensics to assist you in parsing out the information stored within it. You will get the following data, which is stored in SQLite files:

History (Web, bookmarks, downloads and search terms)

Cookies

Web Logins

Archived History (Web History and search terms)

Bookmarks (This is in a non-SQLite format)

File Locations
HDD\Users\USERNAME\Library\Application Support\Google\Chrome\Default

Research Links
Get Google’s Chrome Browser HERE

Forensic Programs of Use
ChromeAnalysis from forensic-software.co.uk: http://forensic-software.co.uk/chromeanalysis.aspx

ChromeForensics by Woanware: http://www.woanware.co.uk/?page_id=70