SACON - Windows Forensic (Dr. Phil Polstra)
3 likes3,763 views
The document provides an overview of digital forensics concepts and processes. It discusses different types of forensics including physical and digital. It outlines general principles like maintaining evidence integrity and documenting investigations. It describes phases of investigations like evidence preservation and event reconstruction. The document also covers topics like incident response procedures, acquiring volatile system data, creating disk images, and mounting disk images to analyze their contents.
SACON - Windows Forensic (Dr. Phil Polstra)
- 1. ©Dr. Phil Polstra Windows Forensics Dr. Phil Polstra @ppolstra PhD, CISSP, CEH http://philpolstra.com
- 2. ©Dr. Phil Polstra Forensic Basics: Background
- 3. ©Dr. Phil Polstra What is Forensics? ● Merriam-Webster: Forensic (n) belonging to, used in, or suitable to courts of judicature or to public discussion and debate ● Forensic science or forensics is the scientific collection of evidence of sufficient quality that it is suitable for use in court
- 4. ©Dr. Phil Polstra Kinds of Forensics ● Physical – Transfer – Fingerprints – DNA ● Digital – Network – Data storage – Small devices – Computers
- 5. ©Dr. Phil Polstra General Principles ● Maintain integrity of evidence ● Maintain chain of custody ● Document everything – Handwritten is better – Work with a partner if possible ● Follow standard practices
- 6. ©Dr. Phil Polstra Phases of Investigation ● Evidence preservation – First do no harm ● Evidence searching – More complicated as storage has increased ● Event reconstruction
- 7. ©Dr. Phil Polstra Incident Response ● First validate that there was an incident ● Then proceed with preservation, searching, and event reconstruction ● Might need to do some preliminary investigation to determine if there was an incident ● Not done till reports are complete
- 8. ©Dr. Phil Polstra High Level Process Call Placed Incident? Lessons Learned No Live AnalysisYes Dead Analysis? Acquire Images Yes Dead Analysis Write Reports No
- 9. ©Dr. Phil Polstra Forensic Basics: First Steps
- 10. ©Dr. Phil Polstra Be Prepared ● Have a response kit with a complete set of forensics tools – Both 32-bit and 64-bit versions – Ideally CDROM and USB – We will build this set of tools throughout this course ● Hardware – Write blockers – Media – Forensic laptop ● Notebook, etc. for documentation
- 11. ©Dr. Phil Polstra Your Forensics Workstation ● At least 8GB of RAM is recommended ● Ideally with USB 3.0 port(s) ● Wired networking available ● Linux distro (64-bit) – Specialized distros such as SIFT or – Ubuntu or – Your favorite distro
- 12. ©Dr. Phil Polstra Installing SIFT (or at least tools) ● To install all of it on top of Ubuntu 14.04: wget --quiet -O - https://raw.github.com/sans- dfir/sift-bootstrap/master/bootstrap.sh | sudo bash -s -- -i -s -y ● To install just the tools on top of Ubuntu 14.04: wget --quiet -O - https://raw.github.com/sans- dfir/sift-bootstrap/master/bootstrap.sh | sudo bash -s -- -i
- 13. ©Dr. Phil Polstra Installing Tools ● If you are running a Debian/Ubuntu distro run the install-dfir.sh script provided ● Alternatively, the virtual machine image can be used
- 14. ©Dr. Phil Polstra Starting an Investigation
- 15. ©Dr. Phil Polstra High Level Process Call Placed Incident? Lessons Learned No Live AnalysisYes Dead Analysis? Acquire Images Yes Dead Analysis Write Reports No
- 16. ©Dr. Phil Polstra Has there been an incident? ● Open a case file ● Talk to the users – Why did they call you? – Why do they think there is a problem? – What is known about the potential victim system: ● Normal use ● Origins ● Recent repairs?
- 17. ©Dr. Phil Polstra Documentation ● Write notes in your notebook – What users said – What you know about the subject system ● Consider taking photos of system and screen if appropriate ● You are now ready to consider actually touching the system
- 18. ©Dr. Phil Polstra Mount the known good binaries ● More complicated than Linux equivalent ● Check path to point to your programs first ● Cannot completely replace Windows binaries ● Advanced malware can hide its presence ● USB 3.0 Flash drive recommended – For practice you might want USB 2.0 for use in VirtualBox
- 19. ©Dr. Phil Polstra Minimize disturbance to system ● Don't install anything on subject system ● Don't create new files on the system ● Minimize memory footprint ● Possible solutions – Netcat (best) – Store to USB drive
- 20. ©Dr. Phil Polstra Using Netcat to Transport Data ● Listeners are created on forensic workstation – Command output – Receive suspicious files ● Standard commands are ran on subject and results sent to workstation ● Suspicious files are also sent ● Automated with shell/batch scripts
- 21. ©Dr. Phil Polstra Collecting Volatile Data
- 22. ©Dr. Phil Polstra Data to Collect ● Date and Time – Clock may be skewed – Might be in different timezone ● Network interfaces – Funny networks – Promiscuous mode? ● Network connections
- 23. ©Dr. Phil Polstra Data to Collect (cont.) ● Open ports ● Programs associated with ports ● Currently logged on users ● Running processes ● Running services ● Open files ● Routing tables ● Mounted filesystems ● Scheduled jobs ● Process memory dumps ● Clipboard contents ● Driver information ● Shares ● Command history
- 24. ©Dr. Phil Polstra Collecting Data ● Run initial scan on Win7 subject ● Examine log on workstation ● What do you see?
- 25. ©Dr. Phil Polstra Final Steps Before Shutdown ● Get file metadata ● Import to spreadsheet or database ● Check file hashes of suspicious files ● Dump RAM – FTK Imager is easiest way
- 26. ©Dr. Phil Polstra Making Filesystem Images
- 27. ©Dr. Phil Polstra Image File Formats ● Raw ● Proprietary with embedded metadata ● Proprietary with metadata in separate file ● Raw with hashes stored in a separate file
- 28. ©Dr. Phil Polstra Creating an Image ● Raw: dd if=<subject device> of=<image file> bs=512 ● Raw with hashes along the way: dcfldd if=<subject device> of=<image file> bs=512 hash=<algorithm> hash window=<chunk size> hashlog=<hash file> ● Dcfldd will create image from running systems!
- 29. ©Dr. Phil Polstra Write Blocking ● Hardware write blockers – Commercial blockers for SATA only $350+ – USB write blocker described in USB class ● Cheap at about $25 ● Slow due to limits of microcontroller that is full-speed (12 Mbps) only ● Software write blocking – Use udev rules as described in USB forensics course – Boot live forensics Linux on subject computer – Boot live forensics Linux on forensics workstation
- 30. ©Dr. Phil Polstra Making the Image ● This takes too long to do in this class ● Several images are provided for this class and general study
- 31. ©Dr. Phil Polstra Mounting Images: MBR Basics
- 32. ©Dr. Phil Polstra High Level Process Call Placed Incident? Lessons Learned No Live AnalysisYes Dead Analysis? Acquire Images Yes Dead Analysis Write Reports No
- 33. ©Dr. Phil Polstra Master Boot Record ● Ancient standard (from the 80s) ● Allows up to four partition ● At most one partition can be active (bootable) ● Some partitions may be extended partitions – Can contain multiple partitions inside them – Partitions are stored in a linked list ● Being replaced with GUID partition tables
- 34. ©Dr. Phil Polstra Master Boot Record Format Offset Length Item 0 (0x00) 446 (0x1BE) Boot code 446 (0x1BE) 16 (0x10) First partition 462 (0x1CE) 16 (0x10) Second partition 478 (0x1DE) 16 (0x10) Third partition 494 (0x1EE) 16 (0x10) Fourth partition 510 (0x1FE) 2 (0x2) Signature 0x55 0xAA
