hemu1438/forensicsgpt-training-data huggingface dataset:
Vmware from hard drive images -
Creating virtual machines from forensic images
After having no success with raw2vmdk, the Live View method has worked.
Live View requires:
Java JRE
VMWare Workstation 5.5+ or Server
VMWare VDDK (download)
Install
Install prerequisites followed by Live View (the installer will check for pre-reqs).
Tested: Win7-64 with VMWare Workstation 7.12, Live View 0.7b, and VMWare VDDK 5.0
VMX Creation
1. Run Live View as Administrator. (Messages pane will result in errors otherwise)
2. Set memory and OS as closely as possible to target machine specs. (To maximize probability of success)
3. Click "Start". (The screenshot error relates to maximums exceeded based on client machine.)
Windows restore points -
On Windows XP the Restore Points can be found in:
C:\System Volume Information_restore{%GUID%}\ 
Where %GUID% is the machine GUID, for which the Restore Point was created.
This directory contains:
fifo.log; Restore Point deletion information
Restore Point data sub directories, named 'RP[1-9][0-9]*', e.g. 'RP1'
A Restore Point data sub directory contains:
change.log or change.log.[1-9];
rp.log; restore point information log file
External Links
Wikipedia: System Restore
MSDN: Legacy System Restore Reference
Restore Point Forensics, by Steve Bunting
Restore Point Forensics, by Harlan Carvey, October 20, 2006
Restore Point Analysis, by Harlan Carvey, June 16, 2007
Enscript Tutorial 1 - Parse XP System Restore Logs, by Yogesh Khatri, March 2, 2012
The Windows Restore Point formats, by Joachim Metz, April 2015
Tools
Plaso as of version 1.3.0 has support for rp.log
rp_change_log.py, tool to analyze the change.log files
Windows desktop search -
Windows Desktop Search (or Windows Search) is a 'desktop' indexer for Microsoft Windows. In Windows XP, Search 4.0 (or Search XP) was an add-on. However Microsoft integrated Search into Windows Vista as 'part of the package'.
Data location
Windows Search stores its data in:
%CommonApplicationData%\Microsoft\Search\Data\Applications\Windows\ 
Note that '%CommonApplicationData%' is dependent on the Windows version.
E.g. on Windows XP
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\ 
E.g. on Windows 7
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\ 
The search index is stored in a file named Windows.edb. This file is an Extensible Storage Engine Database (edb).
To access the Windows.edb file (on a live system) the the Windows Search service needs to be deactivated and the necessary access rights are required.
Analysis
Currently there are not many tools which allow you to 'forensically' analyze the Windows Search database.
Artifacts
The artifacts in the Windows Search database can be useful in forensic analysis of a desktop Windows system, especially Windows Vista and later. A few applications are:
to (partial) recover the content of indexed documents and even email messages stored on a Microsoft Exchange server
to indicate the former existence of files
time-line analysis
Dirty database
When analyzing Windows Search databases you can come across a 'dirty database'. This is one left in a dirty state. Some of the tools fail to open these databases. You might have to resort to repairing the database or use a tools that does not have such limitations.
Obfuscation and compression
Windows Search uses both obfuscation and compression to store some of its data, but according to 'Forensic analysis of the Windows Search database' this is easily circumvented.
