Windows 10 Overview

Windows 10 was released by Microsoft mid 2015, and statistically holds slightly more than 50% of the worldwide desktop market as of June 2020, with the second most popular platform being Windows 7 with a little under 30% of the market share. Interestingly this is despite Microsoft ceasing support of Windows 7 in January 2020!

It is therefore important that a malware investigator has an understanding of how Windows operating systems generically function and what artefacts are created during normal activity, specifically Windows 10.

The basics are that when a computer is booted up, an operating system is loaded into memory for the purpose of processing. This processing enables the operating system to perform those computer functions.

There are therefore 2 areas of interest to the malware investigator on a powered up computer these being processes and related aretfacts residing in computer memory and aretfacts relating to process execution residing on the file system.

Remember a computer needs to be powered up to examine or extract data from the memory although it does not need to be powered up to examine or extract data from the file system.

Additional information…

Unless there is a specific live investigation requirement any examination of a malware infected computer should be conducted on a clone or with the use of virtualization technology.

That said if using virtualization technology, certain complex malware may be able to identify that it is running in a virtual machine due to hardware emulation. If this is the case the malware will likely not perform any nefarious activity!