the SANS Digital Forensic Courses have already included up-to-date material fully covering Windows 7 and Vista unlike anyone has done before. In fact, our challenge for SEC408, Computer Forensic Essentials is strictly based off of a Windows Vista case. We have details in SEC408, Computer Forensic Essentials, that are not as covered in peer courses. Here is just a few things we have helped document regarding Windows 7. User Profiles: With the release of Vista/Win7, Microsoft significantly changed the folder structure and mechanisms used by the operating system for user profiles. One of these changes was to make roaming profiles more explicit. Roaming profiles allow users to log onto other systems in the domain and have their profile information follow them. They have been around for many years, and in Vista/Win7, Microsoft decided to make what follows a user, and what doesnt follow a user much more explicit. Hence within a user profile in Vista/Win7, there are now two different set of folders: Roaming and Local. For our purposes, we want to be able to determine where our browser artifacts will be located in this new file structure. Traditionally Microsoft has included cookies in a roaming profile and excluded cache and history files by default. Thus, cookies are now found under the Roaming folder and history and cache can be found within the Local folder. Internet Explorer: The major change within Vista/Win7 that affects us when performing browser forensics is the newly implemented Protected Mode. The idea is that if malicious code is run in the browser, it will not have the necessary privileges to cause harm to the operating system. Since not all activities using the browser will be unprivileged, a duplicate set of directories were necessary to store files from unprivileged use, called Low folders. An example of what this looks like in the file system is: %userprofile%\AppData\Local\Microsoft\Windows\History\Low\History.IE5 (for the IE history files) Protected Mode conducts web browsing as an unprivileged user A new set of locations were added: low foldersMost browser evidence will be in low folders Local file usage is stored in the standard history folder (because it is not performed with restricted permissions) If Protected Mode is turned off, low folders will not be utilizedIf User Access Control (UAC) is turned off, low folders will not be utilized (it is required for Protected Mode to operate) If the instance of IE is run with Administrator permissions, the low folders are also not used USB Key Analysis: We discussed full Windows 7 USB Key Analysis in this post: http://blogs.sans.org/computer-forensics/2009/09/09/updated-computer-forensic-guide-to-profiling-usb-thumbdrives-on-win7-vista-and-xp/ USB Drive Enclosure Analysis: We discussed how to perform Windows 7 USB Drive Enclosure Analysis in this post: http://blogs.sans.org/computer-forensics/2009/09/09/usb-key-analysis-vs-usb-drive-enclosure-analysis/ Defrag Analysis: Chad Tilbury discussed detecting defrag analysis here: http://blogs.sans.org/computer-forensics/2009/08/17/de-mystifying-defrag-identifying-when-the-windows-defragmenter-has-been-used-for-anti-forensics-part-2-vista/ Timeline Analysis: Kristinn Gujonsson developed and released a full scope timeline creation tool called log2timeline that is able to parse many Windows Vista and Windows 7 artifacts in a single simple tool. Prefetch directory (reads the content of the directory and parses files found inside)UserAssist key info (reads the NTUSER.DAT user registry file to parse the content of UserAssist keys)Squid