±Partners and Sponsors

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 5
New Yesterday: 12
Overall: 26994
Visitors: 79

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Registry query

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2, 3, 4  Next 
  

Registry query

Post Posted: Mon Sep 07, 2009 11:40 pm

Hi all,

I'm a little confused and hope someone can enlighten me regarding the Timezone data i've extracted from the registry. Data below was extracted from that SYSTEM using regripper.

Code:

----------------------------------------
LastWrite Time Wed Feb  4 17:16:46 2009 (UTC)
  ShutdownTime = Wed Feb  4 17:16:46 2009 (UTC)
----------------------------------------
ShutdownCount
ControlSet001\Control\Watchdog\Display
LastWrite Time Wed Feb  4 17:16:46 2009 (UTC)

ShutdownCount = 64
----------------------------------------
TimeZoneInformation key
ControlSet001\Control\TimeZoneInformation
LastWrite Time Tue Feb 17 18:14:57 2009 (UTC)
  DaylightName   -> Pacific Daylight Time
  StandardName   -> Pacific Standard Time
  Bias           -> 480 (8 hours)
  ActiveTimeBias -> 480 (8 hours)


Notice the timezone key lastwrite was updated 13 days after the shutdown time/date was recorded. My question is how can i confirm the time and date when the user yanked the plug from behind the computer? Please note when we got to the computer it was already switched off but no can verify when.

I hope i've explained it clearly and i hope someone can point me to the right direction.

MC.  

mc02
Member
 
 
  

Re: Registry query

Post Posted: Tue Sep 08, 2009 1:39 am

Have you looked at the Event Logs? There probably won't be a specific shutdown event if the plug was pulled, but you could at least get an estimate based on when the last event was. This is of course assuming event logging is switched on.  

ddewildt
Senior Member
 
 
  

Re: Registry query

Post Posted: Tue Sep 08, 2009 5:42 am

All data, not just Registry data, needs to be understood in the context in which it is created and modified (with deletion being the extreme form of modified).

I think ddewildt provided excellent insight into the issue presented by the OP.

> ...how can i confirm the time and date when the user yanked the plug from behind the computer?

Create a timeline from the system (see my blog for information on how to do this...); you may be able to surmise that if the plug was simply pulled on the system, then the last file system activity may correlate to that time.  

keydet89
Senior Member
 
 
  

Re: Registry query

Post Posted: Tue Sep 08, 2009 6:20 am

Thanks all for the input. I'll check the timeline or the event viewer. Smile

MC  

mc02
Member
 
 
  

Re: Registry query

Post Posted: Tue Sep 08, 2009 7:52 am

Why would you use the Event Viewer?  

keydet89
Senior Member
 
 
  

Re: Registry query

Post Posted: Tue Sep 08, 2009 8:10 am

Have you verified the regripper results against another tool to insure regripper is providing correct results.  

magicm
Newbie
 
 
  

Re: Registry query

Post Posted: Tue Sep 08, 2009 8:45 am

- keydet89
> ...how can i confirm the time and date when the user yanked the plug from behind the computer?

see my blog for information on how to do this...


windowsir.blogspot.com/  

douglasbrush
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 4
Go to page 1, 2, 3, 4  Next