Hello Reader,
            Yogesh Khatri continues to push out new OSX forensic tools, if you haven't used mac_apt you really should be https://github.com/ydkhatri/mac_apt. Now Yogesh has given us a Unified Log Parser which will allow you to parse unified logs on any platform and since its python it should be easy to extend or reuse his code which is generously MIT licensed.

Go here and check it out:
https://github.com/ydkhatri/UnifiedLogReader

Hello Reader,
           So I've been pretty bad at pre-scheduling forensic lunches lately so I decided to look at my calendar and commit to a schedule for the first quarter of 2019. So what follows are the scheduled dates for the first quarter of 2019. I already have guests lined up for 2/1/19 and I'll be looking to firm up more for the rest of the quarter.

• 2/1/19  - Blanche Lagny and the DFIR Review Team
• 2/15/19
• 3/1/19
• 3/15/19
• 4/2-4/3/19 MUS
• 4/26/19 

Hello Reader,
            Last week I may have asked a bit much, so I'm reeling myself back in. This week I've posted a lot of links to other peoples work as I've been teaching SANS FOR500 during the day at the CTI Summit and doing my case work at night. However thanks to great students sharing stories and asking great questions I'm walking away with even more insights and questions to answer. This week let's push our knowledge of shellbags forward.

The Prize:
$100 Amazon Giftcard

The Rules:

Hello Reader,
              Looks like my 2019 streak is now broken, this week we have no qualifying answers. When this happens I take it as a sign that the question was harder than I expected which means I really need to focus on finding a real answer myself. I'll be working on that and the other unanswered challenges in the year to come. Tomorrow come back for another challenge and I'll adjust my questions accordingly.

The winning answer: None this week

Hello Reader,
          A new organization within an organization has formed! The DFIR Review group within DFRWS has officially emerged from 'stealth mode' and is ready to give your DFIR research peer review and fast feedback. With a combination of academics and practitioners volunteering their time they are pledging to help you validate your work and look for what you can do next. 

If this excites you, then go directly to:
http://dfrws.org/dfir-review

And get your work in!

Hello Reader,
             SANS is announcing a new DFIR course written by Kevin Ripa and Eric Zimmerman called FOR498: Battlefield Forensics & Data Acquisition. It's a course that focuses on dealing with all the onsite triage you will encounter when gathering evidence in a variety of environments with a big focus on preserving data from a very wide variety of sources.

From RAIDs, RAM, Cloud an Cell Phones this course will run you through the gauntlet of data sources that the modern examiner will encounter in the field.

If you are interested go here: https://www.sans.org/course/battlefield-forensics-and-data-acquisition

I'm looking forward to seeing the final material and labs!

Hello Reader,
           I know this came out a week ago but I don't think I wrote about it. I found this article written by Elcomsoft employee Oleg Afonin to be fascinating! Oleg is writing all about how to get a SSD drive into factory access mode allowing an examiner to get access to all the data on a SSD without a chip off! This whole article was a fascinating read, if any of you out there has a PC3000 SSD let me know as I'd love to do some testing to find out what is actually recoverable from this method.

Read the article here: https://blog.elcomsoft.com/2019/01/life-after-trim-using-factory-access-mode-for-imaging-ssd-drives/

Hello Reader,
             Between calls and work I got to watch some of the CTI Summit this week in DC prior to my class that starts tomorrow. I will admit that I look at CTI mainly from the outside trying to understand how it really works and what is real vs marketing. Prior to the CTI Summit I have read Scott Roberts and Rebekah Brown's book Intelligence Driven Incident Response:
 https://www.amazon.com/Intelligence-Driven-Incident-Response-Outwitting-Adversary/dp/1491934948 and I've talked to the CTI instructors about what they do in FOR578. ,

All of that though was just a foundation to understand the edges of the world of threat intelligence. Here where the words I heard repeated today:

• Bias 
• Cognitive Bias
• ATT&CK
• Pyramid of Pain
• Peer Review
• Threat actor

Hello Reader,
      If you've been following the blog and the test kitchens you would have seen that both myself and Maxim Suhanov have been testing and talking alot about the Amcache which lead to our findings about the Syscache hive. Well, it looks like we are not alone in our quest to truely understand this artifact since Blanche Lagny of the Agence Nationale de la Sécurité des Systèmes d'Information (ANSSI) aka the French National Cybersecurity Agency has released today atleast a years worth of research into not only the Amcache structure but also:

