An Ontology for Digital Forensics in IT Security Incidents - OPUS

4.3. FORENSIC TOOLS 27
psscan Use pool tag scanning to nd processes that are not necessarily
in the list of the operating system. Details to this technique can
be found in [Schuster, 2006] and [Van Baar et al., 2008].
psdispscan Similar to psscan but with dierent memory structure to
look for.
thrdscan Similar to psscan but searching for threads.
envars Lists the environment variables associated with a process.
getsids Lists security identiers associated with a process. Useful for
detecting privilege escalation.
handles Lists the handles associated with a process.
dlllist Lists the dynamic link libraries associated with a process.
• Networking
connections Lists the TCP connections that can be found in the
singly-linked list of the operating system.
connscan Scans for TCP connections or fragments of connection date
in the memory.
sockets Similar to connections but for all protocols.
sockscan Similar to connscan but for all protocols.
• Registry
hivelist Lists the available hives and their location in the memory
and on hard disk. An example output is shown in the appendix
in listing B.2.
hivedump Lists all subkeys in a specied hive.
printkey Prints the information stored at a specic key. If no hive is
provided and the key exists in more than one hive, the information
of all hives is printed.
hivedump2 Custom module that combines hivedump and printkey
functionality. Details are described in section 7.4.
The modules that contain scan in their name search the memory for data
patterns that indicate the relevant data structures. If there are multiple
modules that search for the same objects, for example pslist, psscan and
psdispscan, the dierences between the results can indicate that something
might have been manipulated, for example that malware tries to hide from
the operating systems process list.
As the output of the tools of the dierent categories looks similar only
one output is shown as example. A sample output of psscan from the processes
section is shown in listing 4.4. For the networking category the output