- 35. ©Dr. Phil Polstra Partition Record Format Offset Length Item 0 (0x00 1 (0x01) Active flag (0x80 = bootable) 1 (0x01) 1 (0x01) Start head 2 (0x02) 1 (0x01) Start sector (bits 0-5); upper bits of cylinder (6-7) 3 (0x03) 1 (0x01) Start cylinder lowest 8 bits 4 (0x04) 1 (0x01) Partition type code (0x83 = Linux) 5 (0x05) 1 (0x01) End head 6 (0x06) 1 (0x01) End sector (bits 0-5); upper bits of cylinder (6-7) 7 (0x07) 1 (0x01) End cylinder lowest 8 bits 8 (0x08) 4 (0x04) Sectors preceding partition (little endian) 12 (0x0C) 4 (0x04) Sectors in partition
- 36. ©Dr. Phil Polstra Mounting an Image with a MBR ● Fdisk <image> to get start sector ● Mount with sudo mount -o ro,noatime,loop,offset=$(( sect * 512 )) <image> <mount point> ● Use Python script included in class materials
- 37. ©Dr. Phil Polstra Mounting Images: Extended Partitions
- 38. ©Dr. Phil Polstra Extended Partitions ● Used with MBR-based drives with more than 4 partitions ● A primary extended partition stores logical partitions inside of itself ● Each logical partition is proceeded by an “MBR sector” – Offsets are relative to extended partition – Interpreted as a linked list – Normally only first two entries are used
- 39. ©Dr. Phil Polstra Extended Partition MBR Format Offset Length Item 0 (0x00) 446 (0x1BE) Boot code (unused) 446 (0x1BE) 16 (0x10) First partition 462 (0x1CE) 16 (0x10) Second partition (if any) 478 (0x1DE) 16 (0x10) Third partition (unused) 494 (0x1EE) 16 (0x10) Fourth partition (unused) 510 (0x1FE) 2 (0x2) Signature 0x55 0xAA
- 40. ©Dr. Phil Polstra Partition Record Format Offset Length Item 0 (0x00 1 (0x01) Active flag (0x80 = bootable) 1 (0x01) 1 (0x01) Start head 2 (0x02) 1 (0x01) Start sector (bits 0-5); upper bits of cylinder (6-7) 3 (0x03) 1 (0x01) Start cylinder lowest 8 bits 4 (0x04) 1 (0x01) Partition type code (0x83 = Linux) 5 (0x05) 1 (0x01) End head 6 (0x06) 1 (0x01) End sector (bits 0-5); upper bits of cylinder (6-7) 7 (0x07) 1 (0x01) End cylinder lowest 8 bits 8 (0x08) 4 (0x04) Sectors preceding partition (little endian) 12 (0x0C) 4 (0x04) Sectors in partition
- 41. ©Dr. Phil Polstra Mounting Images: GUID Partitions
- 42. ©Dr. Phil Polstra High Level Process Call Placed Incident? Lessons Learned No Live AnalysisYes Dead Analysis? Acquire Images Yes Dead Analysis Write Reports No
- 43. ©Dr. Phil Polstra GUID Partitions ● Part of the UEFI system to replace BIOS boot ● Allows up to 128 partitions ● Simple ● The new standard ● All current 64-bit systems ship with this
- 44. ©Dr. Phil Polstra GUID Partition Tables
- 45. ©Dr. Phil Polstra Partition Record Format Offset Length Item 0 (0x00 16 (0x10) Partition type GUID 16 (0x10) 16 (0x10) Unique partition GUID 32 (0x20) 8 (0x08) First LBA 40 (0x28) 8 (0x08) Last LBA 48 (0x30) 8 (0x08) Attributes 56 (0x38) 72 (0x48) Partition name
- 46. ©Dr. Phil Polstra Partition Attributes Bit Content Description 0 System partition Must preserve partition as is 1 EFI Firmware Operating system should ignore this partition 2 Legacy BIOS boot Equivalent to 0x80 in MBR 3-47 Reserved Should be zeros 48-63 Type specific Varies by partition type (60=RO, 62=Hidden, 63=No automount for Windows)
- 47. ©Dr. Phil Polstra Mounting GUID partitions
- 48. ©Dr. Phil Polstra FAT Filesystem Basics
- 49. ©Dr. Phil Polstra FAT Filesystem ● Been around since DOS ● Three flavors: FAT12, FAT16, & FAT32 ● Contains File Allocation Tables ● De facto standard ● Modern versions of Windows won't install on it
- 50. ©Dr. Phil Polstra FAT Layout Volume Boot Record FAT 1 FAT 2 Root Directory (FAT12/16) Data Clusters 1 sector FAT12/16, 32 sectors (usually) FAT32 Primary & backup FAT. Size = (total clusters) /(FAT Entry size)/512 FAT32 moved this to data clusters (usually 2) Files and directories are stored here. Numbering starts at cluster 2.
