When is powerpoint file not a powerpoint file?

Dear Reader,

    Today we will not discuss OWA again. Rather we will discuss a peculiar case of a temporary file that lead into a journey of discovery into Microsoft internals.

I was working a case Lockheed Martin v L-3, et al (6:05-cv-1580-Orl-31KRS), which has since settled, which involved amongst other things several files that were contained on a CDROM and accessed on a laptop. On this CDROM were lots of files and one of the issues in the case revolved around which if any of those files had been accessed on the laptop showing which information may have been exposed and/or transferred to the rest of the company.

So like a good computer forensic investigator I reviewed all of the recently used registry entries, the lnk files and the user assist records regarding any of the files known to have come from that CD. One of the files in particular had an extension of 'shs'. 'shs' files are scrap files made when a user is copy and pasting items such as powerpoint slides, in this case it was a powerpoint slide. So I found the entries referencing that this specific shs file, which when loaded into powerpoint is a single slide, was accessed on three occasions. At times corresponding to these accesses I found a temporary file on the desktop that contained keywords relevant to the case and appeared by content to be a powerpoint document but no matter what tool I used it would not open it. All of my file signature tools regarded the file as 'data' with no specific file type.

The opposing investigator had the system this CD was burned form and thus had one significant advantage over me, he knew that the temporary file was related to the scrap file contained on the CD. Sure enough when I renamed this temporary file that no tool regarded as anything to an extension of 'shs' it opened up right away in powerpoint revealing the same slide as contained in the shs file on the CDROM. This left the question, how did this file get created on desktop?

So I keep reiterating the CDROM for a reason, normally when temporary files are created in office documents they are created in the same directory as the file you are working with. When you are working on a file in a read only directory, like a CDROM, it will instead create the temporary file on the desktop. So mystery of why the file exists solved! We already knew the scrap file was accessed and now we have corresponding temporary files to show that on the desktop.

The opposing expert was not deterred so easily, he pointed out that the temporary file sh60.tmp had the numeric 60 in it meaning in his opinion that it had in fact been accessed many more times than 2 since the 60 is actual hex for 96 so he claimed it was accessed approximately 95 times. This would a very large amount of accesses for a single powerpoint slide no matter what the contents so I was skeptical. We did some research to determine what creates the temporary file and found out it was a shared Microsoft library that many, many applications use including the application of hotfixes and service packs. Each time a temporary file is created by anything that uses this shared temporary file library the counter is incremented thus explaining how we had such huge jumps between our temporary files left on the desktop and the discrepancy of the offset to the number of times the rest of the forensic artifacts showed the file being accessed.

So the morale of the story is, sometimes a temporary file isn't just a temporary file so be careful out there and always test your assumptions. In this case both myself for assuming the temporary file was just a temporary file and the opposing expert for assuming that nothing else would change the counter on the temporary file got to learn an important lesson.

Using OWA logs to make your civil case

Hello Readers,

   
I will not be talking about OWA every time.

 In our prior time together we discussed parsing OWA logs to determine who has been accessing someone else's account. For criminal prosecution (unauthorized access) or internal investigations this might be enough, but for investigations involving the civil court system you need to show that the information accessed and the time they accessed it corresponds to some claim such as tortuous interference.

The same OWA logs we looked at last time will allow you to do this, with some caveats. When you see a single entry to access an item such as:

" /exchange/USA/Attach/read.asp?obj=000000007C6A5AC4439BD948B2EDEC2B4701083907007DC649E6901ED711982E0002B3A2389C000000C0411400007DC649E6901ED711982E0002B3A2389C0000013340B20000&att=ATT-0-C9D9D5C63632DD439C1AF3C6A4B4AF8A-TOD9D1%7E1.PPT"

This is a request to open up an email attachment, the obj show here in the query is a unique identifier for the item within the exchange database. This means that if you replay that url while, and this is important, logged in as that user you will be able to bring up the exact same message that was viewed at that time (If it was not deleted). If you attempt to access this object while logged in as any other user it will deny you, even if you login as the administrator. If you want to make sure the messages exist (meaning not deleted) restore the exchange server from a backup tape referring to the time period the message we viewed and replay it to the restored server.

