Skip to main content    

An official website of the United States government

Here’s how you know

**Official websites use .gov**              A **.gov** website belongs to an official government organization in the United States.            

**Secure .gov websites use HTTPS**              A **lock** (  LockA locked padlock) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.            

https://www.nist.gov/itl/ssd/software-quality-group/windows-732-diskprint

            -  Topics  -  All Topics 
-  Advanced communications 
-  Artificial intelligence 
-  Bioscience 
-  Buildings and construction 
-  Chemistry 
-  Climate 
-  Cybersecurity 
-  Electronics 
-  Energy 
-  Environment 
-  Fire 
-  Forensic science 
-  Health 
-  Information technology 
-  Infrastructure 
-  Manufacturing 
-  Materials 
-  Mathematics and statistics 
-  Metrology 
-  Nanotechnology 
-  Neutron research 
-  Performance excellence 
-  Physics 
-  Public safety 
-  Resilience 
-  Standards 
-  Transportation 
 
            -  Publications 
            -  Labs & Major Programs  -  Laboratories    -  Communications Technology Laboratory 
  -  Engineering Laboratory 
  -  Information Technology Laboratory 
  -  Material Measurement Laboratory 
  -  Physical Measurement Laboratory 
-  User Facilities    -  NIST Center for Neutron Research 
  -  CNST NanoFab 
-  Research Test Beds 
-  Research Projects 
-  Tools & Instruments 
-  Major Programs    -  Baldrige Performance Excellence Program 
  -  CHIPS for America Initiative 
  -  Manufacturing Extension Partnership (MEP) 
  -  Office of Advanced Manufacturing 
  -  Special Programs Office 
  -  Technology Partnerships Office 
 
            -  Services & Resources  -  Standards and Measurements    -  Calibration Services 
  -  Laboratory Accreditation (NVLAP) 
  -  Quality System 
  -  Standard Reference Materials (SRMs) 
  -  Standards.gov 
  -  Time Services 
  -  Office of Weights and Measures 
-  Software 
-  Data    -  Chemistry WebBook 
  -  National Vulnerability Database 
  -  Physical Reference Data 
  -  Standard Reference Data (SRD) 
-  Storefront 
-  License & Patents 
-  Computer Security Resource Center (CSRC) 
-  NIST Research Library 
 
            -  News & Events  -  News 
-  Events 
-  Blogs 
-  Feature Stories 
-  Awards 
-  Video Gallery 
-  Image Gallery 
-  Media Contacts 
 
            -  About NIST  -  About Us    -  Leadership 
  -  Organization Structure 
  -  Budget & Planning 
-  Contact Us 
-  Visit 
-  Careers    -  Student programs 
-  Work with NIST 
-  History    -  NIST Digital Archives 
  -  NIST Museum 
  -  NIST and the Nobel 
-  Educational Resources 
 

Information Technology LaboratorySoftware and Systems Division

## Software Quality Group

# Windows-7/32 Diskprint

## Share

Facebook

Linkedin

Twitter

Email

A diskprint is a collection of information captured at various stages of an applications lifecycle. The set of data associated with a particular stage is referred to as a slice. Various tools are used to extract and analyze each data set. Every slice is processed using NSRL tools. These tools are used to extract the filesystem metadata associated with each slice and store that information. The distribution of this stored file metadata can be in different formats .

In addition to the file metadata, the registry hive files are extracted and processed.

The MD5, SHA1 and SHA256 file signatures for the xml downloads are available here.

## DFXML

Digital Forensics XML (DFXML) is a markup language that enables the exchange of forensic information in a structured form. It is used as a distribution format for the file system metadata associated with each diskprint slice. The phyton tool dfxml_tool.py, part of the DFXML library, was used to process the slice VMDK file and output the results in this XML format. The XML output is validated using the  dfxml schema.

This is a DFXML sample of the file metadata for Slice 1 of the Windows 7-32bit OS diskprint.

### CybOX XML Generation

The Cyber Observable eXpression CybOXTM language is used as a distribution format for various objects of interest. CybOX provides a standard XML reporting format for describing different objects types associated with a slice.

The CybOX python api  was used to create the XML documents from each type of object. The Product Object describes the product used to create the diskprint. This would be similar to information provided in the NSRLprod.txt file. We are distributing the file system metadata for a slice using the CybOX File Object. This is the type of information distributed in the NSRLFile.txt.

The Win Registry Key Object characterizes a Windows Registry object. The perl tool regdump.pl in the Perl Parse_Win32Registry-1.0 module was used to analyze the registry hives extracted from a slice. The generated XML identifies the root key and all its subkeys.

These are the cybOX objects for Slice 1 of the Windows 7-32bit OS diskprint.

Below is the complete distribution of a the Windows 7-32bit objects to date.

The MD5, SHA1 and SHA256 file signatures for the zip file downloads are available here.

1stSlice. Installed the OS into the VM. Selected of the English Language. Accepted the license terms. Restarted to Windows.

2ndSlice. Configured system name and user identity. Entered product code. Rejected automatic updates to the system. Set the system time. Rejected setting the clock for daylight saving time.

3rdSlice. Configured the network settings.

4thSlice. Manually restarted the system. The network was configured with its own IP. This allows for the capture of network communication.

5thSlice.Restarted the OS and Logged In.

6thSlice. The VM tools were installed. The System was restarted.

Digital evidenceSoftware research

## Contacts

                -  Douglas R. White  douglas.white@nist.gov      (301) 975-4761   

### HEADQUARTERS

301-975-2000

Webmaster | Contact Us | Our Other Offices

TwitterFacebookLinkedInInstagramYouTubeGiphyRSS FeedMailing List

Feedback

            -  Site Privacy 
            -  Accessibility 
            -  Privacy Program 
            -  Copyrights 
            -  Vulnerability Disclosure 
            -  No Fear Act Policy 
            -  FOIA 
            -  Environmental Policy 
            -  Scientific Integrity 
            -  Information Quality Standards 
            -  Commerce.gov 
            -  Science.gov 
            -  USA.gov 
            -  Vote.gov