Finding Artifacts

Abstract

The essence of any forensic examination is to look for data, artifacts. While it is impossible to describe all possible artifacts that may be of interest in any given investigation, this chapter aims to describe how to find some artifacts that are very common to look for. The chapter first describes how to find information such as install date and time zone settings from the Windows registry. Next, the chapter provides a rather detailed description of how to analyze a partition table in order to ensure that all drive space is allocated to a partition. An overview of how to search for deleted files is also included. A lot of good information can be found in file metadata, which includes information such as when a file was created and by whom. Analyzing different kinds of metadata is described before the chapter presents an approach on how to analyze log files. At the end of this chapter is a discussion on how to analyze unorganized data such as unpartitioned disk space or slack.