See Also
Google Desktop Search
Windows.edb file format
External Links
Wikipedia entry on Windows Desktop Search
Wikipedia list of Desktop search engines
Forensic analysis of the Windows Search database
Tools
libesedb
Windows Search Index Examiner
Dfxml example fileobject tag -
<fileobject> <filename>RAW/report02-3.pdf</filename> <id>19</id> <filesize>1421998</filesize> <partition>1</partition> <alloc>1</alloc> <used>1</used> <inode>39</inode> <type>1</type> <mode>511</mode> <nlink>2</nlink> <uid>0</uid> <gid>0</gid> <mtime>1230764913</mtime> <ctime>1230764913</ctime> <atime>1230764978</atime> <crtime>1230764978</crtime> <seq>1</seq> <byte_runs><run file_offset='0' fs_offset='241542144' img_offset='241542144' len='1421998'/></byte_runs> <hashdigest type='MD5'>dede94f84fb2d00dc93ed00fda272a18</hashdigest> <hashdigest type='SHA1'>3c078d039398c44611b6365e8afdeadeb61967d4</hashdigest> </fileobject>
Dfxml example source tag -
The '''
''' tag is used to introduce the source of forensic data. Currently we are using these for disk images, as the example below illustrates: <pre> <source type='Disk Image'> <imagefile>/corp/images/nus/1040.aff</imagefile> <sectorsize>512</sectorsize> <device_model>SEAGATE ST32550W SUN2.1G 0418</device_model> <device_sn>01806486</device_sn> <acquisition_commandline>aimage scsi1 /project2/b28.aff</acquisition_commandline> <acquisition_device>/dev/sda1</acquisition_device> <device_capabilities>pass2: >SEAGATE ST32550W SUN2.1G 0418< Fixed Direct Access SCSI-2 device pass2: Serial Number 01806486 pass2: 20.000MB/s transfers (10.000MHz, offset 15, 16bit), Tagged Queueing Enabled </device_capabilities> <sectorsize coding='base10'>512</sectorsize> <devicesectors coding='base10'>4194995</devicesectors> <acquisition_macaddr>00:0f:b5:42:6a:fe</acquisition_macaddr> <acquisition_date>2006-07-25T10:56:42</acquisition_date> 
After the source tag you may find some fileobject tags. They may be grouped within a volume tag:
<volume offset='32256'> <byte_runs> <byte_run offset='0' img_offset='114688' len='32768'> <byte_run offset='0' img_offset='1523712' len='32768'> <byte_run offset='0' img_offset='6356992' len='39659'> </byte_runs> <ftype>1</ftype> <ftype_str>ntfs</ftype_str> <block_size>4096</block_size> <block_count>4980142</block_count> <first_block>0</first_block> <last_block>4980141</last_block> <fileobject> ... </fileobject> </volume> 
Encoding
Encoding is assumed to be base10, except for hash codes, which are assumed to be base16.
Checkpoint full disk encryption -
Checkpoint Disk Encryption, formerly known as Pointsec, aka End Point Encryption is a package for encrypting Windows PC disks. See the Checkpoint site for all current information.
Items of interest to Forensics people
It comes in two flavors, boot password protect and Windows Pass-through. Boot protect means you're going to need the key. Windows pass-through means you can attack the OS to get to the underlying data (on a working copy, of course). Once you have an OS key, you can use a fresh copy to assemble evidence.
Checkpoint(sec) does supply boot drivers that allow you to mount a pass-through volume inside a BartPE environment. Very useful. Drivers are available from Checkpoint.
Dfxml piecewise hashing -
Digital Forensics XML can be used to represent the results of piecewise hashing of individual files. The md5deep suite now generates piecewise hashing results in DFXML when the -d option is provided.
Here is an example:
<?xml version='1.0' encoding='UTF-8'?> <md5deep> <fileobject> <filename>sample/bar.txt</filename> <filesize>46</filesize> <mtime format='time_t'>1296497502.0</mtime> <byte_runs><byte_run file_offset='0' len='46'><hashdigest type='MD5'>0e886f6b08986269af98aedde53df23f</hashdigest><hashdigest type='SHA256'>21c35b5698f1e54d11ca8a41321d40d75797425013dfa1b640ab34d7efa7f1ac</hashdigest></byte_run> </byte_runs> <hashdigest type='MD5'>0e886f6b08986269af98aedde53df23f</hashdigest> <hashdigest type='SHA256'>21c35b5698f1e54d11ca8a41321d40d75797425013dfa1b640ab34d7efa7f1ac</hashdigest> </fileobject> <fileobject> <filename>sample/foo.txt</filename> <filesize>193</filesize> <mtime format='time_t'>1296497462.0</mtime> <byte_runs><byte_run file_offset='0' len='193'><hashdigest type='MD5'>06f63e03ed5e1770a2ff753a76d04906</hashdigest><hashdigest type='SHA256'>82a217a76ebe5e6c0f768576a3e8fd9ba6de504c42360c23e08ddfa22e711ba0</hashdigest></byte_run> </byte_runs> <hashdigest type='MD5'>06f63e03ed5e1770a2ff753a76d04906</hashdigest> <hashdigest type='SHA256'>82a217a76ebe5e6c0f768576a3e8fd9ba6de504c42360c23e08ddfa22e711ba0</hashdigest> </fileobject> <fileobject> <filename>sample/somedir/baz.txt</filename> <filesize>19</filesize> <mtime format='time_t'>1296497486.0</mtime> <byte_runs><byte_run file_offset='0' len='19'><hashdigest type='MD5'>362aa248563e453588755f280387a3d4</hashdigest><hashdigest type='SHA256'>7a7c62947561b0b00c213d37d04edbe0c8de46282098b7216a23b25fa336f150</hashdigest></byte_run> </byte_runs> <hashdigest type='MD5'>362aa248563e453588755f280387a3d4</hashdigest> <hashdigest type='SHA256'>7a7c62947561b0b00c213d37d04edbe0c8de46282098b7216a23b25fa336f150</hashdigest> </fileobject> </md5deep>
Imaging Options -
There are multiple ways to image a computer with BitLocker security in place, namely:
Offline imaging
Live imaging
Offline imaging
One can make an offline image with the image containing encrypted information.
