Windows Forensic Analysis Toolkit, 3rd Edition

Chapter 8

Application Analysis

Chapter Outline

Introduction

Log Files

Dynamic Analysis

Network Captures

Application Memory Analysis

Summary

References

Information in this Chapter

• Application Analysis

Introduction

So far in this book, we’ve discussed a number of artifacts and resources that analysts can turn to within a Windows system to help address the issues and goals they are facing. Many of the artifacts we’ve discussed up to this point (e.g., Registry keys, jump lists, etc.) have been generated by the operating system as a result of either user or malware interaction with the environment. What we haven’t discussed is what an understanding of applications can provide to the analyst.

Application analysis can be a very important part of ...