Please enable JavaScript.

Coggle requires JavaScript to display documents.

Week 6 - Coggle Diagram

- - - - contains acc info for localsystem, local users
      - contains user's encrypted password
      - location of user's registry hive
    - - Shell Bags
        
        registry artefacts that store user preferences for directories, windows size, sorting order, placement on screen
    - - user preferences, settings, startup scripts, most recent MRU keys
    - - info on software installed, apps store configuration data in the Software key
    - - SYSTEM KEY contains two control sets
        
        Current control sets
        
        last known goods
      - Current control set is loaded into Software hive :
  - - - no. of times exe was run
      - og path of exe
      - date exe files was last run
      - list of dynamic link files required to run ese
  - - - file contains actual thumbnail produced when user is viewing content of folder
  - - - memory management technique that provides an "idealized abstraction of the storage resources that are actually available on a given machine" which "creates the illusion to users of a very large (main) memory"
    - - swaps memory to and from processes that running in the bg or fg
    - - windows cred
      - strings
      - plain text passwords for apps
      - may maiintain EFS passwords
      - windows event log records
      - running processes
- - - - run-level
      - services
      - version of the distribution
      - time zone
  - - - examiner searches for acc with login privileges via grep ?v nologin in the password file
  - - - software messages
      - events not found in other logs
      - system messages
- - - - index
        
        very fast
      - live
        
        flexible
      - types in searching
        
        use exact words
        
        regular expression
        
        spelling variations
        
        Searchingfor pattern; patterm matching any email addr, ph_no, credit cardl...
  - - - db that allows for fast searching using keywords/ regex
      - extracted and used a dictionary in password cracking attempts