Why bother with collecting system information, anyway? Not all investigations revolve around the user and what actions they took on the system, but, rather, what the system is like and how it is behaving. For example, in the previous section, we discussed how running processes and created services can be informative based on indicators of compromise for a given scenario. However, as DFIR professionals well know, sources for system information can also provide insight into user activity, such as what disks are currently attached to the machine or querying the event log for user logins.
In the first edition of this book, this chapter originally showcased a keylogger script that we developed, whose purpose was mainly to illustrate how to use operating system APIs. For the second edition, we elected to keep that focus intact, but apply...