 

These are the following asp pages that can be called by an OWA user according to about two years worth of logs from one case I worked:

/exchange/USA/LogonFrm.asp

/exchange/USA/root.asp

/exchange/USA/Navbar/nbInbox.asp

/exchange/USA/inbox/main_fr.asp

/exchange/USA/inbox/peerfldr.asp

/exchange/USA/inbox/title.asp

/exchange/USA/inbox/messages.asp

/exchange/USA/inbox/commands.asp

/exchange/USA/forms/IPM/NOTE/frmRoot.asp

/exchange/USA/forms/IPM/NOTE/read.asp    

/exchange/USA/logoff.asp

/exchange/USA/Attach/read.asp

/exchange/USA/logon.asp

/exchange/USA/forms/IPM/NOTE/commands.asp

/exchange/USA/forms/IPM/NOTE/cmpTitle.asp

/exchange/USA/forms/IPM/NOTE/cmpMsg.asp

/exchange/USA/errinbox.asp

/exchange/USA/forms/IPM/SCHEDULE/MEETING/RESP/frmRoot.asp

/exchange/USA/forms/IPM/SCHEDULE/MEETING/RESP/read.asp

/exchange/USA/forms/IPM/SCHEDULE/MEETING/RESP/commands.asp

/exchange/USA/options/set.asp

/exchange/USA/calendar/main_fr.asp

/exchange/USA/calendar/title.asp

/exchange/USA/calendar/events.asp

/exchange/USA/calendar/appts.asp

/exchange/USA/calendar/pick.asp

/exchange/USA/forms/IPM/SCHEDULE/MEETING/REQUEST/frmRoot.asp

/exchange/USA/forms/IPM/SCHEDULE/MEETING/REQUEST/mrread.asp

/exchange/USA/forms/IPM/SCHEDULE/MEETING/REQUEST/commands.asp

/exchange/USA/contacts/main_fr.asp

/exchange/USA/contacts/title.asp

/exchange/USA/contacts/peerfldr.asp

/exchange/USA/contacts/messages.asp

/exchange/USA/contacts/commands.asp

/exchange/USA/finduser/root.asp

/exchange/USA/finduser/fumid.asp

/exchange/USA/finduser/fumsgdef.asp

/exchange/USA/finduser/fumsg.asp

/exchange/USA/finduser/details.asp

/exchange/USA/forms/REPORT/DR/frmRoot.asp

/exchange/USA/tshoot.asp

 

Of these we care about the following:

This is a user logging in - /exchange/USA/LogonFrm.asp

This is a user requesting to read a specific message - /exchange/USA/forms/IPM/NOTE/read.asp

This is a user opening an attachment - /exchange/USA/Attach/read.asp

This is a user composing a new message - /exchange/USA/forms/IPM/NOTE/cmpMsg.asp

This is a user reading a message request - /exchange/USA/forms/IPM/SCHEDULE/MEETING/REQUEST/mrread.asp

 

If you parsed our just these commands identified by the logged in user you could see what specific emails, meetings, and attachments a webmail user had viewed, created, sent using OWA and the time on which they did. Using these times and matching the ip address to the suspect you can then combine the information accessed, to the time it was accessed, to the benefit they received by having that information at that time.

 

As an example, in the case Exel Transporation Services Inc v. Total Transportation Services LLC et al (3:06-cv-00593) I used this to uncover a large industrial espionage case. First I used the program in the prior post to find which accounts were being used to access other email accounts in the system. Then I looked up the IP Addresses and found out one of them was actually registered to one of the ex-executives of exel directly on ARIN. We then broke out just the accesses used by those accounts (I mean really why else would the blackberry server administrative account or the voicemail server be logging into a website .. something we had to explain to counsel) into a database divided up by type of item accessed (email, attachment, calendar).

