Forensic analysis of System Restore points in Microsoft Windows XP [An article from: Digital Investigation]

This digital document is a journal article from Digital Investigation, published by Elsevier in 2006. The article is delivered in HTML format and is available in your Amazon.com Media Library immediately after purchase. You can view it with any web browser.

Description:
Investigating computer intrusions is becoming infinitely more complicated with the advancement of post-exploitation techniques currently being used by attackers. We must continually update our traditional forensic techniques to include the more rare investigative steps. Analysis of System Restore points is one of these steps. This article will illustrate how a forensic examiner analyzed System Restore points to reveal traces of evidence which ultimately lead to the complete understanding of the computer and subsequent bank account compromises.