- 51. ©Dr. Phil Polstra Volume Boot Record ● Allows filesystem to tell operating system about itself ● Contains needed and extended parts ● One sector for FAT12/16 ● Normally 32 sectors for FAT32
- 52. ©Dr. Phil Polstra File Allocation Table ● Gives status for each cluster – Available – Used and file continues to another cluster – Used and last cluster in a file ● First two entries are special ● Used to create a cluster chain ● Two FAT are normally updated together
- 53. ©Dr. Phil Polstra Directory Entries ● Contain metadata – MAC times – File size ● Contains the starting cluster for a file ● Relate file names to cluster chains
- 54. ©Dr. Phil Polstra Data Clusters ● Where all the files live ● All directories (with the possible exception of root directory) live here too ● The only part of the disk that isn't overhead ● Collection of sectors
- 55. ©Dr. Phil Polstra The Volume Boot Record
- 56. ©Dr. Phil Polstra Volume Boot Record ● Used to describe the filesystem ● First 28 bytes same for all versions of FAT ● One sector for FAT12/16 ● Multiple sectors (32?) for FAT32 – Backup boot sector – More boot code – Extra information
- 57. ©Dr. Phil Polstra FAT12/16/32 First Parts Offset Length Item 0 (0x00) 3 (0x3) Jump to bootstrap 3 (0x03) 8 (0x08) OEM name (who made this filesystem?) 11(0x0B) 2 (0x02) Bytes/sector (probably 512) 13 (0x0D) 1 (0x01) Sectors/cluster (usually power of 2) 14 (0x0E) 2 (0x02) Reserved sectors before filesystem (1 or 32) 16(0x10) 1 (0x01) Copies of FAT (probably 2)
- 58. ©Dr. Phil Polstra FAT12/16/32 Second Parts Offset Length Item 17 (0x11) 2 (0x2) Root directory entries (0 for FAT32) 19 (0x13) 2 (0x02) Filesystem sectors if under 32MB (64k sectors) 21(0x15) 1 (0x01) Media descriptor (F0=floppy, F8=everything else) 22 (0x16) 2 (0x02) Sectors/FAT (will show 0 for FAT32) 24 (0x18) 2 (0x02) Sectors/track 26 (0x1A) 2 (0x02) Number of heads
- 59. ©Dr. Phil Polstra FAT12/16 Third Parts Offset Length Item 28 (0x1C) 4 (0x4) Hidden sectors (preceding this partition) 32 (0x20) 4 (0x04) Filesystem sectors if over 32MB (64k sectors) 36 (0x24) 1 (0x01) Logical drive number (0x80, 0x81...) 38 (0x26) 24 (0x18) Extended boot signature if 1st byte 0x29 62 (0x48) 448 (0x1C0) Bootstrap code (16-bit assembly) 510 (0x1FE) 2 (0x02) Signature (0x55 0xAA)
- 60. ©Dr. Phil Polstra FAT12/16 Extended Signatures Offset Length Item 38 (0x26) 1 (0x1) 0x29 indicates an extended signature follows 39 (0x27) 4 (0x04) Partition serial number 43 (0x2B) 11 (0x0B) Volume label or “NO NAME” 54 (0x36) 8 (0x08) Human readable filesystem type
- 61. ©Dr. Phil Polstra FAT32 Third Parts Offset Length Item 28 (0x1C) 4 (0x4) Hidden sectors (preceding this partition) 32 (0x20) 4 (0x04) Filesystem sectors if over 32MB (64k sectors) 36 (0x24) 4 (0x04) Sectors/FAT 40 (0x28) 2 (0x02) Mirror Flag (b7=1 single FAT then b0-3 tell which) 42 (0x2A) 2 Filesystem version 44 (0x2C) 4 (0x04) First cluster of root directory (probably 2)
- 62. ©Dr. Phil Polstra FAT32 Fourth Parts Offset Length Item 48 (0x30) 2 (0x2) FSINFO sector # in reserved area (probably 1) 50 (0x32) 2 (0x02) Backup boot sector # in reserved are (usually 6) 64 (0x40) 1 (0x01) Logical Drive (0x80, 0x81...) 66 (0x42) 24 (0x18) Extended boot signature (same as FAT12/16) 90 (0x5A) 420 (0x1A4) Bootstrap code 510 (0x1FE) 2 (0x02) Signature (0x55 0xAA)