 

The next part was more difficult, we had to replicate their exchange network, AD controller, etc.. to restore their exchange server backups and replay those months to find out what our suspects were viewing. This included almost every decision maker within exel and according to the filings I read about $120 million dollars in lost business as they were able to read the contracts sent to customers during a bidding process and always beat them. We fed the urls into a GUI automation tool that would interact with the web browser and save the emails and attachments into MHT (full website archive) files for the lawyers review. I couldn't within the time frame get a pure perl program to work the way I needed it to.

 

For more information read this news article:

http://www.bizjournals.com/memphis/stories/2006/08/21/daily30.html

 

The case was settled out of court with a public apology written by TTS. The final stone in my understanding that led to settlement was when we matched the TTS OWA logs to the Exel OWA logs and showed the suspects logged into the TTS server with their real user name, with the same ip and at the same date/time, as they were logged into the Exel OWA server with their administrative accounts.

 

I hope this was useful, I can post parsers I wrote if you think it would help you in the future.

 

 

The Fun Continues

2009 Soiled Sport Trail Series

Start Times: 8:00 am sharp
(or maybe 8:02 because Cathy Q is late again)

OUS race start times, you need to confirm for each race @ http://www.ouser.org/

May 16th,
Meadowlilly Trails


May 23 rd
Komoka Trails
or
Ontario Ultra Series Race #4
Sulphur Springs 10K, 25K, 50K, 50M, 100M

May 30th
Medway Trails

June 6th
Fanshawe Trails
or
OUS Series Race #5
Kingston 6hour endurance race

June 13th
Westminister Ponds
or
There is a new trail race, http://www.trailsdaywoodstock.ca/
1 Mile, 5K, 1/2 marathon
*Trail points ONLY if you wear Vulture Bait or Soiled Sport running shirts during the event

June 20th
Kains Woods
or
OUS Race #6
Niagara Ultra 1/2 marathon, marathon & 50k

June 27th
Medway Trail

July 4th
Medowlilly Trai
or
OUS Race #7
Creemore Vertical Challenge (please note the word Vertical.. this means hills, long never ending hills)

July 11th
Gibbons Park Trail

July 18th
Killaly Trail

July 25th
Komoka Trail

August 1st
Fanshawe Trail

Margarine and Phytosterolemia

Margarine is one of my favorite foods. To rip on. It's just so easy!

The body has a number of ways of keeping bad things out while taking good things in. One of the things it likes to keep out are plant sterols and stanols (phytosterols), cholesterol-like molecules found in plants. The human body even has two enzymes dedicated to pumping phytosterols back into the gut as they try to diffuse across the intestinal lining: the sterolins. These enzymes actively block phytosterols from passing into the body, but allow cholesterol to enter. Still, a little bit gets through, proportional to the amount in the diet.

As a matter of fact, the body tries to keep most things out except for the essential nutrients and a few other useful molecules. Phytosterols, plant "antioxidants" like polyphenols, and just about anything else that isn't body building material gets actively excluded from circulation or rapidly broken down by the liver. And almost none of it gets past the blood-brain barrier, which protects one of our most delicate organs. It's not surprising once you understand that many of these substances are bioactive: they have drug-like effects that interfere with enzyme activity and signaling pathways. For example, the soy isoflavone genistein abnormally activates estrogen receptors. Your body does not like to hand over the steering wheel to plant chemicals, so it actively defends itself.

A number of trials have shown that large amounts of phytosterols in the diet lower total cholesterol and LDL. This has led to the (still untested) hypothesis that phytosterols lower heart attack risk. The main problem with this hypothesis is that although statin drugs do lower LDL and heart attack risk, not all interventions that lower LDL lower risk.  LDL plays an important role in heart attack risk, but it's not the only factor.  Statins have a number of biological effects besides lowering LDL, and some of these probably play a role in its ability to protect against heart attacks.

