Collecting data from the endpoints
Windows OS and applications running on it leave many traces of their activity, which are stored in various formats and locations. Over the years, researchers have been analyzing them. They have prepared an advanced knowledge base containing information about the artifacts, as well as a deep breakdown of their format and useful data that could be used for the analysis. Nowadays, such a knowledge base helps us to determine more effective ways of data collection and analysis.
Non-volatile data collection
Let’s first talk about non-volatile data collection. From the endpoints’ perspective, the data shown in Figure 4.1 can be collected for incident examination:
Figure 4.1 – Non-volatile data on the endpoints
In the previous section, we already mentioned that, to save time on collection and concentrate on the immediate analysis of collected data incident response, specialists can use triaging. This...
