SDF: Shimcache Forensics

Name: SDF: Shimcache Forensics
Rating: 4.5 (124 reviews)

Learn how an analyze Windows Shimcache evidence

Created byMichael Leclair

Last updated 5/2023

English

What you'll learn

Understand the Shimcache artifact
Be able to explain Shimcache evidence
Learn the user behaviors that affect the artifact
Know how to validate Shimcache evidence
Learn how to interpret artifact results
Learn how to use freely available tools to extract in parse the artifact

Course content

7 sections • 31 lectures • 1h 18m total length

Welcome to Shimcache Forensics0:37
Welcome to the Surviving Digital Forensic Training Series: Windows Shimcache Forensics!

The goal of this class is to teach you a valuable computer forensics skill all in about one hour. The Windows Shimcache artifact is a core Windows operating system artifact that provides insight to help advance computer forensic investigations. Knowing how to work with this artifact is a critical skill for all analysts.
Class outline5:30
This lecture goes over the goals of the Windows Shimcache class and what students will learn upon completion.
Class tools and downloads0:47
This lecture provides an overview of the tools you will be using in this class. The SDF series focuses on using low-cost\ no-cost computer forensic tools built by the DFIR community.
SIFT Workstation0:37
The SIFT workstation, freely available, will be used as a platform to run the Linux tools.

Set up instructions may be found here: https://digital-forensics.sans.org/community/downloads

SDF class for SIFT set up: https://www.udemy.com/surviving-digital-forensics-paladin-virtual-machine/?couponCode=PODCAST

What is Windows Shimcache?0:26
This lecture explains what the Windows Shimcache artifact is and why it is one of the core windows forensic artifacts examiners use for investigations.
Forensic breakdown4:06
This lecture breaks down the Windows Shimcache artifact into its different forensic components to help examiners better understand the information the artifact contains.
Caveats4:15
This lecture reviews additional caveats that are important to understand when working with Windows Shimcache evidence.
Shimcache knowledge check

Forensic Tools0:21
The following modules show students how to set up and use forensic tools to parse Shimcache evidence.
Artifact extraction2:06
This lecture goes over how to extract the artifact from systems
FTK Imager may be downloaded at: https://accessdata.com/product-download/ftk-imager-lite-version-3.1.1
Shim-in-the-raw: Why tools are preferred2:00
This lecture takes a native look at the artifact to address the challenges of manual interpretation.
FRED (Forensic Registry Editor) may be downloaded at: https://www.pinguin.lu/fred
RegRipper setup0:49
This lecture goes over the steps to obtain an install RegRipper GUI
RegRipper may be downloaded at: https://github.com/keydet89/RegRipper2.8
RegRipper GUI overview1:44
This lecture goes over usage of the forensic tool to parse the artifact.
RegRipper may be downloaded at: https://github.com/keydet89/RegRipper2.8
RegRipper CLI overview5:24
This lecture goes over usage of the forensic tool to parse the artifact.
RegRipper may be downloaded at: https://github.com/keydet89/RegRipper2.8
Shimcacheparser Setup1:58
This lecture walks through the steps of setting up on the shimcache parser on the SIFT workstation
Shimcacheparser overview4:46
This lecture goes over usage of the forensic tool to parse the artifact.
Make ShimCacheParser executable from anywhere3:55

Validation Exercises0:25
The following validation exercises seek to demonstrate the effects of different types of user driven actions on the artifact. The goal is to help students better understand how to interpret artifact results.
Baseline test2:45
This practical demonstrates the affect of running an executable multiple times on the artifact
Dropped executable test2:55
This practical shows what happens to the artifact when a new executable is dropped on to a system
Execution test3:27
This practical shows the affect of running an executable for the first time on the artifact
Deleted executable test2:50
This practical shows the effect of the leading an executable on the artifact

Processing your Shimcache results0:18
This lecture goes over some grep tips for post processing Shimcache results
Targeting recent Shimcache records3:32
This lecture goes over some grep tips for post processing Shimcache results
Targeting notable directories3:43
This lecture goes over some grep tips for post processing Shimcache results
Targeting notable file names5:01
This lecture goes over some grep tips for post processing Shimcache results

Scripting Shimcache Processing Tasks0:25
In this section we are going to add automation to some of the standard, repeated Shimcache evidence refinement tasks.
Scripting Shimcache processing tasks0:50
The section goes over the power of adding scripting to your post processing tools.
Building the script6:57
This section walks you through building a script to automate post processing tasks.
Running the script4:20
In this section validate the results of our script.

Final thoughts on Shimcache evidence0:59
A review of the key points learned during class
Thank you!0:29
Thank you for checking out the Surviving Digital Forensic Training Series!

Be sure to check out the other classes in the series here at Udemy.

Check out the Digital Forensics Survival Podcast and listen to talk about computer forensic analysis, techniques, methodology, tool reviews and more http://digitalforensicsurvivalpodcast.com

Requirements

Windows 8 or Windows 10 system (Windows 10 recommended)
All in-class forensic programs are freely available and download links provided
Student testing and validation material provided

Description

Welcome to the Surviving Digital Forensics series. This class is focused on helping you become a better computer forensic examiner by understanding how to use Windows Shimcache data to prove file use and knowledge - all in about one hour.

As with previous SDF classes you will learn by doing. The class begins with Windows Shimcache fundamentals and will provide an understanding of how the artifact works. Then students delve into several validation exercises to observe how user driven activity affects Windows Shimcache evidence. The last section teaches students how to use freely available DFIR community built forensic tools to examine Shimcache evidence. By the end of the class students will have a solid understanding of how to use the Windows Shimcache as evidence, understand the types of user behaviors that affect the Shimcache and know how to use Windows Shimcache forensic tools.

Expert and novice computer forensic examiners alike will gain from this class. Since we are doing it the SDF way we are going to teach you real computer forensic skills that you can apply using our method or with any forensic tool you choose. Therefore you are not just going to learn about the Windows Shimcache but you will learn a method you can use to answer questions that may come up in the future.

A PC running Windows 8 or Windows 10 is required for this course. The forensic tools we use are all freely available, so beyond your laptop and operating system all you need is the desire to become a better computer forensic examiner.

Who this course is for:

Computer forensic analysts
IT professionals
Security analysts
Students

SDF: Shimcache Forensics

What you'll learn

Explore related topics

Course content

Introduction4 lectures • 8min

Understanding Windows Shimcache3 lectures • 9min

Forensic tool set up9 lectures • 23min

Validation practicals5 lectures • 12min

Refining Shimcache results4 lectures • 13min

Scripting Shimcache Processing Tasks4 lectures • 13min

Conclusion2 lectures • 1min

Requirements

Description

Who this course is for: