Daily Blog #661: New Blog Template, New Blog Entry, New Daily Blog

Hello Reader,
It's been awhile and a lot has changed since my last post.

1. I've now been a Managing Director at KPMG since July of 2019.
2. I finally got a new blog template as you can see, I'm still making tweaks but in short it
    a. No longer has a fixed column width
    b. Allows me to add sections to the main blog site to highlight popular series (like automating dfir) or challenges
     c. Is no longer broken
3. I'm still doing the Forensic Lunch with Matt Seyer, but now I'm getting better at it and resuming a weekly schedule!
4. I stopped daily blogging during the whole work transition thing and to get a new blog template that wasn't broken

With the current crisis my plan is to keep busy, that means focusing on family and work. That also means whatever time I have in between is going to test kitchens, blog posts and research so when this over we are all better off.

So with that, if you couldn't tell from the title, it's time for daily blogging to return.

Tomorrow's post will be the now weekly forensic lunch broadcast, followed by something on Saturday and then Sunday Funday will return.

Keep your reader feeds updated we are back!

In the meantime, read the Daily Blog #660

Read More

Wait it's October?

Hello Reader,
       It's been 5 months since I last updated the blog and I have so much to share with you! I'm writing this to force myself to follow up with some posts tomorrow that will include:

Our slides from OSDFCon
An overview of our new open source project we put on GitHub ElasticHandler
An overview of our other new open source project on GitHub GCLinkParser
All the video's of the forensic lunch, they've been on youtube though!
An update on the forensic lunch podcast version
and more!

Talk to you tomorrow!

Also Read: Automating DFIR - How to series on programming libtsk with python Part 13

Read More

Updates and status

Hello Reader!,
                       It's been awhile since we've talked. Things here at G-C have been pretty busy, the legal sector at least appears to be in a full recovery (knock on wood). While I haven't had time to write up a full blog post on some of the new things we've found over the summer, I did want to take the time to show you how our NTFS $logfile parser is coming. For those of you who attended my CEIC session on 'anti-anti forensics' or who downloaded the labs I posted afterwords you know that we had a rough parser and tests to recover the names of wiped files before.

I'm happy to say we've come a long way since then. The initial proof of concept parser was shown to validate the artifact and divide up the pieces into something we could then further understand. We now have a parser, that is still in development, that can go even further creating CSVs of human readable data extracted from those $logfile segments.

What does that mean? Well it means:

1. We can recover the names of deleted files and their metadata, even if its been purged out of the MFT. This includes the metadata associated with the file (directory, creation, modification and acess times).

2. We can recover the complete rename operation showing cleanly which file became which file. Including parsing out the directory, creation, modification and access times before and after the operation. This essentially will allow you to undo what a wiper has done (except for recover the contents of the file itself).

3. We can determine if files were written to other drives, and an approximation of how many. (This is not in the current version of the parsers and will require ist own blog post).

4. We can recover the original metadata of a file when it was created.

5. We should be able to recover timestamps that have been altered.

It's all written in perl (woo!) and we are going to release the source and documentation as soon as its ready (tm). In the mean time check out this awesome screenshot showing the parser recovering the metadata from 22 files that were wiped with eraser:

If you are need of this tool for a case immediately drop me a line and I'll see what we can do to help you out!

Also Read: CEIC 2012 - Anti Anti Forensics Materials

Read More