Investigating Windows Bitdefender Antivirus
27/01/2023 Friday
Bitdefender is a popular antivirus software that offers comprehensive protection against various forms of malware, such as viruses, spyware, and ransomware. It uses a blend of signature-based detection and behavioral analysis to identify and block threats. Additional features such as firewall, VPN, and anti-phishing protection are also included. Bitdefender is available for Windows, Mac, as well as mobile devices.
Digital Forensics Value of Bitdefender
Due to its high performance, Bitdefender antivirus has gained a large customer base which increases the likelihood of finding Bitdefender antivirus on a suspect's device during a forensic investigation. Bitdefender artifacts can provide valuable information about the course of events or threats detected on a system. It also records user’s browsing history which can make a big difference during a forensic investigation.
Location of Bitdefender Antivirus Artifacts
Bitdefender Antivirus artifacts are found in the following location:
%systempartititon%\ ProgramData\Bitdefender\Desktop\Quarantine
%systempartititon%\ Program Files\Bitdefender\Bitdefender Security
Analyzing Bitdefender Antivirus with ArtiFast
This section will discuss how to use ArtiFast to extract Bitdefender Antivirus from Windows and what kind of digital forensics insight we can gain from the artifacts.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Bitdefender Antivirus artifacts:
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Bitdefender Antivirus artifacts in ArtiFast.
Bitdefender Antivirus Detected Threats Artifact
- Date - The date and time when the threat was detected.
- Threat ID - The ID of the threat.
- Threat Type - indicates the type of the virus or threat.
- Path - The path of the infected file.
- userSID - Program user ID.
- Size - The size of the infected file.
Bitdefender Antivirus Browsing History Artifact
- URL - The visited website URL.
- Expire time - The time this record expires.
- Hash - The hash of the infected file.
For more information or suggestions please contact: amro.alshadfan@forensafe.com
