±Partners and Sponsors

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 3
New Yesterday: 2
Overall: 26968
Visitors: 50

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Windows 8 Forensics - A First Look

Discussions related to Forensic Focus webinars. Please use the appropriate topic for each webinar.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page Previous  1, 2, 3, 4  Next 
  

Re: Windows 8 Forensics - A First Look

Post Posted: Wed Aug 29, 2012 3:13 pm

- Hwallbanger
I would like to also bring to your attention, that the last presented slide (Pg. 25), your audio was very sporadic and a lot of what you had said could NOT be heard OR understood.


My apologies for that. A problem with Skype forced me to dial into the conference bridge on that last slide from a landline and for some reason the recording system didn't like it!

I'm sure Josh will be happy to point you in the right direction as far as resources are concerned.

Jamie  

jamie
Site Admin
 
 
  

Re: Windows 8 Forensics - A First Look

Post Posted: Wed Aug 29, 2012 8:56 pm

Thanks for the forensic overview. Nice job.
_________________
Detective, LVMPD/Computer Forensics Lab,
USSS LV-ECTF/Computer Forensic Examiner, 

bkberghuis
Newbie
 
 
  

Re: Windows 8 Forensics - A First Look

Post Posted: Thu Aug 30, 2012 12:29 am

How about the app registry's when the user uninstalls an app. Will they remain or will they be deleted/Unallocated clusters ?

Regards
Martin Vinther
NITEC Denmark

ps. Thanks for the video  

Mav87th
Newbie
 
 
  

Re: Windows 8 Forensics - A First Look

Post Posted: Thu Aug 30, 2012 6:06 pm

- Mav87th
How about the app registry's when the user uninstalls an app. Will they remain or will they be deleted/Unallocated clusters ?

Regards
Martin Vinther
NITEC Denmark

ps. Thanks for the video


Good question Martin. From everything I saw in the beta testing I did the apps functioned much like programs did in previous versions of Windows, once an app was uninstalled there was still some residual registry artifacts that existed (although I did look at which ones did and did not). I will definitely put that on my list of "to do" things for version 2.0 of this research which I hope to have out at the end of the year.  

brunty11
Member
 
 
  

Re: Windows 8 Forensics - A First Look

Post Posted: Thu Aug 30, 2012 6:10 pm

- Hwallbanger
There still seems to be some questions as to where your default created files will be stored.

In the past, since I believe Win95, you could look for where your login's profile's Document folder/directory was located. Then in Win7 came along the development of Libraries.

From what you have explored and read and researched, does the Non-bootable partition known as the Resilient File System have much to do with this ?

HWallbanger Smile


This has been pretty cloudy from day 1, but I can't really answer your question for sure until the final version comes out in October. I will say that ReFS was developed with redundancy in mind, so I'm sure they will integrate such a new file system "storage pools" into it. I'd recommend reading up on storage pools and what it entails on Google as I don't give an explanation much justice.

I will say this however.... MS is trying to counter the iCloud, so be expected for some odd network storage component to be in place once the dust settles with this new OS.

-Josh  

brunty11
Member
 
 
  

Re: Windows 8 Forensics - A First Look

Post Posted: Tue Nov 27, 2012 6:38 pm

Is there a transcript available for this webinar?
_________________
Thanks;
Ashley
Computer Forensics Student - Third Year
University of Derby (UK) 

bsc.Smith19
Member
 
 
  

Re: Windows 8 Forensics - A First Look

Post Posted: Tue Nov 27, 2012 7:31 pm

Go to the webinar page.

Scroll down.  

jamie
Site Admin
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 3 of 4
Go to page Previous  1, 2, 3, 4  Next