Sans windows time rules

Proper digital forensic and incident response analysis is essential to successfully solving today's complex cases. Each analyst should examine the artifacts and then analyze the activity that they describe to determine a clear picture of which user was involved, what the user was doing, when the user was doing it, and why. The data here will help you in finding multiple locations that can substantiate facts related to your casework.

Each of the rows listed on the poster describes a series of artifacts found on a Windows system that can help determine if an action occurred. Usually multiple artifacts will be discovered that all point to the same activity.

These locations are a guide to help you focus your analysis on the areas in Windows that can best help you answer simple but critical questions. This new updates include many new artifacts and locations from Windows XP through Windows 8. Copy url Url was copied to clipboard.

Related Content. December 19, How to analyze different types of devices and find connections between them Modern digital forensics and incident response cases may involve quite different types of …. December 18, Load More Related Articles. May 7, February 28, The only timestamp change for a local file move according to SANS is the change timestamp. Our test shows this is correct. The SANS poster says modified and changed will be inherited from the original file while access and creation will be set to the time of the move.

As we can see from the above screenshot this is correct. SANS say a file move between volumes using cut and paste via the explorer will inherit the modified, change, and creation time while access time will be set to the time of cut and paste.

Turns out the change timestamp is updated. Overall the SANS poster is mostly accurate with the only differences being with the file access and file modification actions.

The changes between the SANS poster and my tests show that you should always verify what you are told, especially something that can change after an update. You are commenting using your WordPress.

You are commenting using your Google account. You are commenting using your Twitter account. You are commenting using your Facebook account. Notify me of new comments via email. Notify me of new posts via email. Skip to content Windows time rules are an importants part of a forensics investigation. File Modification For file modification SANS say modified and changed should be updated and as you can see modified, accessed, and changed were updated.