Daily Blog #460: Test Kitchen 8/22/18

Hello Reader,
           If you were a subscriber to my YouTube channel you would have seen a notification that I was live tonight. Tonight I decided to do a Test Kitchen broadcast to test the behavior of jumplists in Windows 7 vs Windows 10 to see if any of the new jumplist behavior we have observed in Windows 10 was actually there all along.

If you watch the below video you can see me test whether or not Jumplist entries got created for:

• Creating a file
• Creating a directory
• Opening a directory
• Opening a file
• Copy and pasting a directory
• Renaming a directory

As well as some lnk file testing at the end to see how lnk files were created for opening a file in different directories. 

Watch the video below!

Also Read: Daily Blog #459

Read More

Daily Blog #439: Jumplist maximum storage

Hello Reader,
          There is some interesting testing going on with shell item storage. The quirks of lnk files naming and storage by extension is surprising and needs more testing before its documented. Something that has been tested though is how many items a jumplist will store.

When Eric Zimmerman was first writing Jumplist Explorer we were discussing what the maximum amount of entries stored in a single jumplist could be. So we wrote some quick automation and found that a single jumplist will store approximately 2,000 items before it purges the oldest item. I suspect the hard limit is 2048 (power of 2) but in our testing it was when we reached 2,000 that older items began being deleted from the structure.

Now this does not mean the older entries are lost, the jumplist is a compound file system and the streams are just marked as deleted and available to be recovered until a new entry gets written over it. In fact Jumplist Explorer can recover deleted entries and mark them as such. Tomorrow I'll see if I can get screenshots of this happening and show the internal record numbers. 

Also Read: Validating the Windows 10 Copy Paste artifact

Read More

Daily Blog #426: Directory Copy and Paste Artifacts in Windows 10

Hello Reader,
              I've talked about this in the Forensic Lunch and I think showed it once in a Test Kitchen but I don't think I've written about it in the blog. After reading the ongoing discussion on Twitter about the need to document beyond tweets and videos, you should read Brett Shavers post here , led me to understand that I need to put it in the blog as well to make it more accessible long term. In my mind I've already shown and shared this but I can't expect that everyone has watched and memorized the 100+ episodes of the Forensic Lunch.

So new as of at least Windows 10 (this needs to be tested on Windows 7 and Windows 8) there is a now a jumplist that is capturing the full path of every directory that is copy and pasted. For those of you doing external device investigations that means we have a data source that will show us what data our suspects have been copying and pasting onto external drives ... but only if what they are copying and pasting is a directory. Individual files being copy and pasted does not appear to be tracked, just directories.

You will want to look into the Jumplist with Appid f01b4d95cf55d32a and within it you find an entry for every directory that has been pasted. You will not get the source location but rather the destination which in my mind is more useful. The MRU date associated and the creation time of the directory will show you when as well.  

Also Read: How I Use It: Userassist

Read More

Daily Blog #58: Understanding the artifacts Jump Lists

Hello Reader,
         Another Sunday Funday is behind us and from it I've identified another blog series that need to be written. We are trucking along through the artifacts needed to better understand usage. We've covered LNK files, the USN Journal, USB Stor and User Assist. Today we are going to jump into Jump Lists which first made their appearance in Windows 7.

If you've never heard of Jump Lists before go here, http://www.forensicswiki.org/wiki/Jump_Lists, this blog post assumes you are familiar with them and seeks to help you better understand them. For instance I won't be explaining the difference between automatic/custom jump lists or where to find them and their structures.

If you want to read the most thorough write up of Jump Lists I've seen to date go here: http://articles.forensicfocus.com/2012/10/30/forensic-analysis-of-windows-7-jump-lists/.

An easy way to think about jump lists, though not technically accurate, is a chained series of LNK files stored on a per application basis. The biggest fundamental issue regarding Jump Lists versus the LNK files that analysts know and love is that LNK files where created, stored and maintained for the explorer shell (with the one exception I know of being Microsoft Office). 

Through program shourtcuts, recent documents, office application documents, etc... there is a shared set of LNK files maintained. Jump lists does not entirely replace this functionality but rather extends it allowing tracking of recently used documents from the registry to individual jump lists on a per application basis through automatic destination files.

In short, if you are analyzing a Windows 7 system and you are not parsing/analyzing the jump lists then you are missing evidence. Many up to date forensic suites are not parsing jump list data structures yet and instead will carve LNK files from custom destination lists. Get a tool that handles them correctly:

TZWorks: http://tzworks.net/prototype_page.php?proto_id=20
Woanware: http://www.woanware.co.uk/?p=265

This is good news for us as that means what documents are being accessed through an application are no longer just maintained in the registry through MRU's and we get much more data to analyze on a per file basis. 

Some applications, notably Microsoft Office, emulated this functionality through LNK files in prior versions of Windows but Jump Lists extends this through auto destinations. MRU keys only keep the date of the last file accessed for that MRU key and the order of last access, while automatic Jump Lists records the same type of data a LNK files does but extends it.

One of the difficulties investigators have had with jump lists was matching the appid that makes up the jump lists name back to which application it was tracking. Luckily for us Hexacorn seems to have solved this issue and made a perl script for use (Yay Perl!):
http://www.hexacorn.com/blog/2013/04/30/jumplists-file-names-and-appid-calculator/ which will allow you to generate the app-id for any given string.

So in short, and I probably will want to revisit this blog post, Jump Lists extend the analysis you did prior with LNK files and is stored on a per user basis for recent document access like LNK files, but is stored on a per application basis. 

One of things mentioned between all of the major sources is that jump lists are not deleted when a program is uninstalled and they would not be deleted by any system cleaner that is not 'Windows 7 aware'. So if you are not currently taking them into account in your investigations you should change that today.

Also Read: Daily Blog #57

Read More