Advanced Digital Forensics

Ria Arora
Advanced Digital Forensics
Professor Dragos We are being hired as a consultant to help respond to a small medical office in which they learned that 10 of their employees have been victims of identity theft. The office has 55 total employees amongst two office locations. They have one workstation per employee and different kinds of computer operating systems in use. There is a mixture of Windows 7, Vista, and XP operating systems. The servers being used are Windows 2003 and 2008 versions. This is used for the billing system which hasn’t been updated to cloud services. As a consultant, I will try to help the business by looking at how their information was being received by the attacker, to prevent further attacks, and to check

The investigators should do research on the different Operating Systems and check what kind of vulnerabilities they can find on it. I was able to find a lot of vulnerabilities with Windows 7 using CVE details. CVE details provides details on all the vulnerabilities available on an operating system and how the attackers will be able to gain access to it. Since the Windows XP and Vista have not been updated, there will be a lot of vulnerabilities on those machines as well. There are many resources and tools online which will help us find specific vulnerabilities in these operating systems. It is possible for someone to gain access to the victims machines through these vulnerabilities.
Extracting and translating information in Registry is also very important in incident response. A lot of changes happen in the registry when users download or delete any sort of data. It also keeps date and time for any of those changes. There are a lot of tools which can help with that including RegRipper, Process Monitor, and WRR. These work just as well with machines with an older operating system to extract and understand registry keys and values or monitoring accesses to the Registry on a live system. The tool regslack.exe is very helpful to check if any of the registry keys and values were

The four characteristics of a malware being present on the system include initial infection vector which is how the malware got into the system. The second is propagation mechanism which is how the malware moves between the systems, if it does. The third is persistence mechanism which is how the malware remains on the system and survives reboots or when the user logs out. The fourth one is the artifacts which is what traces the malware leaves on the system as a result of its execution. If malware does seem present, we need to find out what data was also being viewed including the identity of the employees. The company needs to make sure no data of the client is being