8 bits

Explore copied eventlog with PowerShell

Unfortunately, when an Eventlog file from a Windows computersystem is copied for further investigation, it is often corrupted.

The Windows event log database contains a so called floating footer. It will be positioned at the offset where the next record will be written. This floating footer object contains metadata that is maintained in real time.  If the file was not properly closed, the fields of the floating footer will not have been synched and the file status byte will be odd. When you attempt to open such a file with any viewer reliant upon the event log API, it will be reported as corrupt. This frequently occurs in forensics when you pull the plug or do a live acquisition. In that case, you'll need to repair the eventlog. 

Live forensics: prefetch and powershell

Each time you turn on your computer, Windows keeps track of the way your computer starts and which programs you commonly open. Windows saves this information as a number of small files in the prefetch folder. The next time you turn on your computer, Windows refers to these files to help speed the start process. The prefetch folder is a subfolder of the Windows system folder.

In this example, I use PowerShell (with Administrator rights) to show the files in the Prefetch folder

----------
dir c:\windows\prefetch | sort name
----------

I can see that TrueCrypt has been used, which I find interesting:

I want to know if any files have been created with TrueCrypt. As you can see in the image above, I do have the date and time that TrueCrypt has been used (3-10-2012 09:27). I can use this information in my query:

----------
cd \
dir c: -recurse | select name,fullname,lastwritetime | where {$_.lastwritetime -gt "2012-10-03 09:27"} | out-gridview
----------

After a short while, I can see the file c:\temp\newcontainer has been created directly after TrueCrypt was started. Now I can investigate the newcontainer file. Cool, isn't it ?

Powershell: TomTom XML omzetten naar Google Earth KML

Powershell script: TomTom XML omzetten naar Google Earth KML

2011 Scripting Games #PowerShell #2011SG

The 2011 Scripting Games (April 4 - 15 2011) are the premier learning event of the year for IT pros and others who want to master Windows PowerShell. For each of 10 events, the contestant has seven days to script a solution to a scenario-driven problem and post it to an MVP-maintained script repository. A panel of internationally recognized judges scores each submitted script.

You can find my 2011SG scripts, including their ratings, here:

http://2011sg.poshcode.org/Scripts/By/38

 

PowerShell Open Source for Linux, Mac and Win Mobile

Pash (PowerShell + Bash) is an open source reimplementation for "others" (Mac, Linux, Solaris, etc...) and Windows (including Windows Mobile and Windows CE).

The main goal is to provide a rich shell environment for other operating systems as well as to provide a hostable scripting engine for rich applications. The user experience should be seamless for people who are used to Windows version of PowerShell. The scripts, cmdlets and providers should runs AS-IS (if they are not using Windows-specific functionality). The rich applications that host PowerShell should run on any other operating system AS-IS. Secondary goal: the scripts should run across the machines and different OS's seamlesly (but following all the security guidelines).

The current implementation of Pash is written using pure .Net 2.0. It compiles on VS 2008 as well as on Mono. So all the developers can choose the environment that fits their needs and preferences. The produced assemblies can be executed "right out of the box" on Windows, Linux, Mac (or others) without any additional recompilation. Note: for Windows Mobile and Windows CE the produced code should be recompiled against the .NET Compact Framework.

More information: http://pash.sourceforge.net/

How to backup and share PowerShell code-signing certificate

Previously I wrote about the code-signing certificate in PowerShell. If you want to share your codes or if you want to backup your certificate, you can take next steps:

Code signing with PowerShell

How to generate and use a Code-Signing Certificate:

a) use the command Set-ExecutionPolicy AllSigned RemoteSigned in PowerShell
b) download and install Microsoft Windows SDK for .NET 3.5
c) use makecert.exe to create the certificate (it's in c:\Program Files\Microsoft SDK\Windows\v7.0\Bin)

.\makecert.exe -n "CN=MyLocalCertRoot" -a sha1 -eku 1.3.6.1.5.5.7.3.3 -r -sv root.pvk root.cer -ss root -sr LocalMachine

.\makecert.exe -pe -n "CN=PowerShell Cert" -ss My -a sha1 -eku 1.3.6.1.5.5.7.3.3 -iv root.pvk -ic root.cer

Check if the certificate has been created:

Get-ChildItem cert:\CurrentUser\My -codesigning

Now you can sign your newly created PowerShell scripts. Please don't use the PowerShell ISE program to create your tools because it's a cause of problems when you want to sign the scripts afterwards.

How to sign the code:

Set-AuthenticodeSignature c:\myscripts\newscript.ps1 (Get-ChildItem cert:\CurrentUser\My -codesigning | where {$_.Subject -match "PowerShell"})

It's maybe best to put the commands in a function, so you don't have to write the full code each time you want to sign a code:

Function signscripts([string] $script)
{
Set-AuthenticodeSignature $script (Get-ChildItem cert:\CurrentUser\My -codesigning | where {$_.Subject -match "PowerShell"})
}

command: signscript "c:\myscripts\newscript.ps1"

How to find WMI information with PowerShell

"Windows Management Instrumentation (WMI) is the primary management technology for Microsoft® Windows® operating systems. It enables consistent and uniform management, control, and monitoring of Windows computers. Based on industry standards, WMI allows us to query, change, and monitor configuration settings on desktop and server systems, applications, networks, and other components. We can write scripts that use the WMI Scripting Library to work with WMI and create a wide range of systems management and monitoring scripts."

Well, that's nice, but how to get around in this "WMI world" with PowerShell. It's not that hard at all.

How to create a self signed SSL certificate with Powershell

It's easy to create a self signed certificate for your (IIS) webserver with PowerShell. Self signed certificates are free (yeah!) and offer some basic encryption security. There are of course some disadvantages (the other end can't be sure about the publishing authority (ie. You)  and most web browsers will show warnings). But, for most small projects it's simply impossible to pay a big sum of money for a certificate of a major and trusted Certificate Authority. So, self signed certificates can be a very nice (maybe temporary) solution !

PowerShell console in Visual Studio 2010

I just read this great blogpost about integrating PowerShell and Visual Studio 2010.

More information about Visual Studio 2010
More information about PowerConsole