Multiple options to offline decrypt the information, provided the password or recovery password is available, are available. Some of which are:
dislocker
EnCase encryption module
libbde
The recovery password is a long series of digits broken up into 8 segments.
123456-123456-123456-123456-123456-123456-13456-123456 
Note that there is no white space in the recovery password including not at the end, e.g. EnCase does not accept the recovery password if there is trailing white space.
The recovery password can be recovered from a BitLocker enabled computer provided it can be logged into e.g. by running:
manage-bde.exe -protectors -get C: -Type recoverypassword 
The basic steps are:
Make an offline full disk image.
Recover the password, this can be done by booting the original computer, or by creating a clone and booting the clone. (booting from a clone has not been tested at this time.)
Once booted log into the computer
Use the BitLocker control panel applet to display the password. This can also be done from the command-line.
record the password
For EnCase v6 or higher with the encryption module installed
Load the image into EnCase
You will be prompted for the password. Simply enter it and continue.
If you prefer to have an un-encrypted image to work with other tools or share with co-workers, you can "re-acquire" the image from within EnCase. The new image will have unencrypted data.
After adding the encrypted image into your case, simply right click on the drive in the left panel and select acquire. Select "do not add to case". You will be presented a dialog window to enter new information about the image. Make sure the destination you select for your new image does not exist.
Live imaging
FTK Lite
Imaging of a physical drive
Using FTK Imager lite, it was determined a live image of the physical system disk resulted in an image with an encrypted bitlocker container on it.
Note that the phrase "physical" here corresponds directly with FTK Imagers use of the term in their image acquire menu.
Imaging of a logical partition
I was able to add a partition and create an image in which the data was unencrypted.
Note that the phrase "logical" here corresponds directly with FTK Imagers use of the term in their image acquire menu.
Files and Folders collections
This was not attempted, but it seems reasonable to assume this will collect unencrypted files.
X-Ways
Imaging of a physical drive
X-Ways support states this is not supported.
Imaging of a logical partition
X-Ways support states that this should work.
In at least one instance, I was able to add C: drive (not the physical disk, just the partition) and create an image that could in turn be processed by X-Ways. Both existing and deleted files were available within X-Ways after processing.
There has been atleast one report on the X-Ways forum that this feature does not work, so it may not work for all configurations of bitlocker.
See Also
BitLocker Disk Encryption
Paraben sim card seizure -
Paraben has acquired SIMCon and has integrated it into SIM Card Seizure and Device Seizure. Recover deleted sms/text messages and perform comprehensive analysis of SIM card data. SIM Card Seizure takes the SIM Card acquisition and analysis components from Paraben's Device Seizure and puts it into a specialized SIM Card forensic acquisition and analysis tool. SIM Card Seizure includes the software as well as a Forensic SIM Card Reader. If you already have Device Seizure & the Device Seizure Toolbox, there's no need for you to get SIM Card Seizure as well because they contain the components to perform a forensic SIM Card acquisition and analysis. This tool is for the investigator who only wants to acquire SIM Cards and does not want to perform forensic exams of all cell phone data.
