Stuff

Using RegRipper
Russ McRee let me know recently that the folks at Passmark recently posted a tutorial on how to use their OSForensics tool with RegRipper.

Speaking of RegRipper, I was contacted not long ago about setting up a German mirror for RegRipper...while it doesn't appear to active yet, the domain has been set aside, and I'm told that the guys organizing it are going to use it not only as a mirror, but also as a site for some of the plugins they'll be getting in that are specific to what they've been doing.

If you're into GenToo Linux, there's also this site from Stefan Reimer which contains a RegRipper ebuild for that platform.

Updated tool:  Stefan over on the Win4n6 Yahoo group tried out the Jump List parser code and found out that, once again, I'd reversed two of the time stamps embedded in the LNK file parsing code.  I updated the code and reposted the archive.  Thanks!

Meetups
With respect to the NoVA Forensics Meetups, I posted here asking what folks thought about moving them to the DFIROnline meetups, and I tweeted something similar.  Thus far, I have yet to receive a response from the blog post, and of the responses I've seen on Twitter, the vast majority (2 or 3..I've only seen like 4 responses...) indicate that moving to the online format is just fine.  I did receive one response from someone who seems to like the IRL format...although that person also admitted that they haven't actually been to a meetup yet.

So...it looks like for 2012, we'll be moving to the online format.  Looking at the lineup thus far, we already seem to be getting some good presentations coming along in the near future.

Speaking of which, offering to either give a presentation or asking for some specific content to be presented on is a great way to contribute to the community.  Just something to keep in mind...if you're going to say, "...I'd like to hear about this topic", be prepared to engage in a discussion.  This isn't to say that someone's going to come after you and try to belittle your idea...not at all.  Instead, someone willing to present on the topic may need more information about your respective, what you've tried (if anything), any research that you've already done, etc.  So...please be willing to share ideas of what you'd like to see presented, but keep in mind that, "...what do you mean by that?" is NOT a slam.

New Tools
File this one under "oh, cr*p..."...

Seems setmace.exe has been released...if you haven't seen this yet, it apparently overcomes some of the issues with timestomp.exe; in particular, it is reportedly capable of modifying the time stamps in both the $STANDARD_INFORMATION and the $FILE_NAME attributes within the MFT.  However, it does so by creating a randomly-named subdirectory within the same volume, copying the file into the new directory, and then copying it back (Note: the description on the web page uses "copy" and "move" interchangeably).

Okay, so what does this mean to a forensic analyst, if something like this is used maliciously?  I'm going to leave that one to the community...

The folks at SimpleCarver have released a new tool to extract contents from the CurrentDatabase_327.wmdb file, a database associated with the Windows 7 Windows Media Player.   If you're working an exam that involves the use of WMP (i.e., you've seen the use of the application via the Registry and/or Jump Lists...), then you may want to consider taking a look at this tool.

You might also want to check out some of their other free tools.

Melissa posted to her blog regarding a couple of interesting tools for pulling information from memory dumps; specifically, pdgmail and Skypeex.  Both tools apparently require that you run strings first, but that shouldn't be a problem...the cost-benefit analysis seems to indicate that it's well worth running another command line tool.  An alternative to running these tools against a memory dump would be using Volatility or the MoonSols Windows Memory Toolkit to convert a hibernation file to a  raw dump format, and then run these tools.

Speaking of tools, Mike posted a list of non-forensics tools that he uses on Windows systems to his WriteBlocked blog.  This is a very good list, with a lot of useful tools (as well as tools I've used) on that list.  I recently used Wireshark to validate some network traffic...another tool that you might consider using alongside Wireshark is NetworkMiner...it's described as an NFAT tool, so I can see why it's not on Mike's list.  I use VirtualBox...I have a copy of the developer's build of Windows 8 running in it.

Wiping Utilities
Claus is back, and this time has a nice list of wiping utilities.  As forensic analysts, many times we have to sanitize the media that we're using, so having access to these tools is a very good thing.  I've always enjoyed Claus's posts, as well, and hope to see him posting more and more often in 2012.

Can anyone provide a technical reason why wiping with 7 passes (or more) is "better" than wiping with just 1 pass?

File Formats
I was reading over Yogesh Khatri's posts over at SwiftForensics.com, and found this post on IE RecoveryStore files.  Most analysts who have done any work with browser forensics are aware of the value of files that allow the browser to recover previous sessions...these resources can hold a good deal of potentially valuable data.

About halfway down the post, Yogesh states:

All files are in the Microsoft OLE structured storage container format.

That's awesome...he's identified the format, which means that we can now parse these files.  Yogesh mentions free tools, and one of the ones I like to use to view the contents of OLE files is MiTeC's SSV, as it not only allows me to view the file format and streams, but I can also extract streams for further analysis. 

Another reason I think that this is cool is that I recently released the code I wrote to parse Windows 7 Jump Lists (I previously released code to parse Win7 Sticky Notes), and the RecoveryStore files follow a similar basic format.  Also, Yogesh mentions that there are GUIDs within the file that include 60-bit UUID v1 time stamps...cool.  The Jump List parser code package includes LNK.pm, which includes some Perl code that I put together to parse these artifacts! 

