GIAC Experienced Forensics Examiner

Attribution depends on knowing who was at the keyboard. You read account databases, profile artifacts and event logs to establish when accounts existed, logged on and stayed active, and how local and remote sessions differ.

• Local and domain accounts and their artifacts
• Logon types and what each implies
• Security event log records for logon and logoff
• User profile creation and first and last use
• Remote desktop and network session evidence
• Failed logons and account changes

You build An account activity timeline for one machine, with the evidence for each session.

Programs leave traces even after they are deleted. You combine evidence of execution from system caches, logs and user-specific records to show what ran, how often, and who ran it.

• Prefetch files and what they record
• Shimcache and Amcache entries
• UserAssist and background activity records
• System resource usage monitoring data
• Event logs that show process activity
• Weighing conflicting execution evidence

You build A program execution report that combines at least four artifact sources for one set of tools.

Files carry histories of where they came from and who opened them. You trace downloads, shortcuts, recent items and folder navigation, and use them to show how a user interacted with specific files.

• Shortcut files and jump lists
• Recent files and most-recently-used lists
• Shellbags and folder access
• Download origin markers on files
• Office documents and their metadata
• Opened files on removable and network locations

You build A file interaction timeline for one document, from origin to last access.

Showing that a user knew a file existed is often the crux of a case. You examine the file system structures, recycle bin, journals and indexes that show a file was present, opened or deleted, and recover what remains.

• Master file table records and what they hold
• Recycle bin structure and metadata
• The change journal and file system logs
• Search index, thumbnail and cache evidence
• Volume shadow copies as a second history
• Showing user knowledge of a file
• Recovering deleted files and metadata

You build A report on one deleted file, with the evidence that it existed, who knew of it and when it was removed.

Browsers record much of what a person does online. You read history, downloads, cache, sessions and saved data from the common browsers, and relate web activity to other events on the machine.

• Browser artifact locations and formats
• History, typed addresses and search terms
• Downloads and their file system traces
• Cache, cookies and session data
• Private browsing and what it leaves behind
• Correlating browser events with file activity

You build A browser activity timeline for one user across two browsers, correlated with file events.

Removable media is a classic route for data to leave. You identify when a device was first and last connected, which volume it was, who was logged on, and which files touched it.

• Registry keys that record connected devices
• Setup logs and first-connection times
• Device identifiers and volume serial numbers
• Event logs for device connections
• Linking a device to a user and to files
• Phones, cameras and other portable devices

You build A device history for one machine that ties each external device to a user and to file activity.

Sync clients keep local records of what moved to and from the cloud. You examine the databases, logs and file system traces left by common cloud storage applications, and judge what they prove and what they cannot.

• How sync clients store state on a Windows host
• Databases and logs from common storage applications
• File upload and download traces
• Deleted and shared items in sync records
• Web access to cloud storage in browser artifacts
• Limits: what local evidence cannot show

You build A cloud storage activity report that lists files synced and the local evidence for each.

Where a device was says something about who had it. You use network history, wireless profiles and location data on a Windows machine to place a device in time and space and to show the networks it joined.

• Network profiles and connection history
• Wireless network names and first and last connection
• Mapped drives and remote connections
• Location services and related records
• Event logs for network changes
• Building a movement timeline from several sources

You build A network and location history for one laptop, with a map of where and when it connected.

Work a complete case from question to written findings. You examine the artifacts in every category, resolve conflicts between them, and present conclusions at the confidence they deserve.

• Receiving the case question and the evidence
• Applying every artifact category
• Resolving conflicts between sources
• Stating findings with confidence levels
• Writing for an investigator or a court

You build A forensic examination report for a sample case about data leaving a workstation.