- 63. ©Dr. Phil Polstra FAT32 FSINFO Block Offset Length Item 0 (0x00) 4 (0x4) Signature RRaA 484 (0x1E4) 4 (0x04) Start marker rrAa 488 (0x1E8) 4 (0x04) Free clusters (0xFFFFFFFF = unknown) 492 (0x1EC) 4 (0x04) Last allocated cluster (0xFFFFFFFF = unknown) 508 (0x1FC) 4 (0x04) Signature (0x00 0x00 0x55 0xAA)
- 64. ©Dr. Phil Polstra FAT Directory Entries
- 65. ©Dr. Phil Polstra Directory Entries ● Contain – Filename (8.3) – MAC timestamps – File size – First cluster ● 32 bytes long ● First two entries for subdirectories: . & .. ● Kludge for long filename support
- 66. ©Dr. Phil Polstra Directory Entries Offset Length Item 0 (0x00) 11 (0x0B) File name 11 (0x0B) 1 (0x01) Attributes: B0-5: RO, hidden, system, volume label, subdirectory, archive B6-7: unused 14 (0x0E) 4 (0x04) Creation Time & Date 18 (0x12) 2 (0x02) Last Access Date (no time) 20 (0x14) 2 (0x02) Starting cluster high word (FAT32) 22 (0x16) 4 (0x04) Modified Time & Date 26 (0x1A) 2 (0x02) Starting cluster low word 28 (0x1C) 4 (0x04) File size in bytes (0 for directories)
- 67. ©Dr. Phil Polstra Directory Times and Dates Bits Length (bits) Item B11-B15 5 Hours B5-B10 6 Minutes B0-B4 5 Double seconds B9-B15 7 Years since 1980 B5-B8 4 Month B0-B4 5 Day TimeDate
- 68. ©Dr. Phil Polstra Long Filename Entries ● Added in Windows 95 ● Long entries also 32 bytes ● Long entries contain no metadata only name in Unicode ● Long filenames grow upward from single short entry
- 69. ©Dr. Phil Polstra Long Filename Entries Offset Length Item 0 (0x00) 1 (0x1) Sequence number B0-B4; B6(0x40)=final part 1 (0x01) 10 (0x0A) Part of filename in Unicode 11 (0x0B) 2 (0x02) Always 0x0F 0x00 13 (0x0D) 1 (0x01) Checksum for short filename 14 (0x0E) 12 (0x0C) Part of filename in Unicode 26 (0x1A) 2 (0x02) Always 0x00 0x00 28 (0x1C) 4 (0x04) Part of filename in Unicode
- 70. ©Dr. Phil Polstra Deleted Files ● First byte in directory entry/entries changed to 0xE5 ● File clusters marked as available in FAT ● In some versions of Windows FAT32 cluster high word zeroed
- 71. ©Dr. Phil Polstra Deleted Files
- 72. ©Dr. Phil Polstra What happens on deletion ● First byte in directory entry/entries changed to 0xE5 ● Clusters are marked available (zeros) in FATs ● For FAT32 high word of starting cluster may be zeroed
- 73. ©Dr. Phil Polstra The easy scenario ● File uses only one cluster ● Not FAT32 ● Guaranteed recovery if cluster is not reused ● Even if FAT32 might still be recoverable
- 74. ©Dr. Phil Polstra The medium difficulty scenario ● File is contiguous (not fragmented) ● Not FAT32 ● Recovery is likely if clusters have not been reused ● FAT32 recovery far from guaranteed
- 75. ©Dr. Phil Polstra The scenario you don't want ● File is fragmented ● If you are extra unlucky also FAT32 ● Must rely on best guess of cluster allocation ● If it is even possible, manual intervention may be required
- 76. ©Dr. Phil Polstra Technique ● If < 1 cluster – If not FAT32 check for cluster unallocated – If FAT32 scan through possible clusters looking for unallocated and data of appropriate size ● If > 1 cluster – If not FAT32 ● If block of clusters beginning at start cluster unallocated probably it – If FAT32 ● Attempt to find a block of clusters with the stated cluster low word – Check that data size matches last partial sector appropriately
