Using ShellBag information to reconstruct user activities

DFRWS 2009 Annual Conference

Volumn 6, Issue , 2009, Pages

  Zhu, Yuandong ^a   Gladyshev, Pavel ^a   James, Joshua ^a  

^a UNIVERSITY COLLEGE DUBLIN   (Ireland)

Author keywords

Digital forensics; Event reconstruction; Registry snapshots analysis; ShellBag information analysis; Windows XP

Indexed keywords

DIGITAL FORENSICS; ELECTRONIC CRIME COUNTERMEASURES;

DETECTION RULES; EVENT RECONSTRUCTION; MICROSOFT WINDOWS; REGISTRY SNAPSHOTS ANALYSIS; USER ACTIVITY; WINDOWS EXPLORER; WINDOWS REGISTRY; WINDOWS XP;

WINDOWS OPERATING SYSTEM;

EID: 84868594171     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (6)

1. AccessData. Registry viewer, http://www.accessdata.com/products.html; 2008.
2. Carvey H. Registry analysis, windows forensic analysis, syngress. Rockland, Massachusetts, U.S.A.; 2007.
3. Harder B. Microsoft Windows XP system restore, Windows XP technical articles, http://technet.microsoft.com/en-us/library/ms 997627.aspx; 2001.
4. Russinovich M, Cogswell B. RegMon, http://technet.microsoft.com/en-us/ sysinternals/bb896652.aspx; 2006.
5. Zhu Y, Gladyshev P, James J. Identifying newly updated data values of MRU Keys between registry snapshots. In: Fifth annual IFIP WG 11.9 international conference on digital forensics; 2009a.
6. Zhu Y, James J, Gladyshev P. A comparative methodology for the reconstruction of digital events using Windows Restore Points. Digital Investigation 2009b; doi:10.1016/j.diin.2009.02.004.