Scribd Logo
Upload

Welcome to Scribd!

  • 77 views

    B51

    Uploaded by

    nobuyuki
    This document discusses advanced evidence of software execution that can be extracted from a system's memory and disk files. It describes several artifacts including prefetch files, the ShimCache application compatibility cache registry entries, the RecentFileCache database, and the Amcache hive file that can contain metadata on recently run executable files. It also mentions tools like PrefetchParser, ShimCacheParser, and Rfc.pl that can extract relevant execution evidence from these sources.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    B51

    Uploaded by

    nobuyuki
    77 views1 page
    This document discusses advanced evidence of software execution that can be extracted from a system's memory and disk files. It describes several artifacts including prefetch files, the ShimCache application compatibility cache registry entries, the RecentFileCache database, and the Amcache hive file that can contain metadata on recently run executable files. It also mentions tools like PrefetchParser, ShimCacheParser, and Rfc.pl that can extract relevant execution evidence from these sources.

    Original Description:

    b51

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses advanced evidence of software execution that can be extracted from a system's memory and disk files. It describes several artifacts including prefetch files, the ShimCache application compatibility cache registry entries, the RecentFileCache database, and the Amcache hive file that can contain metadata on recently run executable files. It also mentions tools like PrefetchParser, ShimCacheParser, and Rfc.pl that can extract relevant execution evidence from these sources.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    77 views1 page

    B51

    Uploaded by

    nobuyuki
    This document discusses advanced evidence of software execution that can be extracted from a system's memory and disk files. It describes several artifacts including prefetch files, the ShimCache application compatibility cache registry entries, the RecentFileCache database, and the Amcache hive file that can contain metadata on recently run executable files. It also mentions tools like PrefetchParser, ShimCacheParser, and Rfc.pl that can extract relevant execution evidence from these sources.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 1

    Book 5 Execution Evidence

    Thursday, June 2, 2016

    2:57 PM

    Advanced Evidence of Execution


    - Prefetchparser: volatility, comb memory address space for prefetch files not on disk.
    Scan virtual memory for prefetch headers.
    Strong validation reduce false positives.
    Internal metadata.
    - ShimCache: Application compatibility cache
    AppCompatCache registry key for compatibility.
    Track EXE last modification date, file path, file size.
    Registry entries are created => notify system.
    Most recent events are on top, new entries are written on shutdown
    InsertFlag in AppCompatCache entry.
    ShimCacheParser.py
    Metadata in data structure, when shutdown, data str is serialized into registry
    Find registry path, determine format, return data in CSV format or STDOUT.
    Search ControlSet and return unique entries by default. ExecFlag true
    Shimcache volatility: parse app com shim cache registry key.
    RecentFileCache.bcf: Application Experience <-> App Com Cache.
    Check DB for known problems using UA.
    ProgramDataUpdater uses registry file during process creation.
    Maintained by Program Data Updater scheduled service.
    Collect MS customer experience improvement program.
    Reference to program copied/downloaded/executed on sustem.
    Information is cleared when ProgramDataUpdater runs. (12:30AM).
    Rfc.pl to extract data
    Amcache.hve: replacement of RecentFileCache.bcf
    Numeric keys = different exe file run.
    Volume GUID and SYSTEM hive's MountedDevice key
    - Cafae.exe automate registry extraction
    Ntusr.dat hive and usrclass.dat hive for Vista.

    Steinberg Page 1

    You might also like