1 
Disclaimer 

This research was funded by the National Institute 

of Standards and Technology Office of Law 

Enforcement Standards and the Department of 

Homeland Security Science and Technology 

Directorate. 

Any mention of commercial products or reference 

to commercial organizations is for information 

only; it does not imply recommendation or 

endorsement by NIST nor does it imply that the 

products mentioned are necessarily the best 

available for the purpose. 

2 
What impact does software have on a 

computer system? What is its footprint ? 

Is it diagnostic ? 

Is it persistent ? 

When in the software lifecycle can its elements be 

observed ? When should they be expected ? 

Introduction 

3 
Motivation 

Catalog the effects of software on a system over 

the lifetime of the software. 

Provide digital forensic investigators with new 

reference data. 

Extend the NSRL research environment for use 

by forensic researchers to develop new tools and 

techniques. 

4 
Combines the what, where, when and how: 

- Nature of changes 

- Location of changes 

- Actions causing changes 

 - Stage in application lifecycle 

Application Footprint 

5 
Application Footprint Slices 

A “slice” is a collection of metadata derived 

from a system at a particular moment in time 

cf. a slice of time 

Application Footprint is the sequence of all slices 

taken during the software lifecycle

6 
Minimum Slice Set 

Package dependent, but must include: 

• Installation 

• Execution 

• Uninstallation 

• Post system restart 

7 
 Systems and Software 

All software is part of the NSRL collection 

- Known, traceable 

Operating Systems 

- Focus on Microsoft© Windows® 

 variants 

Software applications 

- Based on community 

 recommendations and requests 

8 
Short list 

Windows XP, Windows Vista 32/64bit, 

Windows 7 32/64bit, Windows 8. 

This is a r • Browsers: Chrome, Firefox, Safari, IE. 

• Archivers : WinZip, WinRAR 

• Network Tools: Wireshark, AirSnort, NetCat

• Executable Packer: UPX 

• Microsoft Office: 2003 and later 

• Messengers: Windows Live, Yahoo! 

Messenger 

Operating Systems 

9 

Sample Applications 
Method 

Virtual Machine Installation 

10 
Virtual Machine Advantages 

VM state can be captured at any time 

- VM may be paused / suspended 

VM is preserved as a set of files 

- Hard drive, RAM contents, etc. 

Can be copied off for external processing 

Save for future reference and further 

investigation 

11 
File system (file hashes, MAC times, etc) 

 - Executables

 - Libraries 

 - Documents / Images / Multimedia 

Configuration information 

 - Windows® Registry 

Memory mapping information 

 - System RAM 

Network Chatter 

 - Changes in external systems

Changes in a System 

12 
Step through the minimum slice set: 

• Post – Installation 

• Post – Execution 

• Post – Uninstallation 

• Post system restart 

Method 

13 
Slice Data 

Slice ID – Unique ID 

Slice State – Stage in the software 

lifecycle 

Slice Notes – All user actions taken when 

 generating the slice including unexpected 

 software behavior 

14 
Diskprint Bundle 

Diskprint bundle contains: 

VM bundle for each diskprint slice 

File of network chatter for each slice 

SQL file with the notes and captured metadata 

for each slice 

The completed bundle is moved to a server for 

processing. 

15 
Challenges 

Slow Process – Saving off the VM is slow 

Difficult to isolate software behavior: 

 e.g. avoid automatic updates 

Not totally automated – Human judgment 

 to decide when to take a slice 

The decision is not straightforward 

16 
Diskprint Use 

Study the Windows® Registry 

- see Alex Nelson’s work 

Use case for Digital Forensics standards 

 development: 

 

 Digital Forensics XML ( DFXML ) 

 Cyber Observable Expression ( CybOXTM) 

17 
What’s Next? 

Streamline the diskprinting process: 

 E.g. use snapshot mechanism provided 

 by VM vendor. 

Expand technique to capture automatic updates (e.g. 

software updates) on live systems. 

18 
Thank You 

John Tebbutt 

Mary Laamanen 

Alex Nelson 

john.tebbutt 

mary.laamanen 

alex.nelson } @nist.gov 

19