Daily Blog #269: Cool! When did FTK start doing that? #1 Create/mod dates of Carved PDFs from PDF metadata

Hello Reader,
          Occasionally in our work we stumble across new features from our tools that suddenly makes our lives easier. A long time ago I blogged about when FTK made the 'export lnk metadata' option available which made our lives so much easier. Today I want to talk about something else they just kinda put in and don't know when.

FTK is now correctly parsing out the creation and modification dates (if they exist) from carved pdf files and placing them in the correct fields within the interface. This may sound simple and apparent but for a very long time any carved file within FTK would have no time entries as well, they had no file timestamps... they were carved. What we saw this week was for those files that have timestamps within their metadata FTK is starting to pull this out in the processing of the carved file and sticking them into their relevant timestamp location.

Does this sound simple? It is, but it can be a huge time saver! Here is an example. I have a pdf file that I'm looking for an image that has been deleted and is no longer recoverable from all the usual locations (recycle bin, mft deleted file record, shadow copy, etc..) so I have to carve to find it. I know the date the file was created on the system as I still have a shellbag from the desktop access of the file, but I believe that it is a scanned image stored in a pdf. This presents a problem as I can't just do a keyword search for what I think the file contains as its an image.

You could try to OCR all of the carved pdf's and then search for keywords, but calling the OCRing of carved data (which may be incomplete and curropted) failure prone is being kind. So instead I was able to filter my file list for carved pdf's and then sort by create date. Boom there was one carved pdf created on the same day as the shellbag entry pointing to it. A quick preview of the file within Adobe Reader and I had what I was looking for.

So the next time you are what appears to be a huge lake of carved data trying to find a file interest, check to see if the tool you are using is exposing the dates stored within the document metadata it could be your ticket to a quick resolution.

Also Read: Daily Blog #268

Read More

The best feature you never knew existed - Export LNK Contents & Export LNK metadata in FTK

Bonjour Reader!,
I know I have large gaps in my blog posts, its not for a lack of ideas but it is for a lack of time. With the economic recovery in full swing in the legal world we are very busy.

However, I still need to finish my new book and start getting back to blogging more regularly so please feel free to harass me on twitter @hecfblog if I don't write a post once a week.

In this short post I am going to point out a feature in FTK that has existed since 3.3 atleast that I never knew existed. The feature is called 'export lnk contents' in ftk 3.3 and 'export LNK metdata' in ftk 4.0 and it may be the one feature that I wish existed in FTK for the last 8 years of using it. When I've mentioned what this feature is and what it does to fellow examiners each of them has said the same two things:

1. "Woh! This going to save me so much time!"
2. "Why didn't they tell everyone this was here?!"

So in relation to point number 2, let me do that for them.

HEY EVERYONE, FTK will now export out all of the metadata of a lnk file and the contents of the parsed lnks to a file (from atleast 3.2-4.0)!

It can do this with one, some or all LNK files just highlight them, right click a lnk and the context menu will show the option! Suddenly all the manual copy and pasting into a spreadsheet or running other tools (like tzworks lslnk) are no longer necessary. This is especially great when it comes to carved LNK files that may not actually be valid and break many third party tools when they try to parse them.

What all does it export you say?
Keep reading!

Surely there is no way they snuck in a feature everyone wanted and didn't tell anyone?
I sure didn't see it!

It must be missing something right?
Not that I can see! It exports out into a tab seperated file:

* Shortcut File - Name of the LNK file

* Local Path - The path to the file the LNK file is pointing to

* Volume Type - The type of volume (Fixed, Removable, CDROM) of the volume being accessed

* Volume Label - The volume label for the volume being accessed

* Volume Serial Number - The VSN of the volume being accessed

* Network Path - If this was done over the network, the full UNC path to the file

* Short Name - The 8.3 name of the file

* File Size - Size of the file in bytes

* Creation time (UTC) - When the file the LNK file is pointing to was created

* Last write time (UTC) - When the file the LNK file is pointing to was modified

* Last access time (UTC) - When the file the LNK file is pointing to was accessed

* Directory - If file the LNK file is ponting to is a directory

* Compressed - If file the LNK file is ponting to is compressed

* Encrypted - If file the LNK file is ponting to is encrypted

* Read-only - If file the LNK file is ponting to is marked read only

* Hidden - If file the LNK file is ponting to is marked hidden

* system - If file the LNK file is ponting to is marked as a system file

* Archive - If file the LNK file is ponting to is marked as to be archived

* Sparse - If file the LNK file is ponting to is 'sparse'

* Offline - If file the LNK file is ponting to is offline

* Temporary - If file the LNK file is ponting to is a ntfs temporary file

* Reparse point - If file the LNK file is ponting to is extended directory information

* Relative Path - The relative path to the LNK file

* Program arguments - Any arguements stored for the execution of the program

* Working directory - Where the executable will default for reads/writes without a path

* Icon - What icon is associated with the executable if any

* Comment - This is an outlook feature, not sure why its included

* NetBIOS name - The network names of the system the LNK file was accessing

* MAC address - The MAC of the system the LNK file was accessing

So the next time you are working a case in FTK and you want to know what was being accessed from external drives (and you are checking shell bags and other artifacts seperately of course) then make a filter for all file with the extension 'LNK' and right click on one and export all of them to TSV. Import that TSV into excel, sort by Local Path and your done! This may be one the biggest time savers I've found in FTK in years and I now use it on every case.

Have you found a feature you love that everyone seems to miss? Leave it in the comments below.

Also Read: Back to Basics, CD and DVD basic forensics

Read More