DFIR Review

Can You Track Processes Accessing the Camera and Microphone on Windows 10?

0
Updated

Research

White papers
  • Apple
  • DFIR Review
  • iOS
  • Registry
  • Windows
Tools
  • Metasploit
  • regedit.exe
  • Registry Explorer/RECmd

In certain investigations, it may arise that you need to find the following:

  • What process was using the camera or microphone?

  • When was the last session?

  • How long was that session?

Using the contents of the following reg keys, you can determine when and how long a process had access to privacy protected resources. These resources include the microphone, webcam, bluetooth, location, contacts and more. For this blog, I will focus on the microphone and webcam as an example.

Attachments

  • File Description
    File Size
    File Type
    Downloads
  • Can You Track Processes Accessing the Camera and Microphone on Windows 10
    408 KB
    2