- 77. ©Dr. Phil Polstra Technique (continued) ● If you have gotten this far chances of success are low ● If not FAT32 – Start from starting cluster and search forward for unallocated sectors – Unless the disk is very full if the file was recently deleted this is probably right ● If FAT32 – Look for possible solutions with largest contiguous set of unallocated clusters at beginning that are not empty
- 78. ©Dr. Phil Polstra The good news ● FAT filesystems are primarily used for removable media and not internal hard drives ● We will learn that NTFS undeletion is much simpler
- 79. ©Dr. Phil Polstra File Forensics
- 80. ©Dr. Phil Polstra File Forensics ● Examining individual files ● Can be used to find hidden info – Mismatched extensions – Slack space – Unallocated space – Page files
- 81. ©Dr. Phil Polstra File Signatures ● Many files have standard headers ● Some also have standard footers ● Helps – Identify mismatched extensions – Retrieve files from swap & memory – Verify undeleted files ● Comprehensive list http://www.garykessler.net/library/file_sigs.html
- 82. ©Dr. Phil Polstra Slack Space ● Leftover space in a cluster when file size not an exact multiple of cluster size ● RAM Slack – partial sector ● File Slack – whole sector ● Total Slack = (cluster size)- (file size)%(cluster size) File Data RAM Slack File Slack
- 83. ©Dr. Phil Polstra RAM Slack ● Long time ago what followed in RAM after data was written to disk ● Quickly figured out that this is bad security ● Today it should be all zeroes ● Used portion = filesize%512 ● Slack = 512-filesize%512
- 84. ©Dr. Phil Polstra File Slack ● Can contain fragments of old files ● Whole sectors of slack ● Slack = (total slack)//512 ● Slack = ((cluster size)-(file size)% (cluster size))//512
- 85. ©Dr. Phil Polstra File Carving ● Using file signatures to find files in – Swap space – Unallocated clusters – Unallocated disk space ● General carving tools – Foremost – Scalpel ● Specialized tools also exist
- 86. ©Dr. Phil Polstra File Lab ● Try some of the scripts – Extension-mismatch.sh – Find-files.py ● Use grep to locate files with important info ● Use scalpel to extract files
- 87. ©Dr. Phil Polstra NTFS Filesystem Basics
- 88. ©Dr. Phil Polstra NTFS Filesystem ● Introduced with Windows NT ● Based on HPFS from OS/2 ● Required to install modern versions of Windows ● Files are collections of attributes ● Most items in Master File Table (MFT)
- 89. ©Dr. Phil Polstra NTFS Layout Volume Boot Record Master File Table (MFT) Data Clusters Similar to FAT The central thing in NTFS Files and directories are stored here Backup Boot Record Data Clusters MFT Mirror First 4 MFT Entries
- 90. ©Dr. Phil Polstra Volume Boot Record ● Allows filesystem to tell operating system about itself ● Contains needed and extended parts ● Similar to FAT VBR ● Backup in last sector of disk
- 91. ©Dr. Phil Polstra Master File Table ● Every file and directory has an MFT entry ● MFT entries store a collection of attributes ● Like inode in Linux, but also includes filename
- 92. ©Dr. Phil Polstra MFT Metadata Entries Entry Filename Description 0 $MFT Self-reference for MFT 1 $MFTMirr Backup of first 4 MFT entries 2 $LogFile Journal records 3 $Volume Volume info-label, identifier, version 4 $AttrDef Attribute definitions 5 . Root directory 6 $Bitmap Allocation status of clusters 7 $Boot Boot sector and boot code 8 $BadClus Bad clusters in alternate data stream 9 $Secure Security info and ACLs 10 $Upcase Uppercase conversion table 11 $Extend Optional extensions 16-23 Used if MFT is highly fragmented
