Checklist for a basic Forensics Assessment of a Windows System:
The System Date and Time:
Keeping track of the date and time are necessary in case the system's internal clock is off. This will help in keeping track and correlating data between multiple machines and data that happened prior to the data collection procedure.
The commands to use are date and time respectively.
Current Network Connections:
If malware on the machine is phoning home or communicating between other machines, knowing what all is talking to the box is necessary.
The command needed is netstat -an which will show all active TCP connections, and all ports being listened on.
Coordinating Ports with Executables:
A tool exists called FPort that will show which executable opens which ports. If there are traffic and connections that are unknown this tool will tell you which executable opened it.
Netbios Cache:
This tool shows connections between netbios names and ip addresses of machines that have connected to the victim computer.
The command to get this information is nbtstat -c
Current Logged on Users:
Microsoft tool PSLoggedOn displays list of users that are logged on the system, or remotely accessing shares on the box. This is helpful for when there are intruders on the box.
Internal Routing Table:
Using the Netstat command with the -rn flags will display the internal routing table.
Running Processes:
Microsoft tool pslist will dump all the processes running. If there are any foreign processes, they will show up here.
