Forensically Sound Windows

I called “Forensically Sound Environment” as an operating system is good at logging or tracing for analysis to a specific case in terms of forensic or incident response. Here are some configurations to make forensically sound environment.

Prerequisite

1. Sync date and time to localtime or UTC

Windows

Most of configurations are Windows artifacts. Of course, it’s included that application such as IIS, Windows Advanced Firewall ans so on, however we can’t get any evidence from them unless you set those configurations properly like forensically sound environment.

1. EnablePrefetcher
2. NtfsDisableLastAccessUpdate
3. $LogFile
4. Windows Recovery
5. Minidump
6. Windows Event Log
7. WinRM service
8. Event Tracing for Windows
9. C:\> openfiles /local on
10. Windows Advanced Firewall
11. Application Log
    1. IIS
    2. Anti-Virus
    3. Adobe Reader

Linux

1. Auditd
2. iptables logging

Post Task

1. Build MD5 white-list
2. Logging remotely

I will describe about each title as above in more detail. And I’ll put the link on the title on this page. I hope that I want to make the list in question with you.