Windows Forensics and Incident Recovery

Summary

All software installations on a Windows system have an effect on that system. In essence, this is a practical example of Locard's Exchange Principle, with the two “objects” being the installation package for the malware in question and the system itself. When “contact” occurs, there is a “transfer of material.” The evidence of this transfer is the files and Registry keys that constitute the actual installation. Other indicators may be open ports or running processes depending on how the rootkit is designed. While these indicators may not be visible from the system itself, as the integrity of the system has been compromised, they may be visible via some other means.

While rootkits have been available on Linux systems for quite some time, ...