iSchool Capstone

Actionable Evidence in the Wake of Anti-Forensic Activity on Windows 8 Systems

Project tags:

business & systems analysis

information assurance & cybersecurity

Project poster

Forensic examiners and legal professionals must stay abreast of new technologies while adhering to sound practices required to satisfy evidentiary requirements in court. The widespread adoption of a new operating system and browser bears enormous importance for the digital forensic community. Specifically, the impact of Windows 8 and Internet Explorer 10 is especially dramatic with their range of new features.

Our research encompasses the technical forensic considerations and the legal concerns that arise when dealing with anti-forensic activity and contemporary systems. It serves as an overarching, practical resource for forensic practitioners and legal professionals. We provide an overview of the forensically relevant changes with Windows 8 and Internet Explorer 10, and then investigate the potential for recovery of valuable evidence under forensically challenging circumstances. Finally, we offer insight into the evidentiary treatment and legal ramifications of live acquisition of evidence and antiforensic activity.

Project participants:

Justin Brecese

MSIM

Aaron Alva

MSIM

Casey Rodgers

MSIM