Please enable JavaScript.

Coggle requires JavaScript to display documents.

NIST Data Leakage - Coggle Diagram

- - - - starting and end offsets
      - sectors
      - size
      - type
- - - - extract necessary files from mounted disk into your folder for ease
  - - - OS information
        
        rip.pl –r SOFTWARE –p winver
      - SYSTEM accounts
        
        rip.pl –r SOFTWARE –p profilelist
      - last user to logon
        
        rip.pl –r SOFTWARE –p lastlogon
      - to check app for email communication
        
        rip.pl -r SOFTWARE -p installer | grep -i outlook
      - To check software managed by installer
        
        rip.pl -r SOFTWARE -p installer | grep -Ei "eraser|cclearn" -A 1 -B 2
    - - Time zone setting
        
        rip.pl -r SYSTEM -p timezone
      - computer name
        
        rip.pl –r SYSTEM –P compname
      - last recorded shutdown
        
        rip.pl -r SYSTEM -P shutdown
      - network interface(s) with an IP
        
        rip.pl -r SYSTEM -P nic2
      - Exam prefetch setting from registry
        
        Rip.pl –r SYSTEM –p prefetch
      - Exam USBStor registry
        
        rip.pl -r SYSTEM -p usbstor
- - - - it will list the partition detail by using offset number
    - - fls -rdF -o 206848 cfreds_2015_data_leakage_pc.dd | grep .docx
        
        -r recursively display directories
        -d display deleted entries only
        -F Display file (all non-directory) entries only
  - - - UsnJrnl2Csv
        
        icat -i raw -o 206848 cfreds_2015_data_leakage_pc.dd 59016-128-3 > UsnJrnl2Csv/usnJrnl.bin
  - - - This will list all directories(Not files) that were traversed in ‘RM#2’.
    - - copy UsrClass.dat file from mounted image
        
        rip.pl -r UsrClass_informat.dat -p shellbags | grep E:
  - - - cd Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning\
    - - $MFT stores metadata of files and directories. but it is difficult to find copied files from CD because there may be no metadata in $MFT
  - - - Extract $LogFile
        
        icat -o 206848 cfreds_2015_data_leakage_pc. 2 > LogFileParser/logfile.bin
        
        Analyze extracted .csv
  - - - Extract the db
        
        icat -o 206848 cfreds_2015_data_leakage_pc.dd 490 > Windows.edb
      - Export the db to readable files
      - Exam each file
  - - - To check uninstall registry
        
        rip.pl -r SOFTWARE -p uninstall | grep 2015-03-25 -A 2 -B 2
    - - cat the following path
        
        cat /media/root/C8CA0C8DCA0C7A48/Users/informant/AppData/Local/Google/Drive/user_default/sync_log.log
        
        And then pipe the following command
        
        grep -i deleting
  - - - /media/kali/C8CA0C8DCA0C7A48/Windows/System32/config/SAM
    - - no (hash value)
    - - using rainbow attack