Hacking Exposed Computer Forensics Blog

Daily Blog #278: Forensic Lunch 3/28/14 - Discussion with Vico Marziale and Lee Whitefield

Hello Reader,
Another Forensic Lunch has been enjoyed by those who watched live. This week's show was a bit different than planned but still chock full of great DFIR information. This week we had:

Vico Marziale, @vicomarziale, from 504ensics, discussing their memory differencing project amongst other topics

Lee Whitfield, @lee_whitfield, discussing the upcoming deadline for Forensic 4cast award nominations and the trouble with time machines

Daily Blog #277: Sample Forensic Images

Sample Forensic Images by David Cowen - Hacking Exposed Computer Forensics Blog

Hello Reader,
One of things we built for the book 'infosec pro guide to computer forensics' was a set of images to practice each of the investigative how-to chapters. I used one as a Sunday Funday contest but at the time I was having problems putting them someplace where they wouldn't get taken down due to large bandwidth usage. Luckily this is no longer a problem thanks to mega and their very cheap and generous file sharing/hosting plans. So here are the forensic images we made for the book for you to download and try on your own. Having the book will help you understand the scenario/what to expect to find but you should be able to solve these images without any other information.

Chapter 11 Image - HR Cases (Porn)

Chapter 12 Image Scenario 1 - Administrator Abuse of privileges

Chapter 12 Image Scenario 2 - Administrator Abuse of privileges

Chapter 13 Image - Stealing Information

Chapter 14 Image - Internal Leaks

Chapter 15 Image- Keyloggers and Malware

Have fun, we will be posting up video walk through of these images and reports of results in the near future so you can learn how to solve them as well.

Daily Blog #276: Ever wanted to write a DFIR book?

Ever wanted to write a DFIR book? by David Cowen - Hacking Exposed Computer Forensics Blog

Hello Reader,
It's time to continue my posts about the talks I'll be giving at conferences this year. This time I want to talk about the DFIR author panel that Suzanne Widup from Verizon has setup at CEIC and the SANS DFIR Summit. The panel at CIEC this year will have in alphabetical order:

Warren Kruse, author of Computer Forensics: Incident Response Essentials
Joseph Shaw, author of Unified Communications Forensics: Anatomy of Common UC Attacks
Suzanne Widdup, author of Computer Forensics and Digital Investigation with EnCase Forensic v7
and myself

We will be doing the panel twice once Tuesday, May 20^th from 5:00pm – 6:00pm (Exhibit Hall Happy Hour) and again Wednesday, May 21^st from 12:15pm – 1:15pm (Lunch in the Exhibit Hall). So you'll have two chances to come talk to us and ask questions!

Ask questions about what you ask? Well topics like:

How we decided to write a book
How we found a publisher
What it takes to write a book
What to expect from writing a book
Was it worth it?
How you can get a book deal

It should be a good panel with a variety of publishers and experiences represented and available to answer your questions. I hope to see you there!

Daily Blog #275: IP Theft Panel at ADUC

IP Theft Panel at ADUC by David Cowen - Hacking Exposed Computer Forensics Blog

Hello Reader,
Last week I talked about the talk I am giving at SANS DFIR Summit. Today I want to talk about the panel I'll be on at the AccessData Users Conference on IP Theft. I think this will be a great panel that will expose those attendee's to the whole life cycle of an IP Theft case to trial. The panel will have Pierre Lidome fron Schlumberger providing the perspective of the inside forensics investigator, Sheryl Falk from Winston & Strawn providing the perspective of outside counsel and myself talking about being the outside expert.

We are going to walk through:

How a case starts and ends, from detection to testimony
The different roles each of us plays in the process
The triggering events that causes each of us to get engaged
How we work together
Cases we've worked

I think this is going to be a great panel and I'm excited that this is the first year AccessData has opened their conference up to a public CFP. If you are going to be there I hope you attend and ask lots of questions!

Daily Blog #274: Sunday Funday 3/23/14 Winner!

Sunday Funday by David Cowen - Hacking Exposed Computer Forensics Blog

Hello Reader,
This was an interesting Sunday Funday. I got two good responses that I liked but one seemed to have more information while the other described the details of less artifacts locations in more detail. In the end since it was a general question I went with the one that I thought gave the largest list of forensically relevant artifacts new to Windows 8.

The Challenge:

What changes have occurred between Windows 7 and Windows 8 that have created new forensic artifacts for examiners to recover and analysis. List as many as you can find with a short description of what they are/mean/do.

The Winning Answer:

Jacob Blend

Refresh points (similar to SRPs in XP, but more like an image to revert to)

-these can have wireless network info, bitlocker settings, personalization, metro style)

System recovery (refresh to factory state, but personal files can be handled here, in windows.old for instance)

Recover or refresh leaves different types of artifacts

https://digital-forensics.sans.org/summit-archives/2012/windows-8-recovery-forensics-understanding-the-three-rs.pdf

Registry values for device insertion, removed and firmware fields (timestamps), CurrentControlSet\Enum\DeviceType\DeviceID\InstanceID\{GUID}\Properties\xxxx

File history services (replacement of VSS) (saving differential changes)

Local folder, contains virtualstore

-%Root%\Users\%User%\AppData\Local

immersive apps have their own reg files

metro apps have their own internet artifacts- cache, cookies, and history

installed system apps in registry

installed user account apps

IE 10 should count as it is standard, an a supposed upgrade from Win 7 offerings-

-user pinned tiles

-immersive websites visited

Communication App includes a ton of social networking information

-web cache

-cookies

-user contacts

NEW registry info!

