Windows Analysis, Timelines and Event Correlation

What it is

Once a Windows image and memory capture are ready, the investigator reads them for artifacts: traces left by the operating system and applications. Findings from many sources are then placed on a timeline and correlated into one story.

The exam asks where an artifact lives, which tool or plugin reads it, and how timelines and correlation are built.

How it works

Windows memory analysis

A memory image shows what was running: processes, network connections, loaded modules, injected code and sometimes keys. Volatility is the main framework. Common Volatility 3 plugins:

A process seen in psscan but not in pslist suggests hiding or a process that has exited. Check parent and child relationships for oddities.

Registry analysis

The registry is a set of hive files. System hives are in C:\Windows\System32\config (SYSTEM, SOFTWARE, SAM, SECURITY), and each user has NTUSER.DAT in the profile folder.

Each key has a last written time. Use a registry viewer, and always open copies of hive files.

Additional Windows artifacts

Prefetch is often disabled on servers and can be turned off by settings, so its absence needs explanation.

File system analysis with Autopsy and TSK

The Sleuth Kit (TSK) is a set of command line tools, and Autopsy is its graphical front end.

Autopsy adds ingest modules for keyword search, hash lookup, web artifacts, recent activity and timeline views, and builds a case database.

File system timeline creation and analysis

A timeline orders file system times. NTFS stores modified, accessed, changed (MFT entry) and born (created) values, summarized as MACB. Build one with TSK:

fls -r -m C: -o 2048 image.dd > body.txt
mactime -b body.txt -d > timeline.csv

fls -m writes the body file and mactime converts it. Super timelines from tools such as Plaso combine file times, logs and registry. Look for clusters of activity around the incident time, file creation shortly before execution, and gaps. Timestamps depend on time zones and the system clock, so record offsets.

Types of event correlation

Prerequisites of event correlation

Correlation only works when the data is trustworthy.

• Synchronized clocks across all sources, usually through NTP
• Centralized collection so logs are in one place
• Normalization into a common format and field names
• Complete, protected logs with sensible retention
• Known baselines to judge what is unusual

Event correlation approaches

Rule and field based methods are the most common in practice.

Event deconfliction

Deconfliction separates events with a known, legitimate cause from suspicious ones. Examples are an authorized vulnerability scan, a penetration test or the investigator's own actions. It avoids false positives, prevents the team from chasing its own activity, and keeps different teams from working at cross purposes.

Timeline and kill chain analysis

The Lockheed Martin Cyber Kill Chain has seven stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. Mapping evidence onto the stages shows how far the attack got and where it could have been stopped. A phishing email is delivery, a dropped payload is installation, and beaconing is command and control.

A worked example

A user opened an attachment. The Security log shows event 4688 for a new process, and Prefetch records its first run at that time. Memory shows the process with an outbound connection through windows.netscan, and malfind flags injected code.

The timeline puts these events within minutes of the email delivery. The investigator maps them to the kill chain and deconflicts a scan run earlier by the security team.

How the exam asks about this

• "Which Volatility plugin lists network connections in Windows memory?" → windows.netscan (netscan in Volatility 2).
• "Which TSK tool turns a body file into a timeline?" → mactime.
• "What must be consistent across log sources before correlation?" → Synchronized time.