SIM Card Seizure has unicode support to read multiple languages such as Arabic, Chinese, & Russian: Features:
* Forensic SIM Card Reader Included * Calculates MD5 & SHA1 Hash Values * Search Function * Recovers Deleted SMS Data* * Bookmarking Options * Report Creation Wizard * Save Workspaces for Further Review * Time Stamps Calculate GMT Offset * Access to Paraben's Forum * Access to Paraben's 24 Hour Support
Data Acquired from SIM Cards
* Phase Phase ID * SST SIM Service table * ICCID Serial Number * LP Preferred languages variable * SPN Service Provider name * MSISDN Subscriber phone number * AND Short Dial Number * FDN Fixed Numbers * LND Last Dialed numbers * EXT1 Dialing Extension * EXT2 Dialing Extension * GID1 Groups * GID2 Groups * SMS Text Messages * SMSP Text Message parameters * SMSS Text message status * CBMI Preferred network messages * PUCT Charges per unit * ACM Charge counter * ACMmax Charge limit * HPLMNSP HPLMN search period * PLMNsel PLMN selector * FPLMN Forbidden PLMNs * CCP Capability configuration parameter * ACC Access control class * IMSI IMSI * LOCI Location information * BCCH Broadcast control channels * Kc Ciphering key
SIM Card Seizure also acquires the whole catalog system with data in a tree-view presentation. Additionally, it can recover some deleted SMS data by analysis of unallocated space.
Libluksde -
The libluksde package contains a library and applications to read the Linux Unified Key Setup (luks) volumes.
Tools
The libluksde package contains the following tools:
luksdeinfo, which shows information about LUKS Volumes.
luksdemount, which FUSE mounts LUKS Volumes.
History
Libluksde was created by Joachim Metz in 2013.
External Links
Project site
Forensic disk differencing -
Forensic Disk Differencing is the process of taking two or more disk images from the same computer and determining what changes in the first disk image might have resulted in the changes that are observed in the second. One common use of differencing is to determine what an attacker did during a break-in. To be used for this purpose, it is necessary to have a forensic disk image of the computer before the break-in and after the break-in.
Differencing Tools
idifference.py
idifference.py is part of the Digital Forensics XML Python Toolkit distributed with fiwalk. This tool will compare two different disk images and report changes in files between the first and the second. It also produces a timeline of changes.
For example, using the nps-2009-canon2 series of disk images:
$ python idifference.py /nps-2009-canon2-gen2.raw nps-2009-canon2-gen3.raw >>> Reading nps-2009-canon2-gen2.raw >>> Reading nps-2009-canon2-gen3.raw Disk image:/corp/drives/nps/nps-2009-canon2/nps-2009-canon2-gen3.raw New Files: 2008-12-23 14:26:12 1315993 DCIM/100CANON/IMG_0041.JPG Deleted Files: 2008-12-23 14:12:38 855935 DCIM/100CANON/IMG_0001.JPG 2008-12-23 14:22:38 1347778 DCIM/100CANON/IMG_0037.JPG Files with modified content (but size unchanged): Files with changed file properties: DCIM/CANONMSC/M0100.CTG SHA1 changed 69b30c352ee802f49b1ea25325af9fa05c3ffca1 -> baa42c03a917b01b212fb7e538e5deb525995f31 DCIM/CANONMSC/M0100.CTG crtime changed to 1230070924 -> 1230071142 DCIM/CANONMSC/M0100.CTG mtime changed to 1230070924 -> 1230071142 DCIM/CANONMSC/M0100.CTG resized 180 -> 188 Timeline 2008-12-23 14:25:42 DCIM/CANONMSC/M0100.CTG SHA1 changed 69b30c352ee802f49b1ea25325af9fa05c3ffca1 -> baa42c03a917b01b212fb7e538e5deb525995f31 2008-12-23 14:25:42 DCIM/CANONMSC/M0100.CTG crtime changed 1230070924 -> 1230071142 2008-12-23 14:25:42 DCIM/CANONMSC/M0100.CTG mtime changed 1230070924 -> 1230071142 2008-12-23 14:25:42 DCIM/CANONMSC/M0100.CTG resized 180 -> 188 2008-12-23 14:26:12 DCIM/100CANON/IMG_0041.JPG created $ 
Here are some more examples:
--- idifference.py run on two disks from the 2009-M57 Patents scenario (Jo's November 23 vs. November 24th disk)
See Also
A general strategy for differential forensic analysis
Usbcrypt -
USBCrypt is a commercial (closed source) software intended primarily to encrypt external USB drives. (However, the encryption is not limited to the external drives or to the USB connection: any drive that is recognized by Windows as a valid drive with read-write access can be encrypted with USBCrypt.) USBCrypt software is Windows 7, Vista, XP, 2000-only. It supports AES, and Twofish encryption with the 128- and 256-bit keys, in the XTS and CBC encryption modes.
