Tuesday, March 26, 2019

Daily Blog #653: Forensic Lunch Test Kitchen 3/26/19

Hello Reader,
        Tonight I tried to do a live stream from my hotel in  Jeddah, KSA. Looking back at the recording I'm not sure how well it did but I was able to get some base testing done for a better test of some SRUM recording features tomorrow night UTC +3. In short I did the following to see how SRUM would record it:

  • The livestream to youtube via Xsplit
  • The youtube access via chrome
  • A chrome incognito window to see if it gets tracked seperately
  • Copied data to an external drive with windows explorer
  • Copied data to an internal drive with copy.exe from the command line
  • Deleted files within file explorer
  • Deleted files in the GUI
I'll let this computer run overnight and use the wired internet I have in the classroom to stream tomorrow.

You can watch the video here: https://youtu.be/0I1xgA3DhYo

Monday, March 25, 2019

Daily Blog #652: Seeking Sponsor for the Unofficial Defcon DFIR CTF 2019

Hello Reader,
        Do you or your company want to provide a prize for the Unofficial Defcon DFIR CTF now in its third year? If so email me at dcowen@g-cpartners.com so we can talk. In the past SANS, Magnet Forensics, Blackbag and Metaspike have all graciously provided prizes for our worthy contenders and we'd like to open this up to all of you.

The Defcon DFIR CTF usually gets 100+ players during the events and 100s more once the CTF is opened to the public. I'd like to expand the prize pool so we can award more cool things to more people in three groups.


  1. Top finishers at Defcon
  2. Top finishers online
  3. Noteworthy achievements (Like first perfect score)
So reach out if you are interested and I hope to hear from you soon.

Sunday, March 24, 2019

Daily Blog #651: Sunday Funday 3/24/19

Hello Reader,
   Let's finish this trifecta of the major three cloud compute vendors. I think that getting more of this knowledge out there will many random internet searches just trying to understand whats possible, when someone else made a decision to move their assets to the cloud. We have a streak of new winners and you, yes you, reading this now. I want you to be my next winner so take the time to do some research and I look forward to hearing from you!



The Prize:
$100 Amazon Giftcard

The Rules:

  1. You must post your answer before Friday 3/29/19 7PM CST (GMT -5)
  2. The most complete answer wins
  3. You are allowed to edit your answer after posting
  4. If two answers are too similar for one to win, the one with the earlier posting time wins
  5. Be specific and be thoughtful
  6. Anonymous entries are allowed, please email them to dcowen@g-cpartners.com. Please state in your email if you would like to be anonymous or not if you win.
  7. In order for an anonymous winner to receive a prize they must give their name to me, but i will not release it in a blog post


The Challenge:
Name and describe all of the available forensic data sources provided by Google Cloud Platform

Saturday, March 23, 2019

Daily Blog #650: Solution Saturday 3/23/19

Hello Reader,
         This week's challenge was met with many challenges but they were overcome by @darizotas aka Dario B. I think you'll see in his winning post that did a pretty thorough job documenting what existed with solid references for following up. I'm loving all of these new people in the community getting involved and showing what they have to contribute! So next week, let that be you!


The Challenge:
Name and describe all of the available forensic data sources provided by Azure Compute

The Winning Answer:
@darizotas 
https://darizotas.blogspot.com/2019/03/azure-and-office-365-logging.html

Thursday, March 21, 2019

Daily Blog #649: How to pick something to test

Hello Reader,
         One of the questions I get asked on a semi regular basis is, how do I pick what to test/research? The answer is more simple than you would expect:

Selection pool:

  •  I look at an interaction I just experienced while using the operating system
  • I think about an artifact I don't feel I full understand
  • I am working on a case and have to find a way to recreate a behavior I found

After that, as you can see the in test kitchen videos, I spend hours testing/recreating/examining/understanding the behavior that I'm seeing. While it is possible that two different actions can result in the same behavior, typically those different actions create their own marks on the system allowing you determine which route the user went through.

I have my travel streaming system with me now and I'm currently in an airport in Dubai awaiting my flight to Jeddah. My hope is that the hotel in Jeddah will have enough bandwidth to let me stream some testing this week, wish me luck!

Tuesday, March 19, 2019

Daily Blog #648: How to stream your own test kitchen

Hello Reader,
       As I prepare to get the test kitchen back in service I thought I'd share what I use for others who are looking to do the same. I got this idea after this tweet from Gerald Davis


So here is my setup:
Hardware: I have a Windows 10 desktop with a Nvidia GTX 980 an i7 processor and 32gb of RAM. It's nothing special and you don't need much in order to do this. The OS is running off of a SSD and the virtual machines are running off a 2TB 7200 RPM Western Digital.

Broadcasting software: I'm using XSplit broadcaster. You could use something else like OBS or Wireframe but XSplit when I was looking was the easiest to setup and use with all of its built in plugins and stream support.

Hypervisor: I'm using VMWare Workstation

Mic: I'm using a HyperX Cloud 2 headset, nothing special just a headset with a mic.

I have a 4K Samsung monitor so I have the VM running in the upper corner of the monitor and have drawn the broadcast window over it. This allows me to keep most of the screen off camera as it were so I can monitor the stream, check chat and google things while also making the streamed desktop be a readable size to the viewer.

I got the Windows OS ISO's from MSDN but you could also get eval images from Microsoft directly.

Have other questions? Let me know in the comments and I can explain more about what I do and how it works. 

Monday, March 18, 2019

Daily Blog #647: Windows Forensics in San Diego

Hello Reader,

               Looks like I'll be heading to sunny San Diego California to teach SANS FOR500: Windows Forensics this May 9 2019. The event is called Security West and its one of the bigger SANS events of the years. If you wanted to learn Windows Forensics, see San Diego and see some great bonus sessions for some amazing SANS instructors its a great event.

Want to learn more? Click below
https://www.sans.org/event/security-west-2019/course/windows-forensic-analysis