Matches in SemOpenAlex for { <https://semopenalex.org/work/W9605825> ?p ?o ?g. }
Showing items 1 to 63 of
63
with 100 items per page.
- W9605825 endingPage "202" @default.
- W9605825 startingPage "159" @default.
- W9605825 abstract "This chapter provides an understanding of how some keys and values can be used, not only by an intruder or Malware author but also by a forensic analyst to paint a more complete picture of an examination. Understanding how the user hives can be used is far more important than maintaining a long list of keys and values that do not have any context or anything to indicate how they are important. The most important aspect of Registry analysis is to first understand the goals and what one is trying to demonstrate or prove. The traditional approach to computer forensic analysis has relied heavily on file system time stamps and a few other artifacts (file contents) found on the system. Time stamps can be fairly important and revealing during analysis, particularly when the analyst creates a time line of activity from various data sources. Microsoft Windows does a very good job of tracking what documents a user has accessed, making them available in the Recent Documents menu. This list of documents can be very revealing about a user's activities. An analyst can use all of the information to develop an understanding of and add context to other activity found on the system." @default.
- W9605825 created "2016-06-24" @default.
- W9605825 creator A5039025656 @default.
- W9605825 date "2011-01-01" @default.
- W9605825 modified "2023-09-25" @default.
- W9605825 title "Case Studies" @default.
- W9605825 cites W2912060910 @default.
- W9605825 doi "https://doi.org/10.1016/b978-1-59749-580-6.00004-8" @default.
- W9605825 hasPublicationYear "2011" @default.
- W9605825 type Work @default.
- W9605825 sameAs 9605825 @default.
- W9605825 citedByCount "0" @default.
- W9605825 crossrefType "book-chapter" @default.
- W9605825 hasAuthorship W9605825A5039025656 @default.
- W9605825 hasConcept C10138342 @default.
- W9605825 hasConcept C124101348 @default.
- W9605825 hasConcept C144133560 @default.
- W9605825 hasConcept C15744967 @default.
- W9605825 hasConcept C182306322 @default.
- W9605825 hasConcept C19417346 @default.
- W9605825 hasConcept C2775936607 @default.
- W9605825 hasConcept C38652104 @default.
- W9605825 hasConcept C41008148 @default.
- W9605825 hasConcept C541664917 @default.
- W9605825 hasConceptScore W9605825C10138342 @default.
- W9605825 hasConceptScore W9605825C124101348 @default.
- W9605825 hasConceptScore W9605825C144133560 @default.
- W9605825 hasConceptScore W9605825C15744967 @default.
- W9605825 hasConceptScore W9605825C182306322 @default.
- W9605825 hasConceptScore W9605825C19417346 @default.
- W9605825 hasConceptScore W9605825C2775936607 @default.
- W9605825 hasConceptScore W9605825C38652104 @default.
- W9605825 hasConceptScore W9605825C41008148 @default.
- W9605825 hasConceptScore W9605825C541664917 @default.
- W9605825 hasLocation W96058251 @default.
- W9605825 hasOpenAccess W9605825 @default.
- W9605825 hasPrimaryLocation W96058251 @default.
- W9605825 hasRelatedWork W102374757 @default.
- W9605825 hasRelatedWork W112837408 @default.
- W9605825 hasRelatedWork W1177028454 @default.
- W9605825 hasRelatedWork W1516470032 @default.
- W9605825 hasRelatedWork W155917439 @default.
- W9605825 hasRelatedWork W163188581 @default.
- W9605825 hasRelatedWork W2043440373 @default.
- W9605825 hasRelatedWork W2048316565 @default.
- W9605825 hasRelatedWork W2117710905 @default.
- W9605825 hasRelatedWork W2163676885 @default.
- W9605825 hasRelatedWork W2326089995 @default.
- W9605825 hasRelatedWork W2407611659 @default.
- W9605825 hasRelatedWork W2588167731 @default.
- W9605825 hasRelatedWork W2623768610 @default.
- W9605825 hasRelatedWork W2745121086 @default.
- W9605825 hasRelatedWork W2809835565 @default.
- W9605825 hasRelatedWork W2912352363 @default.
- W9605825 hasRelatedWork W3013639651 @default.
- W9605825 hasRelatedWork W57290220 @default.
- W9605825 hasRelatedWork W2476866432 @default.
- W9605825 isParatext "false" @default.
- W9605825 isRetracted "false" @default.
- W9605825 magId "9605825" @default.
- W9605825 workType "book-chapter" @default.