Lowering total cholesterol and LDL through diet and drugs other than statins does not reliably reduce mortality in controlled trials. Decades of controlled diet trials showed overall that replacing saturated fat with polyunsaturated vegetable oil lowers cholesterol, lowers LDL, but doesn't reliably reduce the risk of cardiovascular disease. Soy contains a lot of phytosterols, which is one of the reasons it's heavily promoted as a health food.

All right, let's put on our entrepreneur hats. We know phytosterols lower cholesterol. We know soy is being promoted as a healthier alternative to meat. We know butter is considered a source of artery-clogging saturated fat. I have an idea. Let's make a margarine that contains a massive dose of phytosterols and market it as heart-healthy. We'll call it Benecol, and we'll have doctors recommend it to cardiac patients.

Here are the ingredients:

Liquid Canola Oil, Water, Partially Hydrogenated Soybean Oil, Plant Stanol Esters, Salt, Emulsifiers, (Vegetable Mono- and Diglycerides, Soy Lecithin), Hydrogentated Soybean Oil, Potassium Sorbate, Citric Acid and Calcium Disodium EDTA to Preserve Freshness, Artificial Flavor, DL-alpha-Tocopheryl Acetate, Vitamin A Palmitate, Colored with Beta Carotene.

Nice.

And I haven't even gotten to the best part yet. There's a little disorder called phytosterolemia that may be relevant here. These patients have a mutation in one of their sterolin genes that allows phytosterols (including stanols) to pass into their circulation more easily. They end up with 10-25 times more phytosterols in their circulation than a normal individual. What kind of health benefits do these people see? Premature atherosclerosis, an early death from heart attacks, abnormal accumulation of sterols and stanols in the tendons, and liver damage.

Despite the snappy-looking tub, margarine is just another industrial food-like substance that I am highly suspicious of. In the U.S., manufacturers can put the statement "no trans fat" on a product's label, and "0 g trans fat" on the nutrition label, if it contains less than 0.5 grams of trans fat per serving. A serving of Benecol is 14 grams. That means it could be up to 3.5 percent trans fat and still labeled "no trans fat". This stuff is being recommended to cardiac patients.

When deciding whether or not a food is healthy, the precautionary principle is in order. Margarine is a food that has not withstood the test of time. Show me a single healthy culture on this planet that eats margarine regularly. Cow juice may not be as flashy as the latest designer food, but it has sustained healthy cultures for generations. The U.S. used to belong to those ranks, when coronary heart disease was rare.

Latest Study on Vitamin K and Coronary Heart Disease

A Dutch group led by Dr. Yvonne T. van der Schouw recently published a paper examining the link between vitamin K intake and heart attack (thanks Robert). They followed 16,057 women ages 49-70 years for an average of 8.1 years, collecting data on their diet and incidence of heart attack.

They found no relationship between K1 intake and heart attack incidence. K1 is the form found in leafy greens and other plant foods. They found that each 10 microgram increase in daily vitamin K2 consumption was associated with a 9% lower incidence of heart attack. Participants consumed an average of 29 micrograms K2 per day, with a range of 0.9 to 128 micrograms. That means that participants with the highest intake had a very much reduced incidence of heart attack on average. Vitamin K2 comes from animal foods (especially organs and pastured dairy)and fermented foods such as cheese, sauerkraut, miso and natto. Vitamin K is fat-soluble, so low-fat animal foods contain less of it. Animal foods contain the MK-4 subtype while fermentation produces longer menaquinones, MK-5 through MK-14.

There's quite a bit of evidence to support the idea that vitamin K2 inhibits and possibly reverses arterial calcification, which is possibly the best overall measure of heart attack risk. It began with the observations of Dr. Weston Price, who noticed an inverse relationship between the K2 MK-4 content of butter and deaths from coronary heart disease and pneumonia in several regions of the U.S. You can find those graphs in Nutrition and Physical Degeneration.

