Digital Forensic Analysis on Prefetch Files

Narasimha Shashidhar; Dylan Novak

Makale detayları

Digital Forensic Analysis on Prefetch Files

Yazarlar:

Narasimha Shashidhar | Dylan Novak

Yayıncı:

Şeref SAĞIROĞLU

Dergi:

International Journal of Information Security Science 2015 Vol.4 Issue 2, pp.39-49

Belge Tipi:

Makale

Yayın Tarihi:

6/2015

Belge Dili:

İngilizce

Document ID (Org No.):

2000719288

Sıklık:

Üç Aylık

eISSN:

2147-0030

Özet:

 

Prefetch files, like any other file in a file system, can be viewed from a digital forensic perspective to further a forensic investigation. Using appropriate tools and techniques available to a digital forensic examiner, we explore and investigate the potential of prefetch files and what they have to offer from a digital forensic analysis perspective in an effort to contribute towards the rapidly advancing field of digital forensics. Windows' prefetch files are used to decrease the startup times of applications and are formatted in a manner to instruct application processes to load data and necessary libraries into memory that it needs before it is actually demanded. In other words, prefetch files help avoid a hard fault, thereby minimizing startup times. These files reside in the prefetch folder under the Windows installation directory of a system. This folder contains prefetch files for user and system applications as well as a ReadyBoot folder, a layout.ini file, and several database files. In this paper, we investigate the mechanism behind the creation and manipulation of prefetch files on a Windows machine. Diving deep into the assembly code generated by the disassembler IDA PRO from ntkrnlpa.exe, we are able to find the Windows kernel processes responsible for the creation of these prefetch files and parse these prefetch files to better understand their forensic value.

Makale detayları

Digital Forensic Analysis on Prefetch Files

Yazarlar: Narasimha Shashidhar | Dylan Novak

Yayıncı: Şeref SAĞIROĞLU

Dergi: International Journal of Information Security Science 2015 Vol.4 Issue 2, pp.39-49

Belge Tipi: Makale

Yayın Tarihi: 6/2015

Belge Dili: İngilizce

Document ID (Org No.): 2000719288

Sıklık: Üç Aylık

eISSN: 2147-0030

Sayı

Yazarlar:

Narasimha Shashidhar | Dylan Novak

Yayıncı:

Şeref SAĞIROĞLU

Dergi:

International Journal of Information Security Science 2015 Vol.4 Issue 2, pp.39-49

Belge Tipi:

Makale

Yayın Tarihi:

6/2015

Belge Dili:

İngilizce

Document ID (Org No.):

2000719288

Sıklık:

Üç Aylık

eISSN:

2147-0030