Daily Blog #197: Sunday Funday 1/5/14 Winner!

Device Trace Challenge by David Cowen - Hacking Exposed Computer Forensics Blog

Hello Reader:
   This week another challenge met! This weeks' winner did a very nice writeup on his testing. Combined with my series, Nicole Ibrahim and this answer I think you're pretty set for handling MTP analysis for Android devices. Well done Kevin Stokes, you won a RiffBox!

The Challenge:
Your suspect was identified with a Samsung Galaxy S3 device attached to his work computer on the day of his departure. On a Windows 7 system what would you do to determine the following:

 

1. When the phone was first and last connected
2. What was being accessed from the phone
3. If data had been copied to the phone
4. The contents of files accessed from the phone

The Winning Answer:
Kevin Stokes
I can actually look at my information from Saturday.  On January 1, I did a factory restore on my laptop.  It’s so nice to have a clean computer!  I connected my phone for charging in the afternoon.
1. When the phone was first and last connected
First Time Connected:  Utilizing Nicole Ibrahim’s research on USB devices, I learned that the follow registry keys would have information regarding times that they were created upon device insertion.   However, it may be possible that some of these are added by default and are actually related to potential events or actions that could take place at some time on the device.  I’ll show an example below, but verifying against the Setupapi.dev.log would be more conclusive of the first insertion time.
SYSTEM\CurrentControlSet\Control\DeviceClasses\




SYSTEM\CurrentControlSet\Control\Class\

This Snapshot of the SetupApi.dev.log shows more conclusive evidence of an MTP device being inserted at the time of interest.  You can see the VID & PID match the entries in DeviceClasses above.
>>>  [Device Install (Hardware initiated) - USB\VID_04E8&PID_6860\8d638616]
>>>  Section start 2014/01/04 14:39:33.433
     ump: Creating Install Process: DrvInst.exe 14:39:33.438
     ndv: Retrieving device info...
     ndv: Setting device parameters...
     ndv: Searching Driver Store and Device Path...
     dvi: {Build Driver List} 14:39:33.462
     dvi:      Searching for hardware ID(s):
     dvi:           usb\vid_04e8&pid_6860&rev_0400
     dvi:           usb\vid_04e8&pid_6860
     dvi:      Searching for compatible ID(s):
     dvi:           usb\ms_comp_mtp
     dvi:           usb\class_06&subclass_01&prot_01
     dvi:           usb\class_06&subclass_01
     dvi:           usb\class_06
     cpy:      Policy is set to make all digital signatures equal.
     dvi:      Enumerating INFs from path list 'C:\windows\inf'
     inf:      Opened PNF: 'C:\windows\System32\DriverStore\FileRepository\wpdmtp.inf_amd64_neutral_28f06ca2e38e8979\wpdmtp.inf' ([strings.0409])
     dvi:      Created Driver Node:
     dvi:           HardwareID   - USB\MS_COMP_MTP
     dvi:           InfName      - C:\windows\System32\DriverStore\FileRepository\wpdmtp.inf_amd64_neutral_28f06ca2e38e8979\wpdmtp.inf
     dvi:           DevDesc      - MTP USB Device
     dvi:           DrvDesc      - MTP USB Device
     dvi:           Provider     - Microsoft
     dvi:           Mfg          - (Standard MTP Device)
     dvi:           ModelsSec    - Generic.NTamd64
     dvi:           InstallSec   - MTP
     dvi:           ActualSec    - MTP.NT
     dvi:           Rank         - 0x00ff2000
     dvi:           Signer       - Microsoft Windows
     dvi:           Signer Score - INBOX
     dvi:           DrvDate      - 06/21/2006
     dvi:           Version      - 6.1.7600.16385
     dvi:      Created Driver Node:
     dvi:           HardwareID   - USB\Class_06&SubClass_01&Prot_01
     dvi:           InfName      - C:\windows\System32\DriverStore\FileRepository\wpdmtp.inf_amd64_neutral_28f06ca2e38e8979\wpdmtp.inf
     dvi:           DevDesc      - MTP USB Device
     dvi:           DrvDesc      - MTP USB Device
     dvi:           Provider     - Microsoft
     dvi:           Mfg          - (Standard MTP Device)
     dvi:           ModelsSec    - Generic.NTamd64
     dvi:           InstallSec   - MTP
     dvi:           ActualSec    - MTP.NT
     dvi:           Rank         - 0x00ff2001
     dvi:           Signer       - Microsoft Windows
     dvi:           Signer Score - INBOX
     dvi:           DrvDate      - 06/21/2006
     dvi:           Version      - 6.1.7600.16385
     inf:      Searched 1 potential matches in published INF directory
     inf:      Searched 35 INFs in directory: 'C:\windows\inf'

Last Time Connected:  The last time connected was more difficult to determine, however after reviewing more entries, this was the latest time I discovered for this device.  This was near the time I removed the device from the computer and plugged it into the wall for charging.  I’m not aware of what actions created this entry, as I was unable to get this time to update with connection testing today.  The registry entries I’m using for this portion of the report, by the way, were all saved prior to any testing.
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\...

Device Name – Software Hive
I did find out that the Microsoft\Windows Portable Devices\Devices\USB#...  key updates when the Device Name changes on my Samsung Galaxy S4.
Here, the first entry shows the device name I had set up (I had performed a factory reset on my phone after a troublesome software update so I changed the name after having connected my phone an earlier time).  I was curious why this time was different from the install times, as Nicole mentioned this key is created initially at the time of the first device install.  I changed the Device Name to TEST (SGH-M919), then rechecked the key and the time value was again changed to the time that I plugged in the phone.



2. What was being accessed from the phone?

Looking over the ShellBag entries from the UsrClass.dat.  These are the folders I created for testing.  The folders name “AllReadyOnDevice”, were created on the microSD card, then the card was placed into the phone to be accessed.  The “CopiedFromComputer” folder was created on my computer, then copied to the microSD card, while it was being access from the phone.  These entries are from when I accessed each folder while they were on the phone.

Also Read: Daily Blog #196

Post a Comment