Hello Reader,
Friday's Forensic Lunch is looking pretty good so far, our first confirmed guest this week is Harlan Carvey. Click the link above to RSVP and receive reminders and notification on when the stream begins at noon CST (GMT -5) so you can watch live and ask questions.
Within the post I make heavy use of FTK Imager and TZ Works tools mainly because for me its a fast and convenient way to triage a forensic image to determine what occurred. You can use any other tool and come to the same results I did. If you find additional artifacts of interest please leave a comment as I'm only covering those I think most relevant to the challenge.
Let's continue our analysis of the Sunday Funday 9/15/13 forensic image. Today let's talk about what we can determine was copied to the external drives found in the forensic image. If you read the answer key from last week, you know that three files were copy and pasted to one external drive. Of those files only one was accessed. So knowing this I exported the following user data to find evidence of files on the external device:
1. Lnk Files
Remember in Windows 7 the default location for a user's LNK files is no longer %user home%\recent it's now \users\\appdata\roaming\microsoft\windows\recent. In the case of our suspect image its located under \users\suspect\appdata\roaming\microsoft\windows\recent as seen below:
There are a lot of LNK parsers out there, I used the TZWorks lnk file parser. Which reveals the following file accessed from the E: Drive with volume serial number ba95-34d6:
With a creation date of 8/31/13 00:53:48 UTC which reflects the time the file was copied onto the external media.
2. Jump lists
Next I exported out the two directories that contain the jump lists for this user AutomaticDestinations and CustomDestinations, which are also located under \users\suspect\appdata\roaming\microsoft\windows\recent.
I then parsed the contents of both directories with the TZWorks jump list parser.
In my review of that data I see:
This is the same file found in the LNK files above with the same volume serial number and creation date. It was opened with AppID 2b88af31b31e51e0 which belongs to the Microsoft Word Viewer installed on the suspect system.
3. Index.dat
When files are opened within explorer often times you'll find an index.dat entry associated with them, in this case we find that here as well. I exported out the Index.dat from \users\suspect\appdata\local\microsoft\windows\history\history.IE5
Then parsing the output with TZWorks Index.dat Parser to find the same file again:
at the same time as seen in the prior two sources.
4. Shell bags
Next I exported the USRCLASS.DAT from \users\suspect\appdata\local\microsoft\windows
and parsed it with TZWorks Shell bag parser finding the access an e:\ drive but no underlying directories, as there were none accessed.
Conclusions
So we can conclude that at least one file was copied and accessed from an external drive on 8/31/13, but we cannot determine the total scope of files copied. We know two additional files were copied onto the drive, why can't we see them? The answer is that the system does not record which files are copy and pasted, even in a data transfer between drives. Instead the artifacts only record which data was accessed from the external drive not its total contents.
In many cases our suspect is nice enough to copy large numbers of files and directories after which they access them and make sure they have what they need. This makes for good evidence to prove what was on the drive but still does not fully document what was contained on an external drive. It's at this point that I normally inform counsel of my findings and we begin the legal process to demand the return of this drive to determine the extent of the data copied.
Tomorrow let's do web analysis of this image leading up to another Friday Forensic Lunch!
Friday's Forensic Lunch is looking pretty good so far, our first confirmed guest this week is Harlan Carvey. Click the link above to RSVP and receive reminders and notification on when the stream begins at noon CST (GMT -5) so you can watch live and ask questions.
Within the post I make heavy use of FTK Imager and TZ Works tools mainly because for me its a fast and convenient way to triage a forensic image to determine what occurred. You can use any other tool and come to the same results I did. If you find additional artifacts of interest please leave a comment as I'm only covering those I think most relevant to the challenge.
Let's continue our analysis of the Sunday Funday 9/15/13 forensic image. Today let's talk about what we can determine was copied to the external drives found in the forensic image. If you read the answer key from last week, you know that three files were copy and pasted to one external drive. Of those files only one was accessed. So knowing this I exported the following user data to find evidence of files on the external device:
1. Lnk Files
Remember in Windows 7 the default location for a user's LNK files is no longer %user home%\recent it's now \users\
There are a lot of LNK parsers out there, I used the TZWorks lnk file parser. Which reveals the following file accessed from the E: Drive with volume serial number ba95-34d6:
| {CLSID_MyComputer}\E:\Acme 2013 Budget.rtf |
With a creation date of 8/31/13 00:53:48 UTC which reflects the time the file was copied onto the external media.
2. Jump lists
Next I exported out the two directories that contain the jump lists for this user AutomaticDestinations and CustomDestinations, which are also located under \users\suspect\appdata\roaming\microsoft\windows\recent.
I then parsed the contents of both directories with the TZWorks jump list parser.
In my review of that data I see:
| {CLSID_MyComputer}\E:\Acme 2013 Budget.rtf |
This is the same file found in the LNK files above with the same volume serial number and creation date. It was opened with AppID 2b88af31b31e51e0 which belongs to the Microsoft Word Viewer installed on the suspect system.
3. Index.dat
When files are opened within explorer often times you'll find an index.dat entry associated with them, in this case we find that here as well. I exported out the Index.dat from \users\suspect\appdata\local\microsoft\windows\history\history.IE5
Then parsing the output with TZWorks Index.dat Parser to find the same file again:
| Visited: Suspect@file:///E:/Acme%202013%20Budget.rtf |
at the same time as seen in the prior two sources.
4. Shell bags
Next I exported the USRCLASS.DAT from \users\suspect\appdata\local\microsoft\windows
and parsed it with TZWorks Shell bag parser finding the access an e:\ drive but no underlying directories, as there were none accessed.
Conclusions
So we can conclude that at least one file was copied and accessed from an external drive on 8/31/13, but we cannot determine the total scope of files copied. We know two additional files were copied onto the drive, why can't we see them? The answer is that the system does not record which files are copy and pasted, even in a data transfer between drives. Instead the artifacts only record which data was accessed from the external drive not its total contents.
In many cases our suspect is nice enough to copy large numbers of files and directories after which they access them and make sure they have what they need. This makes for good evidence to prove what was on the drive but still does not fully document what was contained on an external drive. It's at this point that I normally inform counsel of my findings and we begin the legal process to demand the return of this drive to determine the extent of the data copied.
Tomorrow let's do web analysis of this image leading up to another Friday Forensic Lunch!