• What processes populate the Amcache
• What determines the format of the Amcache data (dll versions not windows versions)
• What determines the behavior of the Amcache storage (again its dll versions)
• and much more

If you are at all interested in the Amcache and want to understand it at a deeper level I would highly recommend you read this:
http://www.ssi.gouv.fr/uploads/2019/01/anssi-coriin_2019-analysis_amcache.pdf

Please note as with any other paper Lagny has both timing and scope limitations so this paper doesn't include every possible facet of the Amcache,  such as what it does not log or how the latest version of Windows 10 populates it. It's not that she is not aware of the other data points its that they are hopefully going to be covered by future papers. 

Hello Reader,
            Last week's challenge brought out some great research and new tools. I hope that this streak of great responses continues through 2019! Let's switch focus back to the Syscache hive for this weeks challenge.


The Prize:
$100 Amazon Giftcard

The Rules:

Hello Reader,
        This weeks' challenge has an interesting twist, I have two answers but neither was submitted before the deadline. So I thought I would post the two answers for everyone's benefit so it's not lost to the twitter timeline.

The Challenge:

Hello Reader,
          Well I attempted to do a test kitchen tonight but VMWare Workstation didn't want to cooperate. What I wanted to show is summarized in the below blog post from Eric Zimmerman:

https://binaryforay.blogspot.com/2019/01/locked-file-support-added-to.html

Eric has added the ability for his registry tools and the MFT explorer to be able to access the locked live files running on the live system. This means you can now access shellbag data with dates, view and search registries, parse amcache hives, run registry plugins and parse MFTs all without imaging or extracting files from the live system.

This is a pretty big step and it will require running the programs as the administrator in order to access the raw disk. I hope you take a moment to give them a spin as I will when I get a VM to boot!

Hello Reader,
            I saw this article over on the verge:
https://www.theverge.com/2019/1/16/18185490/microsoft-cortana-windows-10-search-changes

In this article they describe how Cortana is going to be separated from the search function. Currently we find the Windows 10 search artifacts in the NTUSER registry under the \software\microsoft\windows\current version\search. So keep an eye out for this change as we expect changes in how this data is stored and possibly new entries for cortana.

This is interesting since Cortana has been rapidly changing artifact wise and a return to more locally stored Cortana artifacts would be welcome. 

Hello Reader,
   Tonight we just had a short testing session (8 minutes of actual testing) were we checked in on last nights test. Here is what we learned:

• The time delay did not effect our results
• A shutdown/power on did not add a new entries
• The registry explorer and hasher entries still had no hash
• We still saw no entries for the other mimikatz executables

Hello Reader,
       Tonight we returned to the test kitchen to try to solve the mystery of the Multiple mimikatz executables now showing up in the Syscache

Tonight we learned:

• Syscache does not appear to duplicate entries by hash
• We got some entries to appear without a hash
• We are giving the VM enough time to run its background processes to get the Syscache full written to with a new test tomorrow night
• The last write time does not appear to be updated when the program is executed again
• 64bit and 32bit executables are being recorded

Hello Reader,
          I was out late helping a friend so rather than a test kitchen tonight I'm going to do a tool highlight. David Dym our colleague at G-C Partners, LLC has written a number of tools we use like:

• ShadowKit
• MetaDiver
• SqliteDiver

https://www.easymetadata.com/2019/01/mdviewer-1-0-initial-release/

Hello Reader,
          We've had a back to back great answers in this new year which I hope is just sitting the trend for the rest of 2019. We've bounced around a couple of topics but let's see if you can finish one out for all of us.

The Prize:
$100 Amazon Giftcard

The Rules:

Hello Reader,
        I had two great submissions this week and one of them surprised me because it was from my own fellow g-c'er Matt Seyer. Matt won this weeks competition because he took one step farther in his testing to show not only what the new tables in the Server 2019 SRUM database meant, he also showed where to go in the registry to get the answer.

