Live forensics: prefetch and powershell

Each time you turn on your computer, Windows keeps track of the way your computer starts and which programs you commonly open. Windows saves this information as a number of small files in the prefetch folder. The next time you turn on your computer, Windows refers to these files to help speed the start process. The prefetch folder is a subfolder of the Windows system folder.

In this example, I use PowerShell (with Administrator rights) to show the files in the Prefetch folder

----------
dir c:\windows\prefetch | sort name
----------

I can see that TrueCrypt has been used, which I find interesting:

I want to know if any files have been created with TrueCrypt. As you can see in the image above, I do have the date and time that TrueCrypt has been used (3-10-2012 09:27). I can use this information in my query:

----------
cd \
dir c: -recurse | select name,fullname,lastwritetime | where {$_.lastwritetime -gt "2012-10-03 09:27"} | out-gridview
----------

After a short while, I can see the file c:\temp\newcontainer has been created directly after TrueCrypt was started. Now I can investigate the newcontainer file. Cool, isn't it ?

Comments

[net performance]

In MainPage.xaml.cs add an ObservableCollection of customer object as Dependency property inorder to make sure that UI is updating while we assigning that customer list to another list or object.
http://www.dapfor.com/en/net-suite/net-grid/tutorial/data-grouping