Daily Blog #511: Forensic Lunch Test Kitchen 10/18/18 - External Drive formatted NTFS in regards to ObjectIDs.

Hello Reader,
             Back to the test kitchen tonight! While tonight's broadcast was a later than normal (showed the kids the few episode of the new Doctor Who season) we did have some good testing done. Tonight we tested my theory of what was recoverable from an external drive formatted NTFS in regards to ObjectIDs. 

The theory being that we could use the existence of ObjectIDs to show that files were interacted with after being copied, which is important since access dates are no longer updated when a file is opened on a NTFS drive since Windows Vista.

Tonight we learned:

• ObjectID attributes are set on files accessed from external fixed disks
• The /$Extend/$ObjID:$O Index root is created when a drive is formatted
• The $ObjID:$O Index allocations are not populated on the external drive when objects are created within the file system
• The $logfile will create a record storing the ObjectID that was set, when it was set or changed
• The $UsnJrnl:$J will contain a timestamped record showing when objectids were set allowing an examiner to timeline when the actions took place
• With the $logfile records you could determine which Mac address opened the files, when the objectid was set and when the file was deleted
• With the $usnjrnl records you could determine when the objectid was set and when/if the file was deleted

You can watch the video here:

Also Read: Daily Blog #510

Read More

Daily Blog #509: ObjectIDs and Domains

Hello Reader,
             Well YouTube was down for awhile tonight and at this point I'll need to get to bed before I could finish a test kitchen broadcast (if it would even work tonight!). 

So instead I decided to follow up on a question by Dr. Joe Sylve who asked in last nights Test Kitchen if Domain's are present in ObjectIDs if the computer was attached to a domain. To test this I went onto one of my domain connected computers and checked the objectID attributes of a file I've opened many times, our blank contract.

As you can see the DomainID is still all 0's meaning that this field is not currently being used, but you never know what the future will hold!

Also Read: Daily Blog #508

Read More

Daily Blog #508: Forensic Lunch Test Kitchen 10/15/18 - Examining the ObjectID index

Hello Reader,
          Tonight Matt Seyer virtually joined me for another test kitchen! We decided to examine the ObjectID index to determine what is really happening when a file is deleted and its ObjectID index entry is deleted. Matt presented his theory, Dr. Sylve contributed what he knew and the rest was solved with testing, tsk utilities, and python scripts.

Here is what we learned:

• The ObjectID Index is a B-Tree with pages of entries of ObjectIDs
• The last ObjectID in a page is the one most likely to survive in the slack space if it is deleted
• ObjectIDs anywhere else in the page have a high chance of being overwritten when the b-tree is balanced unless they got saved from a previous page swap
• istat won't give you the full path to a file, but you can get there if you are persistent 
• The $logfile contains every changed page until its overwritten

We also have some new theories to test tomorrow night regarding USN and $Logfile interaction with the ObjectID Index! We should be testing those tomorrow night.

You can watch the video here:

Also Read: Daily Blog #507

Read More

Daily Blog #505: Forensic Lunch Test Kitchen 10/12/18 - Deleting Files from ObjectID Index found at /$Extend/$ObjID:$O

Hello Reader,
            A shorter test kitchen tonight, mainly because the answer came much quicker than I expected but only in part. Tonight we deleted files from the command line and the GUI to see what effect deleting them would have on the ObjectID Index found at /$Extend/$ObjID:$O. I used the updated $O parser from Matt Seyer found here: https://github.com/forensicmatt/WinObjectIdParser

Here is what we learned:

• Deleting a file from the command line causes the ObjectID Index to delete the file entry
• Deleting a file from the GUI causes the ObjectID Index to delete the file entry
• That the deletion appears to clean and too quick, leading me to suspect that there is more going on here

On Monday I expect to resume this line of questioning with a hex editor (likely 010) and some offset tracking as we look to solve the mystery of the deleted ObjectID records. 

You can watch the video here:

Also Read: Daily Blog #504

Read More

Daily Blog #504: Forensic Lunch Test Kitchen 10/11/18 - Discussion on ObjectID

Hello Reader,
          Tonight we had what I think is a very exciting broadcast of the Forensic Lunch. When discussing on twitter whether or not a ObjectID would be created when a file is accessed over a network share DR Joe Sylve (watch the video to see why i capitalized doctor) hypothesized that it would not, while I pontificated that it would. It turns out ... it does! We then extracted and encoded the local objectid database (/$extend/$objid:$o) and parsed it to find out which systems had which dad.

Here is what we learned:

• Opening a file from a Windows 10 system on a Windows 7 file share creates an ObjectID that both systems can see
• The ObjectID contains the volume id and mac address of the file server (the windows 7 system in my testing)
• The ObjectID database on the Windows 7 system contains the objectid of the file accessed
• The ObjectID database on the Windows 10 system does not contain the objectid of the file accessed
• The windows 10 system will create a lnk file for the access
• The windows 7 system does not create a lnk file for the file being accessed from it as a network share
• Creating a file in Windows 10 in the GUI will trigger an ObjectID being created on a network share hosted by a Windows 7 system

You can watch the video here:

Also Read: Daily Blog #503

Read More

Daily Blog #496: Forensic Lunch Test Kitchen 10/3/18 - Our exploration of ObjectIDs within the MFT

Hello Reader,
      Today we come close to a conclusion on our exploration of ObjectIDs within the MFT. We went in and both extracted MFT attributes with pytsk as well as ran/validated the same information with mftecmd to determine why we had duplicate objectids in our file system.

We learned that:

• Duplicate ObjectIDs appear to happen in hard links to the same file
• Every Duplicate ObjectID that we tested had the same file entry and sequence number meaning it was the same file
• Python has a cool function called dir() which will show you all of the available methods that an object has

You can watch the video here:

Also Read: Daily Blog #495

Read More

Daily Blog #495: Forensic Lunch Test Kitchen 10/2/18 - ObjectID Testing and Research

Hello Reader,
          Another night, another test kitchen. Tonight we continued our ObjectID testing and research to see if sequence numbers would reliably increment on reboots allowing us to find evidence of changes to the system clock and in what actual order files were created (windows 10) or opened (all other windows). Here is the summary of what we learned:

• Sequence numbers are set in the Software registry under SOFTWARE\Microsoft\RPC\UUIDSequenceNumber
• Windows.old backups now appear to include the users directory and are deleted after a week by a scheduled task
• Sequence numbers will increment on each reboot, irregardless of timeset
• Sequence numbers can jump and then settle back on the original sequence, working to understand how and why

You can watch the broadcast here:

Also Read: Daily Blog #494

Read More

Daily Blog #491: Test Kitchen 9/27/18 - Sequential ObjectID Testing

Hello Reader,
        We had a short broadcast this evening to test and show how the timestamps within the ObjectIDs were being set and incremented.

We learned that:

1. Files extracted in mass may have the same object ID timestamp
2. Files created by the user should have incrementing object ID timestamps

I've uploaded the new script (ObjectIDScannerV2) to the TestKitchen Github:
https://github.com/dlcowen/TestKitchen/tree/master


Watch it here:

Also Read: The end of enfuse/ceic

Read More