Vista Forensics Slides
I pulished my Vista Forensics slides on my german computer forensics website.
Schlagwort: vista forensics
Talk about Windows Vista Forensics
I’m going to talk about Windows Vista Forensics at the DFN-CERT workshop. The workshop will be held on Februray 13 and 14, 2008 in Hamburg, Germany.
WTF is Microsoft doing with the Last Access Timestamp on Vista?
I recently discovered, that Microsoft destroyed a most valuable digital forensics evidence source on NTFS filesystems with Vista. The default registry key value for HKEY_LOCAL_MACHINE\SYSTEM\ CurrentControlSet \ Control\FileSystem\NtfsDisableLastAccessUpdate is now „1“, which means no last access timestamp will be written at all. On Windows XP and Windows 2000