Windows Forensic Analysis Toolkit: Advanced Analysis Techniques for Windows 8
Harlan Carvey · Syngress (Elsevier) · Fourth edition · 2014
Identifier: ISBN 978-0-12-417157-2
Access and status
Cost
Paid
Costs money to buy outright — a book, a licence, a registration.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
An artifact-by-artifact working guide to Windows examination: Volume Shadow Copies, file metadata, registry analysis, malware detection on a dead box, timeline construction and artifact correlation. Written as a bench manual rather than a textbook.
Who it is for, and when
Useful for the framing more than the specifics: Carvey's approach to building a timeline from many low-value artifacts and to documenting what an artifact does and does not prove is still how good Windows examination is done. Read the timeline and correlation chapters; treat the artifact lists as a starting inventory to re-verify against current builds.
What it does not cover
Explicitly targets Windows 8 and is positioned by the author as a complement to the second edition (XP) and third (Windows 7) rather than a replacement, so it does not carry that earlier material forward. Nothing on Windows 10 or 11 artifacts, SRUM, ETW, OneDrive and cloud-sync artifacts, or BitLocker-by-default. The scripts and tool versions are 2014-era.
Go to the source
Open at shop.elsevier.com (opens in a new tab)https://shop.elsevier.com/books/windows-forensic-analysis-toolkit/carvey/978-0-12-417157-2
Details
- Type
- Book
- Written for
- Working examinerWorking examiner
- Author
- Harlan Carvey
- Publisher
- Syngress (Elsevier)
- Version verified
- Fourth edition
- Year
- 2014
- Identifier
- ISBN 978-0-12-417157-2
- Topics
- windows, registry, timeline, triage, malware
- Checked at source
Related entries
A large collection of free single-purpose Windows artefact parsers — among them MFTECmd, PECmd, LECmd, JLECmd, AmcacheParser, SBECmd, EvtxECmd, RECmd, and the Timeline Explorer and Registry Explorer GUIs. The tools are still distributed from ericzimmerman.github.io, with a Get-ZimmermanTools helper that pulls the current set.
Autopsy
FreeAn open-source graphical forensic platform built over The Sleuth Kit, with an ingest-module architecture for keyword search, hash matching, web and email artefacts, and timeline review. It is now maintained by Sleuth Kit Labs, which also sells the commercial Cyber Triage product.
David Cowen's daily-blog project, running to over 800 numbered posts plus the Sunday Funday challenges, Solution Saturday write-ups and the Forensic Lunch video series, covering Windows artifacts, NTFS internals, cloud logging and DFIR programming.
Two open-source Rust tools that apply Sigma and their own rules directly to Windows event log (EVTX) files and produce a prioritised, timeline-ordered set of hits. Hayabusa comes from Yamato Security; Chainsaw is published by WithSecure (the repository now lives under WithSecureOpenSource). Both are actively released.
An open-source Python framework that extracts timestamps from hundreds of artefact types across a disk image or directory and writes them into a single normalised storage file. log2timeline is the extraction front end; psort and psteal filter, sort, and export the result.