Recognizing drives encrypted with USBCrypt
USBCrypt encrypts drives by creating the file-based Virtual Encrypted Disks on them. In addition to one or more files that contain the encrypted data, USBCrypt also puts a portable software on the drive, to enable its use on other computers. While the encrypted data files contain no identifying information (and thus support plausible deniability, the presence of other supporting files makes it easy to identify the drives encrypted with USBCrypt: the root folder of the encrypted drive contains the file USBCrypt.exe as well as a folder named USBCrypt-system. The latter contains the encrypted data files as well as USBCrypt software files (DLL and SYS). The file USBCrypt.ini is a text-only file that contains settings as well as license information (including the name of the person or business who has purchased the software).
Spare-key file
When the user is encrypting a drive with USBCrypt software, s/he has the option to create a "spare key" file on the user's computer. This file contains a copy of the encryption key that can be used by the user if s/he forgets the main encryption password. Or, it can be used by a system administrator to get access to the encrypted data in case the employees leave the company and take the passwords with them. Each spare key file contains a copy of just one encryption key for the specific encrypted drive it was created for. It cannot be used to decrypt any other drive, even if the user has used the same password and encryption algorithm. USBCrypt can automatically detect whether it can decrypt a specific drive with a spare key.
Forensic Acquisition
If you encounter a system that has a live USBCrypt drive, it is imperative that you capture the contents of the encrypted drive before disconnecting the drive or shutting down the system. Once the system is shutdown, the contents becomes inaccessible unless you have the proper encryption key generated by a user's password. If the encrypted drive in not live, it is imperative to secure access to the user's computer that was used to encrypt the drive: there is a possibility that the computer still has the "spare key" file stored on its hard drive, assuming the user has the selected the option to create such a file when encrypting the drive.
Attacks
If the "spare key" file for the encrypted drive has not been obtained, then the only option for acquiring the content of a dismounted USBCrypt drive is to do a brute-force password guessing attack. USBCrypt software itself contains a built-in command to perform the brute-force attack on the drives it encrypts.
External Links
Official website
USBCrypt website
Prefetch xml -
A Prefetch file is used by Windows NT to improve the startup process of an application. Each prefetch file provides information about each ran application.
XML Example
