Windows 8-- now with more hiberfil

So, Microsoft is touting that their new OS (Windows 8) will boot up "30-70%" faster than any of their previous OS's. While this is super exciting for normal users (sad for us who use the long boot up times to go for a cup of coffee), it is very interesting for forensic investigators.


So, the way Microsoft does this is creating a 'mini' hiberfil, catching just the kernel session during a shutdown. What is the hiberfil? If you ever hibernate your computer, the OS creates a file called hiberfil.sys which is essentially a snapshot of the machines state and a compressed form of what is residing in memory at the time of hibernation. This way when you get your computer out of hibernation, it is very quick to restore and things were as you left it.

You can see an article about the "hiberfil.sys"  from hibernation and what can be extracted from it here.


So now imagine being able to use a hiberfil for boot-up, most of the kernel level stuff is already setup and ready to go, thereby cutting down immensely on driver setup and initialization. (See the link for a pretty diagram).


What does this mean for forensics? Always being able to have a hiberfil means having a portion (not sure how much- the article was a bit fuzzy on this) of RAM to extract and run your favorite memory analysis tool on. At the very least it will have some tasty kernel-level information very useful for rootkit/malware finders.


I guess we shall see come the release of Windows 8!

Windows 7 Forensics

So I was discussing with an old coworker today about the desire to learn a tad more about Windows 7 in a forensic sense. It is much different than XP (which still has a good chunk of market shares, quite impressive for being 10 years old) and since I am going to be back on the job saddle **cough cough** soon, its good to start thinking about these things...

So, I present some good links on Windows Vista/7 in terms of forensics:

Iron Geeks Forensically Interesting Spots in Windows 7/Vista: So not all of these are new by any stretch, but I see some interesting opportunities for scripting when I see these. I might be playing with Harlan Carvey's RegRipper and my boyfriends Windows 7 box (ahhh there is always a sacrificial lamb) soon.

Windows 7/VISTA Advanced Forensics for LE: Seems to have some interesting downloads, including one on Shadow Volumes

On another note I am trying to pick up Java, because even though I hate (ok maybe not hate, just do not like very much in the words of my granny) programming I do appreciate how useful knowing how to write/read it can be. I am still on baby steps, but I am using the book "Understanding Java" by Barry Cornelius. Very descriptive, good explanations, and no cheesy graphics. Not that I mind cheesy, heck you will never guess where I am headed this weekend!! :: suspense::