ELAM- Early Launch Anti Malware

BBI (Browser-Based Interface)

Settings.dat (User Profile)

NTUSER.DAT artifact TypedURLsTime

SAM artifacts

internet user name

user's tile

ISO automount

2 Swapfiles (pagefile.sys, swapfile.sys)

Storage Pools (resilient storage areas)

http://www.forensicfocus.com/downloads/windows-8-forensics-josh-brunty.pdf

http://www.forensicfocus.com/c/mode=prnt/id=49/webinars/2012/windows-8-forensics---a-first-look/

Daily Blog #273: Sunday Funday 3/23/14 - Forensic Artifacts Challenge

Forensic Artifacts Challenge by David Cowen - Hacking Exposed Computer Forensics Blog

Hello Reader,
This Sunday Funday is going up later in the day than normal so I will shift the deadline to be later in the day as well. If you watched the Forensic Lunch this Friday you heard Nasa & Khizra talk about a new feature in Windows 8 called File History. For this Sunday Funday let's see how well you've been keeping up with an operating system that has been out for over a year for a prize worth fighting for.

The Prize:

A free ticket to the SANS DFIR Summit! (A $499 value if you were to register in the next week with the discount code 'SUMMIT')

The Rules:

You must post your answer before Monday 3/23/14 2PM CST (GMT -5)
The most complete answer wins
You are allowed to edit your answer after posting
If two answers are too similar for one to win, the one with the earlier posting time wins
Be specific and be thoughtful
Anonymous entries are allowed, please email them to dcowen@g-cpartners.com
In order for an anonymous winner to receive a prize they must give their name to me, but i will not release it in a blog post

The Challenge:
What changes have occurred between Windows 7 and Windows 8 that have created new forensic artifacts for examiners to recover and analysis. List as many as you can find with a short description of what they are/mean/do.

Daily Blog #272: Saturday Reading 3/22/14

Saturday Reading by David Cowen - Hacking Exposed Computer Forensics Blog

Hello Reader,
It's Saturday! Put the kids outside (if its above freezing where you are) and brew your favorite beverage because it's time to get ready for the week ahead! It's for more links to make you think in this week's Saturday reading.

1. We had another great forensic lunch this week, this week we had:
Vico Marziale, @vicomarziale Talking about the research being done at 504ENSICS Labs and specifically into the OSX Spotlight index.

You can get a copy of spotlight inspector here:
http://www.504ensics.com/tools/digital-forensics-tool-spotlight-inspector/

You can read the 504ensiecs blog here
http://www.504ensics.com/blog/

You can see the rest of their website and tools here:
http://www.504ensics.com/

Nasa Quba & Kausar Khizra - Talking about their research on Windows 8 File History!
You can see Nasa & Khizra at the SANS DFIR Summit this june go into depth into this research during an hour presentation on the topic!
Go here to learn more

To contact Nasa & Khizra their linkedin page is here:
http://www.linkedin.com/in/kausarkhizra/
www.linkedin.com/pub/nasa-quba/39/715/382/

2. Didier Stevens has a new blog up talking about how to find embedded executables with his tool Xorsearch. Very cool stuff read it here: http://blog.didierstevens.com/2014/03/20/xorsearch-finding-embedded-executables/

3. On the SP Security Blog there is a great writeup on the examination of a rootkit using Volatility, http://spresec.blogspot.com/2014/03/uroburos-rootkit-hook-analysis-and.html Always nice to see how someone else solves these kinds puzzles.

4. Brian Moran has a new blog post up with his OSX live response scripts, http://brimorlabs.blogspot.com/2014/03/announcing-osx-live-response-bash.html If you are doing live response Brian's scripts are very helpful.

5. Darren Windham has a new blog up this week talking about the side effects of having McAfee installed when you are trying to do memory analysis, http://dfirtx.blogspot.com/2014/03/update-from-this-week-mcafee-and-memory.html

6. Version 3 of the SANS SIFT virtual machine is out,http://digital-forensics.sans.org/community/downloads

7. The Rekall memory forensics blog has a post up on how simple it can be to stop memory acquisitions, very interesting http://rekall-forensic.blogspot.fr/2014/03/how-to-stop-memory-acquisition-by.html

8. Frank McClain has a new blog up talking about his planned talk at this years SANS DFIR Summit, http://forensicaliente.blogspot.com/2014/03/presenting-dfir-shakespeare-style-dfir.html

Did I miss something? Let me know in the comments below!

Daily Blog #271: Forensic Lunch 3/21/14 - Discussion with Vico Marziale on OSX Spotlight Index

Hello Reader,
We had another great forensic lunch this week, this week we had:
Vico Marziale, @vicomarziale Talking about the research being done at 504ENSICS Labs and specifically into the OSX Spotlight index.

You can get a copy of spotlight inspector here:
http://www.504ensics.com/tools/digital-forensics-tool-spotlight-inspector/

You can read the 504ensiecs blog here
http://www.504ensics.com/blog/

You can see the rest of their website and tools here:
http://www.504ensics.com/

Nasa Quba & Kausar Khizra - Talking about their research on Windows 8 File History!
You can see Nasa & Khizra at the SANS DFIR Summit this june go into depth into this research during an hour presentation on the topic!
Go here to learn more

To contact Nasa & Khizra their linkedin page is here:

http://www.linkedin.com/in/kausarkhizra/

www.linkedin.com/pub/nasa-quba/39/715/382/

The Most/Recent Articles