The Winning Answer:
Matt Seyer (@forensic_matt)

Sunday Funday Submission

The Challenge

Methodology

Windows Versions Used

Table Differences

Base Tables

Windows 10	Server 2019 Desktop Experience	Status
--------------------------------------- Table: MSysObjects --------------------------------------- ObjidTable -> INTEGER_32BIT_SIGNED Type -> INTEGER_16BIT_SIGNED Id -> INTEGER_32BIT_SIGNED ColtypOrPgnoFDP -> INTEGER_32BIT_SIGNED SpaceUsage -> INTEGER_32BIT_SIGNED Flags -> INTEGER_32BIT_SIGNED PagesOrLocale -> INTEGER_32BIT_SIGNED RootFlag -> BOOLEAN RecordOffset -> INTEGER_16BIT_SIGNED LCMapFlags -> INTEGER_32BIT_SIGNED KeyMost -> INTEGER_16BIT_UNSIGNED LVChunkMax -> INTEGER_32BIT_SIGNED Name -> TEXT Stats -> BINARY_DATA TemplateTable -> TEXT DefaultValue -> BINARY_DATA KeyFldIDs -> BINARY_DATA VarSegMac -> BINARY_DATA ConditionalColumns -> BINARY_DATA TupleLimits -> BINARY_DATA Version -> BINARY_DATA SortID -> BINARY_DATA CallbackData -> LARGE_BINARY_DATA CallbackDependencies -> LARGE_BINARY_DATA SeparateLV -> LARGE_BINARY_DATA SpaceHints -> LARGE_BINARY_DATA SpaceDeferredLVHints -> LARGE_BINARY_DATA LocaleName -> LARGE_BINARY_DATA	--------------------------------------- Table: MSysObjects --------------------------------------- ObjidTable -> INTEGER_32BIT_SIGNED Type -> INTEGER_16BIT_SIGNED Id -> INTEGER_32BIT_SIGNED ColtypOrPgnoFDP -> INTEGER_32BIT_SIGNED SpaceUsage -> INTEGER_32BIT_SIGNED Flags -> INTEGER_32BIT_SIGNED PagesOrLocale -> INTEGER_32BIT_SIGNED RootFlag -> BOOLEAN RecordOffset -> INTEGER_16BIT_SIGNED LCMapFlags -> INTEGER_32BIT_SIGNED KeyMost -> INTEGER_16BIT_UNSIGNED LVChunkMax -> INTEGER_32BIT_SIGNED Name -> TEXT Stats -> BINARY_DATA TemplateTable -> TEXT DefaultValue -> BINARY_DATA KeyFldIDs -> BINARY_DATA VarSegMac -> BINARY_DATA ConditionalColumns -> BINARY_DATA TupleLimits -> BINARY_DATA Version -> BINARY_DATA SortID -> BINARY_DATA CallbackData -> LARGE_BINARY_DATA CallbackDependencies -> LARGE_BINARY_DATA SeparateLV -> LARGE_BINARY_DATA SpaceHints -> LARGE_BINARY_DATA SpaceDeferredLVHints -> LARGE_BINARY_DATA LocaleName -> LARGE_BINARY_DATA	Both table schemas match.
--------------------------------------- Table: MSysObjectsShadow --------------------------------------- ObjidTable -> INTEGER_32BIT_SIGNED Type -> INTEGER_16BIT_SIGNED Id -> INTEGER_32BIT_SIGNED ColtypOrPgnoFDP -> INTEGER_32BIT_SIGNED SpaceUsage -> INTEGER_32BIT_SIGNED Flags -> INTEGER_32BIT_SIGNED PagesOrLocale -> INTEGER_32BIT_SIGNED RootFlag -> BOOLEAN RecordOffset -> INTEGER_16BIT_SIGNED LCMapFlags -> INTEGER_32BIT_SIGNED KeyMost -> INTEGER_16BIT_UNSIGNED LVChunkMax -> INTEGER_32BIT_SIGNED Name -> TEXT Stats -> BINARY_DATA TemplateTable -> TEXT DefaultValue -> BINARY_DATA KeyFldIDs -> BINARY_DATA VarSegMac -> BINARY_DATA ConditionalColumns -> BINARY_DATA TupleLimits -> BINARY_DATA Version -> BINARY_DATA SortID -> BINARY_DATA CallbackData -> LARGE_BINARY_DATA CallbackDependencies -> LARGE_BINARY_DATA SeparateLV -> LARGE_BINARY_DATA SpaceHints -> LARGE_BINARY_DATA SpaceDeferredLVHints -> LARGE_BINARY_DATA LocaleName -> LARGE_BINARY_DATA	--------------------------------------- Table: MSysObjectsShadow --------------------------------------- ObjidTable -> INTEGER_32BIT_SIGNED Type -> INTEGER_16BIT_SIGNED Id -> INTEGER_32BIT_SIGNED ColtypOrPgnoFDP -> INTEGER_32BIT_SIGNED SpaceUsage -> INTEGER_32BIT_SIGNED Flags -> INTEGER_32BIT_SIGNED PagesOrLocale -> INTEGER_32BIT_SIGNED RootFlag -> BOOLEAN RecordOffset -> INTEGER_16BIT_SIGNED LCMapFlags -> INTEGER_32BIT_SIGNED KeyMost -> INTEGER_16BIT_UNSIGNED LVChunkMax -> INTEGER_32BIT_SIGNED Name -> TEXT Stats -> BINARY_DATA TemplateTable -> TEXT DefaultValue -> BINARY_DATA KeyFldIDs -> BINARY_DATA VarSegMac -> BINARY_DATA ConditionalColumns -> BINARY_DATA TupleLimits -> BINARY_DATA Version -> BINARY_DATA SortID -> BINARY_DATA CallbackData -> LARGE_BINARY_DATA CallbackDependencies -> LARGE_BINARY_DATA SeparateLV -> LARGE_BINARY_DATA SpaceHints -> LARGE_BINARY_DATA SpaceDeferredLVHints -> LARGE_BINARY_DATA LocaleName -> LARGE_BINARY_DATA	Both table schemas match.
--------------------------------------- Table: MSysObjids --------------------------------------- objid -> INTEGER_32BIT_SIGNED objidTable -> INTEGER_32BIT_SIGNED type -> INTEGER_16BIT_SIGNED	--------------------------------------- Table: MSysObjids --------------------------------------- objid -> INTEGER_32BIT_SIGNED objidTable -> INTEGER_32BIT_SIGNED type -> INTEGER_16BIT_SIGNED	Both table schemas match.
--------------------------------------- Table: MSysLocales --------------------------------------- Type -> INTEGER_8BIT_UNSIGNED iValue -> INTEGER_32BIT_SIGNED Key -> BINARY_DATA	--------------------------------------- Table: MSysLocales --------------------------------------- Type -> INTEGER_8BIT_UNSIGNED iValue -> INTEGER_32BIT_SIGNED Key -> BINARY_DATA	Both table schemas match.
--------------------------------------- Table: SruDbIdMapTable --------------------------------------- IdType -> INTEGER_8BIT_UNSIGNED IdIndex -> INTEGER_32BIT_SIGNED IdBlob -> LARGE_BINARY_DATA	--------------------------------------- Table: SruDbIdMapTable --------------------------------------- IdType -> INTEGER_8BIT_UNSIGNED IdIndex -> INTEGER_32BIT_SIGNED IdBlob -> LARGE_BINARY_DATA	Both table schemas match.
--------------------------------------- Table: SruDbCheckpointTable --------------------------------------- ProviderId -> GUID CheckpointId -> INTEGER_32BIT_SIGNED NextIncId -> INTEGER_32BIT_SIGNED SeqNumber -> BINARY_DATA RecordSet -> LARGE_BINARY_DATA	--------------------------------------- Table: SruDbCheckpointTable --------------------------------------- ProviderId -> GUID CheckpointId -> INTEGER_32BIT_SIGNED NextIncId -> INTEGER_32BIT_SIGNED SeqNumber -> BINARY_DATA RecordSet -> LARGE_BINARY_DATA	Both table schemas match.

Extended Tables

Resolving Extended GUIDs