<?xml version='1.0' encoding='ISO-8859-1'?> <prefetch> <header> <os>Windows 7</os> <header_size>240</header_size> <filename>ACRORD32INFO.EXE</filename> <runs>3</runs> <atime>2011-02-07T12:24:52</atime> </header> <volume> <path>/DEVICE/HARDDISKVOLUME1</path> <serial_number>b46f6927</serial_number> </volume> <creation>2010-08-18T06:13:10</creation> <filenames> <file>/DEVICE/HARDDISKVOLUME1/WINDOWS/SYSTEM32/NTDLL.DLL</file> <file>/DEVICE/HARDDISKVOLUME1/WINDOWS/SYSTEM32/KERNEL32.DLL</file> <file>/DEVICE/HARDDISKVOLUME1/WINDOWS/SYSTEM32/APISETSCHEMA.DLL</file> <file>/DEVICE/HARDDISKVOLUME1/WINDOWS/SYSTEM32/KERNELBASE.DLL</file> <file>/DEVICE/HARDDISKVOLUME1/WINDOWS/SYSTEM32/LOCALE.NLS</file> <file>/DEVICE/HARDDISKVOLUME1/WINDOWS/SYSTEM32/ADVAPI32.DLL</file> <file>/DEVICE/HARDDISKVOLUME1/WINDOWS/SYSTEM32/MSVCRT.DLL</file> <file>/DEVICE/HARDDISKVOLUME1/WINDOWS/SYSTEM32/SECHOST.DLL</file> <file>/DEVICE/HARDDISKVOLUME1/WINDOWS/SYSTEM32/RPCRT4.DLL</file> <file>/DEVICE/HARDDISKVOLUME1/WINDOWS/WINSXS/X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4927_NONE_D08A205E442DB5B5/MSVCR80.DLL</file> <file>/DEVICE/HARDDISKVOLUME1/PROGRAM FILES/ADOBE/READER 9.0/READER/ACRORD32INFO.EXE</file> <file>/DEVICE/HARDDISKVOLUME1/PROGRAM FILES/ADOBE/READER 9.0/READER/ACRORD32.DLL</file> <file>/DEVICE/HARDDISKVOLUME1/WINDOWS/SYSTEM32/WININET.DLL</file> <file>/DEVICE/HARDDISKVOLUME1/WINDOWS/SYSTEM32/SHLWAPI.DLL</file> <file>/DEVICE/HARDDISKVOLUME1/WINDOWS/SYSTEM32/GDI32.DLL</file> </filenames> <dirnames> <dir>\DEVICE\HARDDISKVOLUME1\PROGRAM FILES\MSN TOOLBAR</dir> <dir>\DEVICE\HARDDISKVOLUME1\PROGRAM FILES\MSN TOOLBAR\PLATFORM</dir> <dir>\DEVICE\HARDDISKVOLUME1\PROGRAM FILES\MSN TOOLBAR\PLATFORM\6.3.2348.0</dir> <dir>\DEVICE\HARDDISKVOLUME1\PROGRAM FILES\WINDOWS LIVE</dir> <dir>\DEVICE\HARDDISKVOLUME1\PROGRAM FILES\WINDOWS LIVE\COMPANION</dir> <dir>\DEVICE\HARDDISKVOLUME1\PROGRAM FILES\WINDOWS LIVE\COMPANION\EN</dir> <dir>\DEVICE\HARDDISKVOLUME1\PROGRAM FILES\WINDOWS LIVE\INSTALLER</dir> <dir>\DEVICE\HARDDISKVOLUME1\PROGRAM FILES\WINDOWS LIVE\SHARED</dir> <dir>\DEVICE\HARDDISKVOLUME1\PROGRAMDATA</dir> <dir>\DEVICE\HARDDISKVOLUME1\PROGRAMDATA\MICROSOFT</dir> <dir>\DEVICE\HARDDISKVOLUME1\PROGRAMDATA\MICROSOFT\SEARCH ENHANCEMENT PACK</dir> <dir>\DEVICE\HARDDISKVOLUME1\PROGRAMDATA\MICROSOFT\SEARCH ENHANCEMENT PACK\SEANOTE</dir> <dir>\DEVICE\HARDDISKVOLUME1\PROGRAMDATA\MICROSOFT\SEARCH ENHANCEMENT PACK\SEARCH BOX EXTENSION</dir> <dir>\DEVICE\HARDDISKVOLUME1\PROGRAMDATA\MICROSOFT\SEARCH ENHANCEMENT PACK\SEARCH HELPER</dir> <dir>\DEVICE\HARDDISKVOLUME1\USERS</dir> </dirnames> </prefetch> 
See Also
Prefetch
Libbde -
The libbde package contains a library and applications to read the BitLocker Disk Encryption (bde) volumes.
Tools
The libbde package contains the following tools:
bdeinfo, which shows information about BDE Volumes.
bdemount, which FUSE mounts BDE Volumes.
History
Libbde was created by Joachim Metz in 2011.
External Links
Project site
Building (libbde and tools) from source
Mounting a BitLocker encrypted volume
Libsmdev -
The libsmdev package contains a library and applications to read storage media devices.
History
Libsmdev was created by Joachim Metz in 2010, while working for Hoffmann Investigations. Libsmdev is a rewrite of earlier work for the proof-of-concept multi-threaded imager: GNOME Forensic Imager.
Tools
The libsmdev package contains the following tools:
smdevinfo, which shows information about a storage media device
The libsmdev package also contains the following bindings:
pysmdev, bindings for Python.
External Links
Project site