Please enable JavaScript.

Coggle requires JavaScript to display documents.

Week 6 Forensics (Analysis (Timeline analysis (Chronological, Timestamp…

- - - - Examples
        
        The Sleuth Kit & Autopsy
        
        X-Way Forensics
        
        FTK
        
        Encase
      - Try to be an all-in one solution
  - - - Submit keywords/expression
        
        Software will search top to bottom
      - Slow
      - Flexible
    - - Fast
      - Develop a table of keywords
        
        Create a mapping between locations and keywords
- - - - HKEY_LOCAL_MACHINE
      - HKEY_CLASSES_ROOT
      - HKEY_CURRENT_USER
      - HKEY_USERS
      - HARDWARE hive only accessible when system is running
    - - NTUSER.DAT
        
        Specific user info
        
        Settings
        
        Most recently used (MRU) keys.
        
        Start up scripts
        
        Files accessed
        
        URLs typed
        
        Commands entered
        
        Software installed
        
        File shares
        
        Location
        
        C:\Users\{name}\
        
        C:\Documents and Settings\{name}\
      - USERCLASS.DATA
        
        Added in Windows 7
        
        Location
        C:\Users\{name}\AppData\Local\Microsoft\Windows\
        
        Previously, this info was in NTUSER.DAT
        
        Eg. Shell-Bags
        
        Window size
        
        Folder sorting order
        
        Folder placement
      - Software
        
        Location
        C:\Windows\system32\config
        
        Info on installed software, including OS and MS apps
        
        Any app can store info in the software key under HKey\LocalMachine\Software\WOW6432Node
      - System
        
        Location
        C:\Windows\system32\config
        
        2 control sets
        
        Last known good
        
        Current control sets
        
        Should look at both when examining dead image
        
        Current control set was used last time the system was booted
      - SAM
        
        Location
        C:\Windows\system32\config
        
        Account info
        
        Local users
        
        User's encrypted password
        
        Location of user's registry hive
        
        Domain accounts may not be stored in SAM
        
        Logins & SIDs
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
    - - Can be unallocated (deleted) but recovered manually or with carving tools
  - - - Heavily protected
      - Attackers use this to get access to NTDS.dit
  - - - Distro version
      - Services
      - Runlevel
      - Timezone
      - passwd
      - shadow
    - - SSH and SU logon logs
    - - dmesg
      - syslog
    - - Process accounting
      - Plain-text logs
      - Grepped using aureport command
    - - .bash_history
      - .zsh_history
      - Contains timestamps
    - - Location
        Virtual dir /proc
      - Running processes
      - Passwords
      - Log events
      - strings
      - Tools
        
        LiME
        
        Retrieve memory
        
        Volatility
        
        Examine memory
- - - - File extension .PF
      - Name is the executable's name + Hash of original path
        
        E.g. a prefetch file for FTK imager could be named FTK IMAGER.EXE-1B23CEFA.pf.
    - - Contains paths to all DLLs, EXEs and other files loaded at boot
  - - - One entry called MRUList/MRUListEx
        
        Data contains names of other entries that form the MRU
      - Other entries described in chronological order
  - - - thumbcache_x.db
        Where x is the thumbcache for a certain folder
    - - Location
        ProgramData\Microsoft\Search\Application\Windows
      - Use Thumbcache Viewer to view this