A consistency study of the windows registry

IFIP Advances in Information and Communication Technology

Volumn 337 AICT, Issue , 2010, Pages 77-90

  Zhu, Yuandong ^a   James, Joshua ^a   Gladyshev, Pavel ^a  

^a UNIVERSITY COLLEGE DUBLIN   (Ireland)

Author keywords

counter counter forensics; registry analysis; Windows forensics

Indexed keywords

CONSISTENCY CHECKING; COUNTER-COUNTER-FORENSICS; EVENT SEQUENCE; FORENSIC TOOLS; NOVEL METHODS; REGISTRY ANALYSIS; TIME STAMPS; WINDOWS REGISTRY;

ELECTRONIC CRIME COUNTERMEASURES;

MODEL CHECKING;

EID: 78651104447     PISSN: 18684238     EISSN: None     Source Type: Book Series    
DOI: 10.1007/978-3-642-15506-2_6     Document Type: Conference Paper

References (9)

1. H. Carvey, Windows Forensic Analysis, Syngress, Burlington, Massachusetts, 2007.
2. M. Geiger and F. Cranor, Counter-Forensic Privacy Tools: A Forensic Evaluation, Technical Report CMU-ISRI-05-119, Institute for Software Research International, Carnegie-Mellon University, Pittsburgh, Pennsylvania (reports-archive.adm.cs.cmu.edu/anon/isri20 05/CMU-ISRI-05-119.pdf), 2005.
3. P. Gladyshev and A. Enbacka, Rigorous development of automated inconsistency checks for digital evidence using the B method, International Journal of Digital Evidence, vol. 6(2), pp. 1-21, 2007.
4. P. Gladyshev and A. Patel, Formalizing event time bounding in digital investigations, International Journal of Digital Evidence, vol. 4(2), pp. 1-14, 2005.
5. S. Hilley, Anti-forensics with a small army of exploits, Digital Investigation, vol. 4(1), pp. 13-15, 2007.
6. Microsoft Corporation, Windows registry information for advanced users, Redmond, Washington (support.microsoft.com/kb/256986), 2008.
7. S. Willassen, Hypothesis-based investigation of digital timestamps, in Advances in Digital Forensics IV, I. Ray and S. Shenoi (Eds.), Springer, Boston, Massachusetts, pp. 75-86, 2008.
8. Y. Zhu, P. Gladyshev and J. James, Using ShellBag information to reconstruct user activities, Digital Investigation, vol. 6(S1), pp. S69-S77, 2009.
9. Y. Zhu, J. James and P. Gladyshev, A comparative methodology for the reconstruction of digital events using Windows restore points, Digital Investigation, vol. 6(1-2), pp. 8-15, 2009.