MANDIANT Restore Point Analyzer

CloneRanger · Feb 23, 2011

Found this VERY interesting PDF article & free software

A simple forensic tool to analyze change.log files from restore points to determine the original paths and file names of files stored inside restore points.

Learn more about Restore Point Analyzer

White Paper

PDF Forensic Analysis of System Restore Points in Windows XP

Introduction

Investigating computer intrusions can be a complicated matter. Attackers are continually hiding their malicious code, erasing or modifying log files, and finding new techniques to minimize the trace evidence they leave behind. After reviewing nearly 200 compromised systems in the last 12 months, I have often become frustrated with the lack of evidence found on victim systems after the intrusions took place. In fact, the exploitation and post-exploitation techniques used by current attackers almost always thwart traditional physical media analysis practiced by the majority of computer forensic examiners. Therefore, we have to continually improve our techniques, and add investigative steps that used to be rare, but now must become commonplace to the forensic examinations we perform in support of computer intrusion cases. Several new investigative steps we have added to our repertoire include in-depth examination of System Restore points.

This article is the result of a case study on an investigation conducted in the United States. This case demonstrates how computer forensic examiners can review System Restore points to establish an event timeline and unearth well hidden clues that assist in understanding how a computer system had been compromised. Without review of the System Restore points, our
investigation would have fallen very short of answering the questions promoted by the case.

http://www.mandiant.com/products/research/mandiant_restore_point_analyzer
Click to expand...

You can DL a free copy of RPA from here

http://www.mandiant.com/products/research/mandiant_restore_point_analyzer/download

I did, but as i don't want NET and don't have it it's no go for me, on this comp anyway

sded · Feb 23, 2011

Just as an aside, I heard Kevin Mandian speak as part of the RSA 2011 Security Conference last week and though he really had his s--- together. Worth taking a look at.

Log in or Sign up

MANDIANT Restore Point Analyzer

CloneRanger Registered Member

sded Registered Member

Log in or Sign up

MANDIANT Restore Point Analyzer

CloneRanger Registered Member

sded Registered Member

Useful Searches