- 93. ©Dr. Phil Polstra NTFS Directories
- 94. ©Dr. Phil Polstra NTFS Directories ● Directories are stored as an index of filenames ($30) ● The index is a tree with a root stored in attribute $90 ● Attribute $90 can also store index entries ● As directory grows index is stored in clusters
- 95. ©Dr. Phil Polstra $90 Layout $Index_Root ($90) Attribute Attribute header (standard) Index root entry (what is being indexed, size of index buffers, etc.) Index header entry (logical/physical size of entries, resident or non-resident) Index entry Index entry
- 96. ©Dr. Phil Polstra Index Root Entry Index Root Entry Offset Size Description -- -- Attribute Header 0 4 Attribute Type 4 4 Collation Rule 8 4 Buffer Size (0x 00 10 00 00 = 4096 bytes) 12 4 Clusters per Buffer (0x 01 00 00 00 = 1 cluster)
- 97. ©Dr. Phil Polstra Index Header Entry Index Header Entry Offset Size Description 0 4 Offset to First Index Entry 4 4 Logical Size of Index Entries (total – from start of Index Header Entry) 8 4 Physical Size of Index Entries 12 4 Non-resident Index Flag (Buffer Flag) (01-Uses Index Buffers, 00- Resident) 16 -- Index Entry Start
- 98. ©Dr. Phil Polstra Index Entry Index Entry Offset Size Description 0 8 $MFT Record Number 8 2 Total Length of Index Entry Field (current field) 10 2 Length of Index Entry Data stream 12 1 Index Flag (00 – “resident”, 01 – “nonresident” - Index points to buffer, 02 – Last Index Entry 16 -- Index entry data stream ($30 attribute) * 8 Buffer VCN (non-resident only last 8 bytes)
- 99. ©Dr. Phil Polstra Filename ($30) Entry Offset Size Description 0 6 MFT record ID of the containing directory 6 2 Sequence number (reuse count) of that directory 8 8 Date and time of file creation 16 (0x10) 8 Date and time of the last file modification 24 (0x18) 8 Date and time of the last MFT record change 32 (0x20) 8 Date and time of the last read access to the file 40 (0x28) 8 Physical (Allocated) file size 48 (0x30) 8 Logical (Actual) file size 56 (0x38) 4 Flags – DOS File Attributes 60 (0x3C) 4 Used by extended attributes and “reparse” 64 (0x40) 1 Length of the filename in Unicode characters 65 (0x41) 1 Namespace of the filename 66 (0x42) 2 x length Filename in Unicode
- 100. ©Dr. Phil Polstra NTFS Index Buffers
- 101. ©Dr. Phil Polstra NTFS Index Buffers ● Once the directory grows beyond 2- 4 entries $90 can no longer hold info ● Index buffer $A0 added to store entries in data clusters ● Attribute $B0 added to keep track of index buffer usage
- 102. ©Dr. Phil Polstra Index Allocation ($A0) Header Offset Size Description 0 4 INDX identifier 4 2 Offset to Update Sequence (Fix up code) 6 2 Size of Update Sequence and Array (in words) 8 8 Log File Sequence Number 16 8 VCN of Current INDX Buffer 24 4 Offset to start of Index Entries 28 4 Logical Size of Index Entries 32 4 Physical Size of Index Entries 36 4 Flags (0x 00 00 00 00 – Leaf Buffer, 0x 01 00 00 00 – Normal Buffer (has children) 40 2 Update Sequence Number 42 2 x seq len Update Sequence Array – size depends on value in offsets 6-7
- 103. ©Dr. Phil Polstra NTFS Timestamps
- 104. ©Dr. Phil Polstra Important Disclaimer ● Microsoft can't seem to decide how these timestamps work and the rules have changed with each version of Windows and this will likely continue in the future!
