數位鑑識-人為操作調查之檔案開啟紀錄(Jumplist)

<span style="-webkit-text-stroke-width:0px; background-color:rgb(255, 255, 255); color:rgb(68, 68, 68); display:inline !important; float:none; font-family:microsoft jhenghei,heiti tc; font-size:16px; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; letter-spacing:0.8px; orphans:2; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-decoration-thickness:initial; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px">在數位鑑識裡，有可能遇到公司想調查離職員工的使用電腦，或是檢警調查嫌犯電腦的操作紀錄等…，我們可以從 C:\Users\[使用者名稱]\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations 這個路徑下的檔案做解析，如下圖：

<span style="-webkit-text-stroke-width:0px; background-color:rgb(255, 255, 255); color:rgb(68, 68, 68); display:inline !important; float:none; font-family:microsoft jhenghei,heiti tc; font-size:16px; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; letter-spacing:0.8px; orphans:2; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-decoration-thickness:initial; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px">可以從這些檔案解析出該使用者開啟過什麼檔案，時間點是什麼時候，好推測此電腦人為操作的時間流程，而且還可以找到嫌犯可能的犯罪證據，畢竟他開啟過的檔案中，裡面或許有他的犯罪檔案內容，這都值得調查的，我們看看解析後的結果吧！

<span style="-webkit-text-stroke-width:0px; background-color:rgb(255, 255, 255); color:rgb(68, 68, 68); display:inline !important; float:none; font-family:microsoft jhenghei,heiti tc; font-size:16px; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; letter-spacing:0.8px; orphans:2; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-decoration-thickness:initial; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px">這是欄位名稱

<span style="-webkit-text-stroke-width:0px; background-color:rgb(255, 255, 255); color:rgb(68, 68, 68); display:inline !important; float:none; font-family:microsoft jhenghei,heiti tc; font-size:16px; font-style:normal; font-variant-caps:normal; font-variant-ligatures:normal; font-weight:400; letter-spacing:0.8px; orphans:2; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-decoration-thickness:initial; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px">紅框這一欄 record time 就是最主要的開啟時間資訊，其他時間只是該檔案的(.lnk)資訊內容也是可以做些參考，有興趣的朋友也能自己試看看，你開啟一個檔案後，找個解析 Jumplist 的工具，看看 record time 有沒有符合你剛剛開啟該檔案的時間。

<span style="-webkit-text-stroke-width:0px; background-color:rgb(255, 255, 255); border:0px; color:rgb(68, 68, 68); font-family:microsoft jhenghei,heiti tc; font-size:16px; font-stretch:inherit; font-style:normal; font-variant-caps:normal; font-variant-east-asian:inherit; font-variant-ligatures:normal; font-variant-numeric:inherit; font-weight:400; letter-spacing:0.8px; line-height:inherit; margin:0px; orphans:2; padding:0px; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-decoration-thickness:initial; text-indent:0px; text-transform:none; vertical-align:baseline; white-space:normal; widows:2; word-spacing:0px">要是對這些鑑識調查系統資訊模組或工具製作有興趣，可以到粉絲團 <a href="https://www.facebook.com/rexlintechnology" style="margin: 0px; padding: 0px; border: 0px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-numeric: inherit; font-variant-east-asian: inherit; font-weight: 400; font-stretch: inherit; font-size: 16px; line-height: inherit; font-family: "Microsoft JhengHei", "Heiti TC"; vertical-align: baseline; color: var(--primary-color); text-decoration: none; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); box-sizing: border-box; letter-spacing: 0.8px;" target="_blank">facebook.com/rexlintechnology <span style="-webkit-text-stroke-width:0px; background-color:rgb(255, 255, 255); border:0px; color:rgb(52, 52, 52); display:inline !important; float:none; font-family:noto sans tc,微軟正黑體,sans-serif; font-size:17.6px; font-stretch:inherit; font-style:normal; font-variant-caps:normal; font-variant-east-asian:inherit; font-variant-ligatures:normal; font-variant-numeric:inherit; font-weight:400; letter-spacing:1px; line-height:inherit; margin:0px; orphans:2; padding:0px; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-decoration-thickness:initial; text-indent:0px; text-transform:none; vertical-align:baseline; white-space:normal; widows:2; word-spacing:0px"> <font color="#444444" face="microsoft jhenghei, heiti tc" style="font-size: 17.6px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: 1px; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; background-color: rgb(255, 255, 255);"> 跟我留言或聯絡， <span style="-webkit-text-stroke-width:0px; background-color:rgb(255, 255, 255); border:0px; color:rgb(68, 68, 68); font-family:microsoft jhenghei,heiti tc; font-size:16px; font-stretch:inherit; font-style:normal; font-variant-caps:normal; font-variant-east-asian:inherit; font-variant-ligatures:normal; font-variant-numeric:inherit; font-weight:400; letter-spacing:0.8px; line-height:inherit; margin:0px; orphans:2; padding:0px; text-align:start; text-decoration-color:initial; text-decoration-style:initial; text-decoration-thickness:initial; text-indent:0px; text-transform:none; vertical-align:baseline; white-space:normal; widows:2; word-spacing:0px">不吝嗇給個讚跟追蹤吧！

RexLin的部落格

歡迎光臨RexLin在痞客邦的小天地

數位鑑識-人為操作調查之檔案開啟紀錄(Jumplist)

個人資訊

熱門文章

文章分類

最新文章

動態訂閱

文章精選

文章搜尋

誰來我家

參觀人氣