As several sites have rightfully pointed out....Accessdata has made a huge jump ahead with their recent release of FTK Imager v3.0. (not to mention FTK 3.2 and their most recent "Volatile tab.") Just finished testing it today by mounting physical images and using VFC to virtually boot XP and Win7 systems. Flawless! While wandering around their site (actually looking for updated RSR files to add to their most recent Registry Viewer version), I stumbled across two additional documents that I believe are very worthy of a good read - or at least printing out as a permanent reference.
Registry Quick Find Chart - a very recently updated 34-page reference documenting Registry locations for the standard 5 Registry files. The document has a few new columns in the document - one which lists what versions of Windows the reference pertains to (ie: XP, Vista or Win7) and a second column that states when the Registry reference is updated (immediately, when document opened, at logon...) This document would also be great starting reference to initiate further research on Registry locations and extractable artifacts. D/L it....know it....print it and keep it handy!
Read more: Computer Forensics and IR - What's New?
Posts
