Investigating Windows Systems

Chapter 3

User Activity

Abstract

Following user activity on Windows systems is critically important, as it can mean the difference between guilt and innocence, between someone going to jail or being fired (or both) and someone being found not culpable in wrongdoing. The locations analyzed for user activity depend upon the version of Windows examined.

Keywords

User activity; Windows XP; Windows 7; Windows 10

Chapter Outline

• Introduction 45
• CFReDS Hacking Case Image 46
  • Analysis Goals 46
  • Analysis Plan 47
  • Timeline 48
  • Additional Data 51
  • Summary 53
  • Lessons Learned 54
• Data Theft 55
  • Analysis Goals 56
  • Analysis Plan 56
  • Connected Devices 56
  • Data Theft 60
  • Outlook PST File 62
  • Other Data Sources 62
  • Summary 63
  • Lessons Learned 63
• Joe’s PC 64
  • Analysis Goals