Hack Like a Pro: Digital Forensics for the Aspiring Hacker, Part 9 (Finding Storage Device Artifacts in the Registry) « Null Byte :: WonderHowTo

Welcome back, my fledgling hackers!Inthis series, I am trying to develop your knowledge of digital forensics, which is valuable whether you're choosing a career in itorjust want to know how your hacker activity can be traced. Few professional digital forensic investigators have a hacking background, but the best ones do.The occupation of digital forensic investigation is a rapidly growing one. Nearly every crime has a digital component these days. This might include things as innocuous as a text message, a Google search, or an email, and law enforcement and civil litigators need trained professionals to find the necessary information and preserve it in a forensically sound manner.Finding Storage Device Artifacts in a Windows RegistryAs I have mentioned ina previous article in this series, the registry in Windows is how Microsoft manages the operating system. As such, it contains volumes of information on who, what, where, and how activity took place on this system. If we know where and how to look in the registry, we can build a strong case of what actually took place there.In this tutorial, we will focus on finding evidence of storage devices within the registry. Often, the suspect will use a Flash drive or hard drive for their malicious activities and then remove them so as not to leave any evidence. The skilled forensic investigator, though, can still find traces of evidence of those storage devices within the registry, if they know where to look.Image viaShutterstockThe registry on a Windows system varies a bit from version to version. A skilled, professional digital forensic investigator needs to be able to work with nearly all versions of Windows and other operating systems. Since Windows 7 is still the most widely used operating system, by far, I will be demonstrating on it. Keep in mind, though, that this will vary slightly between versions.Step 1: Open RegeditAlthough a forensic investigator will usually be working on an image file and using a forensic suite, we can clearly demonstrate the principals and locations by using regedit on a live system. In some forensic investigations, you might actually have the need or luxury of working on a live system, but it is rare. Usually, you will be using an image, but the registry remains the same whether live or image.To open the Registry Editor, type "regedit" at the command prompt. When you do so, it will open the Registry Editor as seen below.As you remember froma previous tutorial, the registry has five hives.Step 2: USB Storage DevicesImagine a case where we suspect that someone installed a keylogger or removed confidential information with a USB drive. How would we find evidence that a USB storage device was inserted and used? To find evidence of USB storage devices, we want to look at the following key.HK_Local_Machine\System\ControlSet00x\Enum\USBSTORIn this key, we will find evidence ofanyUSB storage device that haseverbeen connected to this system. Expand USBSTOR to see a listing of every USB storage device ever connected to this system.In the screenshot above, I have circled one suspicious looking USB device. When we expand it, it reveals a unique identifier for that device. By clicking on this identifier, we can find much more information about the device.As you can see in the screenshot above, when we click on the USB storage identifier, it reveals in the right-hand window the Global Unique Identifier (GUID), the friendly name, and the hardware ID, among other things. This may be exactly the evidence we need to tie the suspect to their activity on this system!Step 3: Mounted DevicesIf the suspect used any hardware device that must be mounted to either read or write data (CD-ROM, DVD, hard drive, flash drive, etc.), the registry will record the mounted device. This information is stored at:HKEY_LOCAL_MACHINE\System\MountedDevicesAs you can see below, when we click on this key, it provides us a long list of every device ever mounted on that machine.If we need further information on any of those mounted devices, we can simply click on it, and it will open a small app that will enable us to read the data in ASCII. As you can see, this device was an IDE CD-ROM manufactured by Teac.If there is not a TEAC CD_ROM on the system, the forensic investigator now knows that they need to find this piece of hardware to find further evidence of the crime.The registry is a depository of volumes of information on what happened on a Windows system, and by learning our way around it, we can reconstruct the elements of a crime that it was used for.Keep coming back, my aspiring forensic investigators, as we exploremore waysto find evidence of criminal or malicious activity.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viaShutterstockRelatedHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 5 (Windows Registry Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 1 (Tools & Techniques)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 8 (More Windows Registry Forensics)News:Why YOU Should Study Digital ForensicsHack Like a Pro:Digital Forensics Using Kali, Part 1 (The Tools of a Forensic Investigator)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 11 (Using Splunk)How To:The Essential Skills to Becoming a Master HackerNews:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 12 (Windows Prefetch Files)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 7 (Windows Sysinternals)How To:Become a Computer Forensics Pro with This $29 TrainingHack Like a Pro:Digital Forensics Using Kali, Part 2 (Acquiring a Hard Drive Image for Analysis)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 6 (Using IDA Pro)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 2 (Network Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 15 (Parsing Out Key Info from Memory)News:What to Expect from Null Byte in 2015Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 14 (Live Memory Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 10 (Identifying Signatures of a Port Scan & DoS Attack)News:Airline Offers Frequent Flyer Miles to HackersSPLOIT:Forensics with Metasploit ~ ( Recovering Deleted Files )Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 13 (Mounting Drives & Devices)Hack Like a Pro:Digital Forensics Using Kali, Part 3 (Creating Cases in Autopsy & Sleuth Kit)News:You Can Get a OnePlus 7 Pro with INSANE Specs for the Price of theXRor S10eHow To:Why You Should Study to Be a HackerHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 16 (Extracting EXIF Data from Image Files)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 13 (Browser Forensics)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)How To:Track a USB deviceNews:Flawed Laptop Fingerprint Readers Make Your Windows Password Vulnerable to HackersHow To:Complete the Registry of Foundables & Obtain Treasures in Harry Potter: Wizards UniteGoodnight Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsHow To:Don't Get Caught! How to Protect Your Hard Drives from Data ForensicsNews:Day 2 Of Our New WorldCommunity Byte:HackThisSite, Realistic 5 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsGoodnight Byte:HackThisSite Walkthrough, Part 8 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 2 - Legal Hacker TrainingNews:FIX WINDOWS 7 SLOW STARTUP TIMES...