Digital Forensics and Incident Response - Second Edition

Web artifacts

There are several types of incidents where it may be necessary to examine a system for evidence of malicious activity that's been conducted by a user. Previously, we mentioned accessing cloud-based storage where a malicious insider has uploaded confidential documents. In other circumstances, social engineering attacks may have an unsuspecting employee navigate to a compromised website that subsequently downloads malicious software. In either case, Autopsy provides us with the ability to examine several areas of web artifacts.

The first of these web artifacts is the web history. In the event of a social engineering attack that involves a user navigating to a malware delivery site, this data may provide some insight into the specific ...