8 bits

Explore copied eventlog with PowerShell

Unfortunately, when an Eventlog file from a Windows computersystem is copied for further investigation, it is often corrupted.

The Windows event log database contains a so called floating footer. It will be positioned at the offset where the next record will be written. This floating footer object contains metadata that is maintained in real time.  If the file was not properly closed, the fields of the floating footer will not have been synched and the file status byte will be odd. When you attempt to open such a file with any viewer reliant upon the event log API, it will be reported as corrupt. This frequently occurs in forensics when you pull the plug or do a live acquisition. In that case, you'll need to repair the eventlog. 

Live forensics: prefetch and powershell

Each time you turn on your computer, Windows keeps track of the way your computer starts and which programs you commonly open. Windows saves this information as a number of small files in the prefetch folder. The next time you turn on your computer, Windows refers to these files to help speed the start process. The prefetch folder is a subfolder of the Windows system folder.

In this example, I use PowerShell (with Administrator rights) to show the files in the Prefetch folder

----------
dir c:\windows\prefetch | sort name
----------

I can see that TrueCrypt has been used, which I find interesting:

I want to know if any files have been created with TrueCrypt. As you can see in the image above, I do have the date and time that TrueCrypt has been used (3-10-2012 09:27). I can use this information in my query:

----------
cd \
dir c: -recurse | select name,fullname,lastwritetime | where {$_.lastwritetime -gt "2012-10-03 09:27"} | out-gridview
----------

After a short while, I can see the file c:\temp\newcontainer has been created directly after TrueCrypt was started. Now I can investigate the newcontainer file. Cool, isn't it ?

PowerShell Hex viewer

After installing the free community extensions you can use PowerShell as a Hex viewer.

Simple forensics with PowerShell

After installing the Community Extensions, you can easily hash files (MD5) with PowerShell:

Get-Hash file.txt

You can use this for simple forensic purposes. For example, make a text file (aka 'hash database'), containing the hash values of all files in a specific folder:

Get-Hash c:\myfirstfolder\*.* | Format-Table -property hashstring > file1.txt

You can use this newly created hash database to find matches with files in a different folder (or on a different computer). Create a hash database of the files in the other folder:

Get-Hash c:\mysecondfolder\*.jpg | Format-Table -property hashstring > file2.txt

Now, you can use PowerShell to find the matches:

Compare-Object -referenceobject $(get-content c:\myfirstfolder\file1.txt) -differenceobject $(get-content c:\mysecondfolder\file2.txt) -includeequal | where-object {$_.SideIndicator -match "=="}

This is just a very simple example, but it works and it's nice to play with :-)

View the contents of a DD image while it's being made

I'm acquiring an old hard drive. The hard drive is not recognized in Windows. So, the only option for me is to make the image with Linux. At the moment I'm making a DD image, using this command:

dd if=/dev/sdc1 of=/home/my_name/my_dir/partition.image bs=4096 conv=notrunc,noerror

To my surprise, I can open and view the contents of the DD image with FTK Imager, while the DD image is being made and certainly not ready yet. No error warnings at all, in the background the DD process keeps goin' on and the image get's bigger and bigger.

I think this is quiet cool, maybe this trick can be usefull in very urgent cases, what do you think ?

Lab FTK Imager: file carving using the MFT

NTFS uses the MFT as a kind of database to keep track of files. We can use the MFT to find the location (cluster) of the file and we can carve the file in order to study it. Let's use FTK Imager to see how it works. 

Top 100 Computer Forensics Twitterers to Follow

I just found out I've been added to Forensic Focus' list of Twitterers. I'm honored with my top ranking :-)

 

Complete list: http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4185

Capture memory with FTK Imager v. 2.6.1

It's possible to capture the contents of RAM memory with FTK Imager v. 2.6.1 now. As you can see, a new button has appeared in the toolbar:

 

Download FTK Imager v. 2.6.1 at http://www.accessdata.com/downloads/current_releases/imager/imager-ftk_imager-2.6.1.exe

RipXP parses registry hives in Windows restore points

Harlan Carvey has managed to make a great new tool again: RipXP. RipXP is similar to rip.exe, in that it is a CLI tool and that it uses the same plugins as RegRipper and rip.exe. You give ripXP (as command line arguments) the hive file, the directory where the Restore Points reside, and a plugin to run. Once you have all this, ripXP will then:

- Access the hive file and guess what kind (SAM, System, NTUSER.DAT, Software, or Security) hive file it is (if it's an NTUSER.DAT file, it will attempt to retrieve the user's SID)

- Compare the type of hive file to the hive file that the plugin was written for; that is, if you pass it a System hive file, it won't let you run a plugin meant for an NTUSER.DAT file (just like rip.exe, ripXP includes the "-l" option so you can list all available plugins)

- Run the plugin against the hive file you selected

- Access the System Restore RP directories, and run the plugin against the appropriate hive

All this happens automatically, and the output goes to STDOUT, so all you have to do is redirect the output to a file.

Download RipXP at http://www.regripper.net/

Great process indicator for Encase

Anybody who's working with Encase knows it's process indicator isn't accurate. You never know how long a process (acquire, verify etc.) wil take. The free Process Monitor of systinternals.com solves this problem.

How does it work

Download the free tool, unzip it and store procmon.exe in the c:\Windows\sytem32 folder

Next time you start to work with Encase, open a dosbox and type "procmon.exe". Process Monitor will now start.

Now add the following details:

Process name is Encase.exe then Include

   

Click Add and OK

Now, you can exactly see the processes of Encase.