Microsoft published their „Fundamental Computer Investigation Guide For Windows“. The paper discusses processes and tools for use in internal computer investigations for windows systems.
You can find the guide here.
The table of content of the document:
Overview..
- Computer Investigation Model
- Initial Decision-Making Process.
- Chapter Summary.
- Audience.
- Caveats and Disclaimers.
- References and Credits.
- Style Conventions.
- Support and Feedback.
Chapter 1: Assess the Situation.
- Notify Decision Makers and Acquire Authorization.
- Review Policies and Laws.
- Identify Investigation Team Members.
- Conduct a Thorough Assessment
- Prepare for Evidence Acquisition.
Chapter 2: Acquire the Data.
- Build a Computer Investigation Toolkit
- Collect the Data.
- Store and Archive.
Chapter 3: Analyze the Data.
- Analyze Network Data.
- Analyze Host Data.
- Analyze Storage Media.
Chapter 4: Report the Investigation.
- Gather and Organize Information.
- Write the Report
Chapter 5: Applied Scenario Example.
- Scenario.
- Assess the Situation.
- Acquire Evidence of Confidential Data Access.
- Remote Evidence Collection.
- Local Evidence Collection.
- Analyze Collected Evidence.
- Report the Evidence.
- Applied Scenario Lab Configuration.
- Deploy Computers and Create Domain.
- Create Users and Groups.
- Create Folders and Files.
- Assign Sharing and Permissions.
- Configure Auditing.
Appendix: Resources.
- Preparing Your Organization for a Computer Investigation.
- Worksheets and Samples.
- Reporting Computer-Related Crimes.
- Local Law Enforcement Agencies.
- Local Law Enforcement Agencies.
- Training.
- Tools.
- Windows Sysinternals Tools.
- Windows Tools.
- Windows Sysinternals Tools.
Acknowledgments.
Index.