ISLOnline

ISL Online is a remote access tool with several methods of connecting to clients. ISL Light allows for installed or run once clients.

ISL AlwaysOn allows for unattended access to clients and requires elevated privileges to install the ISL Online client.

Forensic artifacts vary based on method of use.

One of the most common methods of connecting to a client is to ask them to navigate to islonline.net and enter a connection code which will then download a single use ISL client.

The most useful artifacts are ISLClient.out, trace.out, and session.xml. With these files you can identify how many sessions occured, when they occurred, as well as what took place (ie. file transfers in or out)