- 105. ©Dr. Phil Polstra Copying a File $Standard_Info $Filename Modification No change Changed Access Changed Changed Creation Changed Changed Record Change Changed Changed
- 106. ©Dr. Phil Polstra Access a File $Standard_Info $Filename Modification No change No change Access Changed (< Vista) No change Creation No change No change Record Change No change No change
- 107. ©Dr. Phil Polstra Modify a File (contents saved) $Standard_Info $Filename Modification Changed No change Access No change No change Creation No change No change Record Change No change No change
- 108. ©Dr. Phil Polstra Delete a File $Standard_Info $Filename Modification No change No change Access No change No change Creation No change No change Record Change No change No change
- 109. ©Dr. Phil Polstra Rename a File $Standard_Info $Filename Modification No change No change Access No change No change Creation No change No change Record Change Changed No change
- 110. ©Dr. Phil Polstra Move a File on Same Volume $Standard_Info $Filename Modification No change Changed ($SI time) Access No change No change Creation No change No change Record Change Changed Changed ($SI time)
- 111. ©Dr. Phil Polstra Move a File on New Volume $Standard_Info $Filename Modification No change Changed Access Changed Changed Creation No change Changed Record Change Changed Changed
- 112. ©Dr. Phil Polstra NTFS lab ● Extract files with extract.py ● Get timeline info with get-macs.py ● Import timeline info into spreadsheet and/or database ● Get a single file’s timeline using print-file-timeline.sh
- 113. ©Dr. Phil Polstra The Windows Registry
- 114. ©Dr. Phil Polstra What is it? ● Central place for storing most configuration information ● Introduced in Windows NT ● Replaces most (not all) .ini files ● A tree structure
- 115. ©Dr. Phil Polstra How is it stored? ● Stored in at least 5 hive files ● Most are in /Windows/System32/Config ● Each user has a hive in the user directory – /Documents and Settings/User or – /Users/User
- 116. ©Dr. Phil Polstra How is it organized? ● Branches – HKEY_CLASSES_ROOT – HKEY_CURRENT_USER – HKEY_LOCAL_MACHINE – HKEY_USERS – HKEY_CURRENT_CONFIG
- 117. ©Dr. Phil Polstra HKEY_LOCAL_MACHINE ● Branches – HARDWARE – SAM – SECURITY – SOFTWARE – SYSTEM
- 118. ©Dr. Phil Polstra Data Types Constant Description REG_BINARY Binary data in any form. REG_SZ Null-terminated string. REG_EXPAND_SZ Null-terminated string w/ references to env variables REG_DWORD 32-bit number. REG_LINK Unicode symbolic link. REG_QWORD 64-bit number. REG_MULTI_SZ Array of null-terminated strings REG_DWORD_LITTLE_ENDIAN 32-bit number in little-endian format. REG_NONE No defined value type. REG_RESOURCE_LIST Device-driver resource list. REG_QWORD_LITTLE_ENDIAN A 64-bit number in little-endian format. REG_DWORD_BIG_ENDIAN 32-bit number in big-endian format.
- 119. ©Dr. Phil Polstra Viewing the Registry ● Extract hive files – FTK Imager – Scripts described earlier ● Use an editor – FREd – Access Data Registry Viewer ● Scripts and tools for common things – RegRipper – Python modules
- 120. ©Dr. Phil Polstra Lab:Viewing the Registry ● Extract hive files from win7 image ● Examine with FrED ● Run RegRipper on hives
- 121. ©Dr. Phil Polstra Lab:Windows Artifacts ● Recycle bin ● Event logs ● Prefetch files ● User directories ● Browser histories ● Print spools
- 122. ©Dr. Phil Polstra Lab:Volatility ● Use various volatility commands against provided memory image
- 123. ©Dr. Phil Polstra Lab:Malware ● Checking databases ● File command ● Strings ● PEBrowse ● Sandboxes
- 124. ©Dr. Phil Polstra Finishing the Job
- 125. ©Dr. Phil Polstra Reporting ● Not done till reports are written ● Report should have – Executive summary – Main body – Appendices
- 126. ©Dr. Phil Polstra Executive Summary ● Less than a page ● High-level description of what happened ● Major findings ● Might use to create a presentation
- 127. ©Dr. Phil Polstra Body of report ● Systematic ● Includes all findings ● Is free of technical jargon ● If jargon is required all terms are defined (possibly in glossary)
- 128. ©Dr. Phil Polstra Appendices ● All the gory details ● Can contain output from tools and scripts ● Can contain any custom scripts ● Describe any non-standard procedures
- 129. ©Dr. Phil Polstra Archiving the Case ● Might want to burn a CD with – Report – Any custom scripts – Digital copies of any notes – Anything else you feel might be relevant
- 130. ©Dr. Phil Polstra Archiving the Case (cont) ● All data should be packaged together – Backup drive with images – CD – Any hard copies ● Stored in a secure and climate controlled location