FE: Why is xyz not in the registry?!
CR: Well, did you check the restore points?
FE: *crickets* Um... one moment. *Furious mouse clicks* Uh... never mind.
The problem here, as many would point out, could be solved simply by following a list that includes a bullet-point along the lines of "Restore Point Analysis Performed." Check. There is a lot to be said for the checklist method of analysis. It can focus even the most hex-centric mind. Checklists save the day. And there is much rejoicing. So why is it that my own experience with checklists has been checkered with resentment that occasionally leads to drawing unflattering facial hair on its typeface?
Where comprehensive checklists go wrong is in being, well, comprehensive. With skyrocketing data storage and efforts to mitigate costs in litigation, it is very rare that I am asked to perform a complete examination of any media larger than a thumb drive. Usually, a DF investigation is performed with a specific question in mind that the analysis is supposed to answer. And the steps taken to answer one question, while perfectly valid in that instance, may be completely extraneous in the attempt to uncover answers to a different question.
While in Las Vegas at the ADUC, I attended a lecture by Jesse Kornblum with the intimidating title "Statistical Validation and Data Analytics in eDiscovery." It is a testament to his devotion to his work that a presentation with that title was one of the most fun and entertaining lectures of the conference. And to prove that I did indeed have some cognitive functions on my third day in Vegas, I have decided to create my very own decision tree for targeted checklists.
A flow chart, while pretty and impressive to upper management, is great but it still does not solve all investigative ills. Checklists are great tools - but like any other tool in DFIR, they are just a tool. Sticking rigidly to a list of procedures takes the investigator out of the investigation. While I wouldn't argue that analysts should dump the binary content of a drive out of the box and just pick up random bits without any sort of structure, neither would I recommend blinders. Follow the white rabbit! Just remember to take notes along the way.