The 25% of participants eating the most vitamin K2 (and with the lowest heart attack risk) also had the highest saturated fat, cholesterol, protein and calcium intake. They were much less likely to have elevated cholesterol, but were more likely to be diabetic.

Here's where the paper gets strange. They analyzed the different K2 subtypes individually (MK-4 through MK-9). MK-7 and MK-6 had the strongest association with reduced heart attack risk per microgram consumed, while MK-4 had no significant relationship. MK-8 and MK-9 had a weak but significant protective relationship.

There are a few things that make me skeptical about this result. First of all, the studies showing prevention/reversal of arterial calcification in rats were done with MK-4. MK-4 inhibits vascular calcification in rats whereas I don't believe the longer menaquinones have been tested. Furthermore, they attribute a protective effect to MK-7 in this study, but the average daily intake was only 0.4 micrograms! You could get that amount of K2 if a Japanese person who had eaten natto last week sneezed on your food. I can't imagine that amount of MK-7 is biologically significant. That, among other things, makes me skeptical of what they're really observing.

I'm not convinced of their ability to parse the effect into the different K2 subtypes. They mentioned in the methods section that their diet survey wasn't very accurate at estimating the individual K2 subtypes. Combine that with the fact that the K2 content of foods varies quite a bit by animal husbandry practice and type of cheese, and you have a lot of variability in your data. Add to that the well-recognized variability inherent in these food questionnaires, and you have even more variabiltiy.

I'm open to the idea that longer menaquinones (K2 MK-5 and longer, including MK-7) play a role in preventing cardiovascular disease, but I don't find the evidence sufficient yet. MK-4 is the form of K2 that's made by animals, for animals. Mammals produce it in their breast milk and other animals produce it in eggs all the way down to invertebrates. I think we can assume they make MK-4, and not the longer menaquinones, for a reason.

MK-4 is able to play all the roles of vitamin K in the body, including activating blood clotting factors, a role traditionally assigned to vitamin K1. This is obvious because K2 MK-4 is the only significant source of vitamin K in the diet of infants before weaning. No one knows whether the longer menaquinones are able to perform all the functions of MK-4; it hasn't been tested and I don't know how you could ever be sure. MK-7 is capable of performing at least some of these functions, such as activating osteocalcin and clotting factors.

I do think it's worth noting that the livers of certain animals contain longer menaquinones, including MK-7. So it is possible that we're adapted to eating some of the longer menaquinones. Many cultures also have a tradition of fermented food (probably a relatively recent addition to the human diet), which could further increase the intake of longer menaquinones. The true "optimum", if there is one, may be to eat a combination of forms of K2, including MK-4 and the longer forms. But babies and healthy traditional cultures such as the Masai seem to do quite well on a diet heavily weighted toward MK-4, so the longer forms probably aren't strictly necessary.

Well if you've made it this far, you're a hero (or a nerd)! Now for some humor. From the paper:

The concept of proposing beneficial effects to vitamin K2 seems to have different basis as for vitamin K1. Vitamin K1 has been associated with a heart-healthy dietary pattern in the earlier work in the USA and this attenuated their associations with CHD. Vitamin K2 has different sources and relate to different dietary patterns than vitamin K1. This suggests that the risk reduction with vitamin K2 is not driven by dietary patterns, but through biological effects.

They seem confused by the fact that people who ate foods high in saturated fat and cholesterol had less CHD, yet people consuming green vegetables didn't.  Here's more:

Thus, although our findings may have important practical implications on CVD prevention, it is important to mention that in order to increase the intake of vitamin K2, increasing the portion vitamin K2 rich foods in daily life might not be a good idea. Vitamin K2 might be, for instance more relevant in the form of a supplement or in low-fat dairy. More research into this is necessary.

Translation: "People who ate the most cheese, milk and meat had the lowest heart attack rate, but be careful not to eat those things because they might give you a heart attack. Get your K2 from low-fat dairy (barely contains any) and supplements."