Skip main navigation

Windows 10 Overview

Article detailing overview of area's of interest to a malware investigator.
© PA Knowledge Ltd | 7Safe Training

Windows 10 overview

Windows 10 was released by Microsoft mid 2015, and statistically holds slightly more than 50% of the worldwide desktop market as of June 2020, with the second most popular platform being Windows 7 with a little under 30% of the market share. Interestingly this is despite Microsoft ceasing support of Windows 7 in January 2020!

It is therefore important that a malware investigator has an understanding of how Windows operating systems generically function and what artefacts are created during normal activity, specifically Windows 10.

The basics are that when a computer is booted up, an operating system is loaded into memory for the purpose of processing. This processing enables the operating system to perform those computer functions.

There are therefore 2 areas of interest to the malware investigator on a powered up computer these being processes and related aretfacts residing in computer memory and aretfacts relating to process execution residing on the file system.

Remember a computer needs to be powered up to examine or extract data from the memory although it does not need to be powered up to examine or extract data from the file system.

Additional information…

Unless there is a specific live investigation requirement any examination of a malware infected computer should be conducted on a clone or with the use of virtualization technology.

That said if using virtualization technology, certain complex malware may be able to identify that it is running in a virtual machine due to hardware emulation. If this is the case the malware will likely not perform any nefarious activity!

© PA Knowledge Ltd | 7Safe Training
This article is from the free online

Introduction to Digital Forensics: Malware Analysis and Investigations

Created by
FutureLearn - Learning For Life

Our purpose is to transform access to education.

We offer a diverse selection of courses from leading universities and cultural institutions from around the world. These are delivered one step at a time, and are accessible on mobile, tablet and desktop, so you can fit learning around your life.

We believe learning should be an enjoyable, social experience, so our courses offer the opportunity to discuss what you’re learning with others as you go, helping you make fresh discoveries and form new ideas.
You can unlock new opportunities with unlimited access to hundreds of online short courses for a year by subscribing to our Unlimited package. Build your knowledge with top universities and organisations.

Learn more about how FutureLearn is transforming access to education