Testing Environment & Setup

Testing Environment 
A test lab was configured for the purposes of this review, below are the specifications:

VMWare Virtual Machine (Workstation, 12)
Operating system: Windows 7 Professional
Memory: 2gb
Hard Drive: 50gb
Virtual Network adapter with host only and bridged networking.

This virtual machine is configured with hourly snapshot backups to ensure retention of the lab environment. This will also allow for a system rollback if required. See Figure 1.

Figure 1: Virtual Machine Settings

Additionally, snapshots before important changes will be made also.

Software:
None, vanilla install of Windows 7 Professional.

The following has been installed to meet the pre requisites of Dumpzilla:
Python 3.5.2 (64-Bit)
GnuWin32 File utility (Required by Magic Module)

Python Modules:
The following additional modules were required by Dumpzilla
Magic Module (https://github.com/ahupp/python-magic)

Additional Software & Configuration: 
Notepad++ - An extended text editor.
Environment Variable - PYTHONIOENCODING=UTF-8
This environment variable is suggested as directed by the Python 3.x Wiki (2012) to prevent unprintable characters flooding the output of the tool.


Software Installation Timeline:
This forensics tool does not install, instead it is utilized by using the python 3.x binary. As such, there isn't much of a timeline that can be shown here, nor the system changes that have occurred.
Various DLL files that required for the Magic Module and GnuWin32 File Utility were installed into the system32 folder of windows so that they can be accessed later via the default path environment.

Some screenshots were taken to visualize the installation process of these pre-requisites.

Figure 2: The Python installation folder was added to the windows PATH environment variable so that it can be accessed from the command prompt.,

Figure 3: Magic Module being installed (python setup.py install)

Figure 4: A screenshot showing the Dumpzilla script being ran for the first time, and outputting the syntax / help menu.

Once these had been installed, the latest version of the Firefox web browser was installed and several searches were performed along with the installation of two addons. The Procmon tool by Microsoft (Russinovich, 2016) was used to capture all system events during the processing of the Firefox profile with Dumpzilla. This garnered a large amount of results and thus has been compiled into parsable XML output and is available for download and viewing here! (Easton, 2016)

The summary of events from Procmon for the python process is shown below in Figure 5.

Figure 5: Summary of events from the Python process whilst running Dumpazilla

Bibliography
Busindre. (2013) Dumpzilla Manual [Online]. Available from: <http://www.dumpzilla.org/Manual_dumpzilla_en.txt>[Accessed 31/10/2016]

Python Wiki (2012) PrintFails, 2012-11-25 11:32:18 [Online]. Available from: <https://wiki.python.org/moin/PrintFails>[Accessed 31/10/2016]

Russinovich, M. (2016) Process Monitor [Online]. Available from: <https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx>[Accessed 2/11/2016]

Easton, C (2016) Procmon_Dumpzilla.txt [Online]. Available from: <https://www.dropbox.com/s/fo23x5zces3zpz2/Procmon_Dumpzilla.txt?dl=0>[Accessed 2/11/2016]