Windows Forensic Analysis Toolkit, 4th Edition

Chapter 1

Analysis Concepts

This chapter provides a foundation for analysis discussed in the rest of the book. We discuss core analysis concepts so that they can be built upon in the following chapters of the book.

Keywords

Concepts; analysis; framework; set up

Chapter Outline

Introduction 1

Analysis concepts 4

Windows versions 4

Analysis principles 6

Goals 7

Tools versus processes 9

The tool validation myth-odology 9

Locard’s exchange principle 11

Avoiding speculation 11

Direct and indirect artifacts 13

Least frequency of occurrence 16

Documentation 18

Convergence 19

Virtualization 20

Setting up an analysis system 22

Summary 25

Information in This Chapter

 Analysis Concepts

 Setting Up An Analysis System

Introduction

If you’ve had your ...