Daily Blog #771: Solution Saturday 3/8/25

Hello Reader,

 This week Phill Moore has brought us the winning answer but as his conversation on X showed it was an answer that could have had additional findings if all of the new logging sources were turned on. Let's celebrate Phill's win and know that blogs will be coming to explore his results and what log sources can be turned on to give even more information. 

The Challenge:

 

What log entries are left behind when the following scenarios occur:

 

1.  A user searches their own mailbox

 

2. A user searches their own onedrive

 

3. An administrator searches their own mailbox

 

4. An administrator searches their own one drive

 

5. An administrator searches someone else's mailbox

 

6. An administrator searches someone else's onedrive 

 

The winning answer:

https://thinkdfir.com/2025/03/08/sunday-funday-searching-for-searching/

Also Read: Daily Blog #770: Forensic Lunch Test Kitchen 3/7/25

Read More

Daily Blog #765: Sunday Funday 3/2/25

Hello Reader,

It's Sunday! This week's challenge is all about Microsoft 365! I know many of you are routinely searching and reviewing Microsoft 365 UAL logs so let's see what you know!

The Prize:

$100 Amazon Giftcard

The Rules:

1. You must post your answer before Friday 3/7/25 7PM CST (GMT -5)
2. The most complete answer wins
3. You are allowed to edit your answer after posting
4. If two answers are too similar for one to win, the one with the earlier posting time wins
5. Be specific and be thoughtful
6. Anonymous entries are allowed, please email them to dlcowen@gmail.com. Please state in your email if you would like to be anonymous or not if you win.
7. In order for an anonymous winner to receive a prize they must give their name to me, but i will not release it in a blog post
8. AI assistance is welcomed but if a post is deemed to be entirely AI written it will not qualify for a prize. 

The Challenge:

 

What log entries are left behind when the following scenarios occur:

 

1.  A user searches their own mailbox

 

2. A user searches their own onedrive

 

3. An administrator searches their own mailbox

 

4. An administrator searches their own one drive

 

5. An administrator searches someone else's mailbox

 

6. An administrator searches someone else's onedrive

 

Also Read: Daily Blog #764: Solution Saturday 3/1/25

Read More

Daily Blog #690: Forensic Lunch 5/1/20 - Oleg Skulkin (FeatureUsage), Brian Marks (Office 365) , Lee Whitfield (Forensic 4Cast Nomations)

Hello Reader,
      This week the Forensic Lunch went into Overtime! We went a full 25 minutes over the usual hour because we had so much to talk about. On this weeks show:

• Matt Seyer (@forensic_matt) talked all about the etl parser and monitor he's working on in Rust! https://github.com/forensicmatt/RsWindowsThingies
• Oleg Skulkin (@oskulkin) talked about how he approaches Sunday Funday's (he's won 3!) and about his new blog post about the Windows FeatureUsage artifact.  https://www.group-ib.com/blog/featureusage
• Brian Marks (@briandfir) talked about how the Office365 UAL MailboxItemsAccessed Audit event works and what the entry details mean  
• Lee Whitfield (@lee_whitfield ) talked through the Forensic 4Cast Awards nominations that end in two weeks, and Matt and I gave who we will be nominating. https://forensic4cast.com/2020/02/2020-forensic-4cast-awards-nominations-are-open/

You can watch the video here:
 https://youtu.be/g-CajSYPzYY

Also Read: Daily Blog #689

Read More

Daily Blog #680: Apple Unified Audit Logging

Hey Reader,
           Today I didn't have the time I needed to get a test kitchen done so I decided to take this opportunity to point you towards another great blog you should be reading with a different focus.

Sarah Edwards over at the Mac4n6 blog has started a series on the apple unified audit logging. If you have not been diving deep in your MacOS/Osx/Whatever they call it now analysis by looking into the data that unified audit logs provide your missing out.

Many examiners look at MacOS as a BSD operating system and just look at syslog, forgetting that there is a whole scaffold of another OS layered on top with its own logging. Apple's Unified Audit Logging is a moving target as they are notoriously not backwards compatible, I mean who else force upgrades file systems?

So do yourself a favor and check out Sarah's blog below:

https://www.mac4n6.com/blog/2020/4/19/introducing-analysis-of-apple-unified-logs-quarantine-edition-entry-0

Also Read: Daily Blog #679

Read More