Information Technology Reference
In-Depth Information
Almost.every.action.you.take.on.your.computer.will.result.
in.iles.being.created..Sometimes.it.is.log.iles.that.an.appli-
cation. keeps. in. the. background. for. the. purpose. of. trouble-
shooting,.or.simply.as.a.means.of.evolving.and.making.your.
experience.more.eficient.
As.we.noted.before,.every.trip.you.take.on.the.Web.cre-
ates.literally.hundreds.of.new.iles.as.it.opens.up.the.various.
pictures,.text,.movies,.and.so.forth,.that.make.up.a.Web.site.
Every.one.of.those.ile.creations,.modiications,.last.access.
times,.deletions,.archiving,.or.anything.else.that.the.operat-
ing.system.needs.to.track.about.those.iles.is.recorded.in.the.
MFT..This.can.be.a.wealth.of.information.for.someone.who.
needs.to.know.what.happened.on.a.computer..In.fact,.it.can.
be.far.too.much.information.
As.a.computer.forensics.practitioner,.I.use.the.$MFT.ile.
on.a.regular.basis.to.try.to.understand.when.malware.infected.
a.computer.and.what.type.of.malware.it.is..Yet,.even.if.I.have.
a.pretty.good.idea.of.when.the.device.was.infected,.it.can.be.
like.searching.for.a.needle.in.a.haystack.to.look.through.the.
thousands.of.iles.created.every.day.on.a.computer.
One.more.type.of.hidden.ile.that.can.be.of.great.value.
in. understanding. the. actions. of. a. computer. user. is. called.
the. Restore. ile. in. some. Windows. operating. systems.. The.
Restore.ile.contains.records.that.the.Windows.operating.sys-
tem.keeps.of.the.state.of.your.computer.at.a.given.time.and.
date.. Every. time. you. add. a. new. application,. a. restore. ile.
is.created..Windows.also.creates.these.whenever.it.does.an.
update,.or.just.on.a.regular.schedule.
These.are.created.for.the.purpose.of.restoring.your.com-
puter. to. a. known. good. state. in. case. something. goes. bad..
Sometimes.a.new.application.will.cause.conlicts.with.exist-
ing.applications,.or.will.not.work.correctly.with.your.device.
for.some.reason;.perhaps.it.has.bad.hardware.drivers.or.some.
incompatibility.with.your.system.
If. that. happens. and. you. recognize. that. the. problems.
started.when.you.installed.that.software,.you.can.use.the.sys-
tem.restore.points.to.roll.back.your.computer.to.the.state.of.
