IT Forensics – Windows

Forensic analysis of the Windows hosts file – Tracing manual name resolutions

The hosts file enables host names to be mapped to IP addresses locally and is consulted by Windows before a DNS query is made. Changes to this file may serve legitimate administrative purposes, but may also indicate tampering or the presence of malware.

Enquire without obligation

A professional analysis is never carried out in isolation. Only by correlating the findings with DNS artefacts, registry data, event logs, browser artefacts and other digital traces is it possible to arrive at a reliable technical assessment.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.

The examination is carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.

Our services

We analyse the contents, timestamps and any changes to the hosts file, and evaluate these alongside other Windows artefacts. All stages of the investigation are documented in a transparent manner.

Typical areas of application

•Incident Response
•Malware and phishing investigations
•Analysis of potential system tampering
•Reconstruction of network activity
•Expert reports for the courts
•Employment law proceedings

This is how the analysis works

Once a forensic image has been created, the hosts file is analysed alongside the associated system artefacts. This is followed by a comprehensive technical assessment.

Why is the hosts file important?

Alterations to the hosts file can affect name resolution. Whether a change is significant can only be determined by a comprehensive analysis of all available digital traces.

Frequently Asked Questions

What information does the hosts file contain?+
It contains local mappings between hostnames and IP addresses.
Are changes always suspicious?+
No. Changes can be both legitimate and technically conspicuous, and must be assessed within the overall context.
Is the original system being examined?+
No. Only a forensic copy or forensic image is analysed.
Is the hosts file alone sufficient for an expert opinion?+
No. It is always analysed alongside other Windows artefacts.

LanCologne – Windows Forensics in Cologne

Do you need a professional analysis of the Windows hosts file or other Windows artefacts? LanCologne can assist you with the forensically sound preservation of digital evidence and the objective analysis of complex Windows systems.

Get in touch now