I don't have, nor do I have access to at this time, any RecoveryStore files to work with (with respect to writing a parser)...however, over time, I'm sure that the value of these artifacts will reach a point such that someone writes, or someone contributes to writing, a parser for these files.
  

Meetup

Last night's meetup was a great success!  Sam not only gave a great presentation, he also peppered the audience with some amazing card tricks!  Sam really knows how to deliver on not only the technical information, but also with the magic, and did a great job of keeping everyone entertained on both fronts.  Yes, Sam is an accomplished magician. 

Copies of the slides for Sam's presentation are posted to the NoVA4n6Meetup and Win4n6 Yahoo groups.

I ended up taking notes on my iPhone (using the Notepad app), but here are a couple of take-aways that I had from the presentation:

- I really liked the way Sam broke down and categorized the whole process through visualization.  The third slide of the presentation has a "tool analysis pyramid" (it also appeared later in the presentation)...maybe a better title would be "tool-analysis pyramid".  Based on the work that I've done on the Windows side of things, I really like how Sam broke things down into easy-to-understand categories, which has the effect of making it much easier to communicate your findings, thoughts or needs to others that also understand the framework.

- "Supported means supported."  Depending on the equipment or software you have, and the device, "supported" can mean different things.

- Sam programs in Perl.  Uh...that's the most awesome thing.  EVER.  If you find yourself doing something over and over again, automation is a wonderful thing.  It's also a force multiplier...someone like Sam can write something useful, and someone else who understands the issue and Perl can leverage what Sam did, reducing the time it takes to reach that same level of understanding and effectiveness.

- Sam runs races.  I've run some similar distances as what Sam runs, but that was 20 years ago.  I'd be honored if Sam were to come out and run the Tough Mudder with me...we'll have to see what the future holds.  Maybe I'll have to go out ahead of him and leave either some old cell phones or some antique decks of playing cards along the route...  ;-)

Overall, 32 attendees was a great showing...I thank everyone who braved the weather to come out and see Sam, and I hope that everyone had a great time.  And I wanted to thank Sam for taking the time to put together a wonderful presentation, as well as to come out and give that presentation to all of us.  Many of us have families and other commitments, and I for one greatly appreciate the time and effort that Sam, as well as our other presenters, have taken to put materials together and get up in front of their peers.

Online DFIR Meetups
Back when I attended (and presented at) PFIC 2011, I had a chance to talk to Mike Wilkinson, an instructor in digital forensics at Champlain College.  Mike decided to start online DFIR meetups via his Adobe Connect Meeting Room. The first meetup is on Thu, 15 Dec 2011 at 8pm EST.  Be sure to have Adobe Flash installed on your system, and come join us.  I did see a request that Mike record the meetups...I hope that this ends up being the case.

NoVA Forensics Meetup

Reminder - our next NoVA Forensics Meetup is Wed, 2 Nov 2011...same Bat-time, same Bat-place.

Drop me an email or comment here if you're interested in meeting for a warm up at or just before 6pm.

NoVA Forensic Meetup

Last night's meetup went very well!  I'd like to thank Brian Rydstrom for providing a very good presentation on Mobile Forensics...I don't do any forensics of mobile devices, so I found the information very valuable.

I'd also like to thank everyone who showed up last night.  Attendance was very good...we had about 28 people show up, and a lot of interaction and questions.  Per usual, we had a couple of core regulars, as well some new folks who took time out to stop by.

So, Mitch Harris has graciously offered to provide part 2 of his botnets presentation ("Botnets 201") next month (Nov), and Sam Brothers is still on-board to provide December's presentation on "Mobile Forensics".  We also had a request for a presentation on SSD forensics, as well as someone who offered to give such a presentation early next year (TBD).  I did find this blog post that discusses SSDs.

We had a couple of additional requests last night, as well.  One was for something a bit more hands-on...I'm sure that we could do something like that.  Brian offered to set up a LinkedIn group for the meetup, so that folks could see a bit more about the professional backgrounds of the other attendees.  We're also looking for something more stable for providing announcements and copies of presentations...seems that Yahoo groups aren't for everyone.

The other request was for something along the lines of "gorilla forensics", or perhaps more appropriately "Sniper Forensics".  I don't think I want to steal Chris's thunder (not that I could if I tried...), but maybe we can come up with something along the lines of "the essentials of DF investigations".  I think that this would end up being an interesting discussion, particularly when it comes to the topic of maintaining case notes.

Again, thanks to everyone who was able to make it last night, and thanks to the ReverseSpace guys for hosting us.

NoVA Forensics Meetup Reminder

Just a quick reminder that the next NoVA Forensics Meetup will be Wed, 5 Oct 2011.  Time and location remains the same.  We're planning to have a presentation on mobile forensics.

NoVA Forensics Meetup Group

Based on some advice from a friend, I set up a NoVA 4n6 Yahoo Group.  I've updated the blog page with the information, but will be posting information about location, meeting times, etc., to this group.  This will also provide us with a place for folks to upload files (i.e., presentations, etc.), ask questions, continue discussions, etc.

Also, I've received comments from folks who've indicated that it's far too difficult to find information regarding the meetups, so I wanted to put everything in one place...or one more place...because what we want to do is grow the meetup group, not make it a right of passage just trying to find the place. 

Thanks.