Forensic Analysis of Windows Restore Points

Presentation I gave in February of 2011 about Windows Restore Points

1. By: Glenn P. Edwards Jr. @hiddenillusion
2.  “It provides a way to restore a system to a previously known good point that would otherwise require you to reinstall an application or even the entire operating system.” http://csit.udc.edu/~byu/UDC3529315/WindowsInternals-4e.pdf
3.  Windows ME  Windows XP  Windows Vista  Windows 7 * Windows Server 2003 isn’t supported but can also have it installed.
4.  Windows 2000  Windows Server 2008  FAT/FAT32 systems  System Restore requires shadow copies.
5.  Critical system files  Registry hives  Local profiles (not roaming)  WMI database  COM+ database  Windows File Protection DLL cache  ISS metabase file (If ISS is installed)  Files listed as include in the Monitored File Extensions list
7.  DRM settings  SAM hive*  WPA settings  User-created data stored in the user profile  Contents of redirected folders  HKLM\Software\WOW6432Node  Any file with an extension not listed in the Monitored File Extensions list
8.  Every 24 hours  Certain software installations  Windows Update  When the user requests it  Unsigned driver installations http://www.mydigitallife.info/wp-content/uploads/2007/12/unsigned-driver-install.jpg
9. %SystemRoot%\System Volume Information\_restore{XX-XXX-XXX } http://xpdrivers.com/wp-content/uploads/012111_0904_WindowsXPCr9.png
11. rp.log http://www.stevebunting.org/udpd4n6/forensics/registryhivefiles.jpg Registry hive files
12. http://www.stevebunting.org/udpd4n6/forensics/filesrenamed.jpg change.log.x
13. SYSTEM\Controlset00X\Control\BackupRestore HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore AsrKeysNotToRestor e FilesNotToBackup KeysNotToRestore DisableSR %SystemRoot%\System Volume Information\_restore{GUID}\fifo.log RPLifeInterval
14. http://www.stevebunting.org/udpd4n6/forensics/images/eventlog.jpg
15. • http://www.stevebunting.org/udpd4n6/forensics/restorepoints.htm • http://en.wikipedia.org/wiki/System_Restore • Windows Forensic Analysis by Harlan Carvey • Forensic Analysis of System Restore Points in Microsoft Windows XP by Kris Harms • http://www.mandiant.com/products/research/mandiant_restore_point_analyzer/download • Microsoft Windows Internals 4th Ed. By Mark Russinovich and David Soloman