Some months ago i’ve got GCFA certification.

During exam preparation i’ve collected a lot of notes, and after the exam i’ve gradually organized them in a index based on topics emerged during the exam, usual using my few freetime.

Update 20/11/2018

I’ve released on Amazon an extended and updated version of this ebook, also available as printed version:

The little handbook of Windows Forensics

Update 29/10/2018

My “sketchbook” was an unexpected result: a lot of users bought it!

And a lot of users (thanks!) send me reports of small errors and typos in the document. That’s why i published a new version of the sketchbook, with some corrections. Furthermore, i’ve included also an extended reference to Volatility (initially included in the sketchbook, but removed in order to limit the size of the document, because it is not an exam main topic).

Users that already bought the Sketchbook, using the link received in the Gumroad’s email should be able to download the new version: otherwise, email me!

The document it’s not a simple braindump: for each exam question that remember, i’ve collect all notes taken during the preparation and organized them in a alphabetical index useful for a quick search during exam.

Finally i’ve accomplished a first version, that can be downloaded from Gumroad.

Table of contents

**FAT Filesystem**
   Structure
   Boot Record
   FATs
   Root Directory
   Data Area
   Clusters
   Wasted Sectors
   FAT Entry Values
       FAT12
       FAT16
       FAT32
   Versions
       FAT12
       FAT16
       FAT32
       Limitations with Windows 2000 & Windows XP
       exFAT (sometimes incorrectly called FAT64)
   Disk Unit Addressing
   Metadata Addressing
   Notes on Timezones
   General Notes on Time
   Sentinel Timestamps
   References
**NTFS Filesystem**
   Structure
   Master File Table
       Metafiles
       Attributes
   Last Access Time
       Within the file’s attribute
       Within a directory entry for a file
   Alternate Data streams
       Known Alternate Stream Names
   Sparse Files
   Journaling
   Directory junctions
   Hard links
   File compression
   References
**Volume Shadow Copies**
   Overview
   Windows Versions
       Windows XP and Server 2003
       Windows Vista, 7 and Server 2008
       Windows 8 and Server 2012
       Windows 10
   Compatibility
   Shadow Volume Copies in Digital Forensics
       Why Shadow Copies are important to Forensics
       Limitations of Shadow Copies in forensic investigations
       Volume Shadow Copies in the Registry
       Analyzing Volume Shadow Copies
   References
**MAC(b) Times**
   Where are they stored?
       $STANDARD_INFO
       $FILE_NAME
       What are the differences?
   Time Rules
   How to detect Anti-Forensics Timestamp Anomalies?
**Memory analysis**
   Volatility
       Volatility Plugins reference
       Acronyms
       External References
   Redline
   Process Hollowing
       Detecting hollowed processes with Volatility
       Mitigation
**Windows Registry**
   Persistence techniques
       DLL Search Order Hijacking
       Shortcut Hijacking
       Bootkit
       COM Hijacking
   Amcache and Shimcache
       Amcache
       Shimcache
   Recent opened Programs/Files/URLs
       Start>Run
       UserAssist
       Shell bag
       Recent URLs
   Installed programs
   Windows Protect Storage
   Pagefile
   Windows Search
   File extensions
   Mounted drives
   USB Storage
   Debugging
**Windows Events**
   Structure and location
   Useful events for forensics analysis
   Logon Type Codes
**Security Identifiers (SIDs)**
   Machine SIDs
       Decoding Machine SID
   Service SIDs
   Well-known security identifiers
**Forensics Tools**
   Sleuthkit
       Timeline creation
   DensityScout
   Plaso
       Supertimeline creation
   Foremost
   md5deep
   RegRipper
   Log Parser
   python-evtx
   EvtxParser
   Hibr2Bin
   Kansa
   Sigcheck
   PECmd
   ShimCacheParser
**Attack tools**

I hope this helps!

Loading…

I’m sorry, this time it’s not a free goody: the exam preparation is a process that cost time and money.

I think is correct share this knowledge only with users really interested.