Links

My interview with Lee Whitfield is up as Forensic4Cast episode 17. Lee asked some interesting questions, so be sure to listen to the entire podcast...we talk about some things at the end of the interview that you like to hear.

Chris Pogue, co-author of Unix and Linux Forensic Analysis, has started his own blog...check it out! Chris and I have worked together, and it's good to see him getting into the mix now and bringing his experience and knowledge to the blogosphere, including posting a review of WFA 2/e! Chris will also be at the SANS Forensic Summit, speaking on the IR panel. I'm sure if you asked him, he'd be more than happy to sign your copy of ULFA, which, by the way, Syngress will have table at the Summit with their books available.

Hogfly posted on the Need for Speed, and I really think that this is something that cannot be said enough. While there is a need for speed in response, there's also a need to ensure that things are still done right and still done to a standard of accuracy and quality. Again, though...the need for speed in response is very real. In many cases, you'll have an issue of suspected data leakage or exposure, and acquiring a small number of systems and taking 2 months or more to provide an answer is simply unacceptable, as much or more so than providing the wrong answer too quickly. Processes and techniques need to be addressed, improved and implemented in such a manner as to answer the three most important questions:

1. Was the system compromised?
2. Did the system house or store "sensitive" data?
3. Did #1 lead to the exposure of #2?

Suffice to say that a lot of what it takes to answer these questions rests squarely on the shoulders of the system owners themselves. There's only so much that can be done when the breach goes unnoticed (often, for weeks), and then the first reaction of the on-site staff is to shut the system down and take it off of the network.

Hogfly also posted his review of WFA 2/e...check it out. I like to see what practitioners have to say about the book (or any other resource, for that matter), because who better to have an opinion on something like that than someone who works in the business, right? Seriously. If you wanted to get someone's opinion on, say, the acceleration and handling of a sports car, who would you look to? Eddie, the introvert who reads car magazines (and other things) online, or Danika Patrick?

#1 on Amazon!

Just today, I found out that WFA 2/e is #1 in the Amazon Sales Rank for Forensics books! Awesome! Thanks to everyone who's reviewed the book and to everyone who's purchased a copy of the book!

Buy F-Response, get a free copy of WFA 2/e!

Hey, no kidding! Check it out! Matt's offering a free (as in "beer") copy of WFA 2/e with each purchase or renewel of F-Response CE/EE. Got four consultants? Outfit each of them with a copy of F-Response EE, and they'll each get a copy of WFA 2/e. Sweet! Don't think so? Check out the reviews!

WFA 2/e eBooks

I've received a number of emails regarding ebook versions of WFA 2/e, and at this point, all I've been able to determine is that Elsevier will NOT be producing a PDF version of the book for sale. No, I don't know why, and to be honest, I'm as mystified as you are.

The information I have from the publisher at this time is that it takes about 1-2 months to produce the ebook version of a book, and multiple ebook versions are produced (Kindle, Safari, etc.). I've been told that while a PDF version will not be produced for sale, that there will be a version produced by Ingram (??) that will be available to be read on a computer, and I'm also told that this reader, like Adobe Reader, allows the ebook to be searched. Other than that, I have nothing...I don't even know where to download the reader just to take a look at it. Nor do I know when the ebook will be available in any version, nor how much it will cost.

That's all I have. Pretty amazing, eh? A large publishing firm like Elsevier, and an author such as myself is having trouble getting basic information.

So, all I can say is sorry (although I'm not sure why I'm the one saying that...), and if you really want to let someone know how you feel about this, email my editor...she's graciously consented to accepting your emails. Or stop by the Syngress table at the SANS Forensic Summit and let her know.

Thoughts on Timeline Analysis

I was chatting with Chris Pogue (a fellow Syngress book author attending the SANS Forensic Summit) a bit over the past couple of days on the subject of Timeline Analysis, and had some thoughts that I wanted to throw out there and see what others thought about them...

Personally, I've been doing some pretty cool things with timeline analysis, incorporating not only file system metadata, but Event Log entries, data from the Registry, as well as the user's web browser history, etc. What this does is allow me to view events from several sources all in one place, giving me some context, but not all of the possible context. And this can be a LOT of data! I go through the process of creating a bodyfile, then a 5-field TLN format events file, and then a full timeline in ASCII, saving it in a text file. I've updated some of my code recently to allow me to re-run the events-file-to-timeline conversion tool and focus solely on a specific date range, down to a single day.

This is where we usually start talking about visualization...what's a good way to present this information in a graphic format so that the analyst can determine the answer to the question they're trying to answer? Perhaps better yet...IS there a good way?

When it comes down to presenting the data to the customer, I've never been a supporter of giving the customer all of the raw data (there are folks out there who think a 3300+ page report is a good thing!), and giving the customer a timeline graphic of ALL of the data really doesn't do a whole lot, either for them to understand what's going on, or for your professional credibility. That's where the knowledge and ability of the analyst come in, and you create a timeline that summarizes the important and relevant events for the customer.

So, how do you do this? Do you sift through the data, extracting all of the irrelevant stuff (ie, removing thousands of file last accessed events and replacing them with a single AV scan event, etc.) and dump it into some kind of program that will generate the timeline automatically, or is it something more of a manual process? (See the Resources section at the end of this post for some examples of how to create a graphic representation of a timeline that can be added to reports.)

At this point, I'm of the opinion that this is still largely a manual process. While timeline creation and analysis has been automated to some degree through the use of tools, the fact is that there's currently no automated "sausage grinder" that you can drop an acquired image into and have it chug away and give you a full timeline. Just the file system metadata alone from one system can be cumbersome and overwhelming, particularly if you don't know what you're looking for. Lets say that you automatically add the Event Log entries to the timeline...but what if the Security Registry hive shows that the type of auditing you're looking for (successful login attempts) wasn't enabled, and a scan of the Event Logs shows that the events do not cover the dates in question anyway? If this is an automatic process, you've now got a lot of extra, albeit irrelevant, data.

What about context? Not all context of the events is visible in a timeline...in some cases, a recent modification date on a file isn't as important as what was added (or removed) from the file. Or you may have two events...a USB removable storage device plugged into the system and shortly thereafter, a Windows shortcut/LNK file created...and the valuable context of the correlation between the two events is in the path information and volume ID embedded in the LNK file.

In a way, this discussion brings us back around to the basic idea of the skill and knowledge of the examiner/analyst. Lets say an analyst responds to an incident, and goes on-site to find four desktop systems that had been powered down and taken off of the network. One analyst might look at this, remove the drives, and image them with the pair of Vooms he has in his jump kit. Another might hook each drive up to a write-blocker and acquire logical images of each partition. Yet another responder might boot each system, log in as Administrator, acquire volatile data, and then perform live acquisitions. Given this kind of disparity across a single response, how does an analyst then "correctly" decide which information needs to be included in a timeline for analysis, and then determine the context of the data?

IMHO, this all comes down to training and experience. Training specifically in this topic needs to be available, followed by guidance and mentoring. Cheatsheets need to be available to remind folks about what's available, why and how the data is important, and then within organizations and labs, there needs to be some kind of peer review.

Thoughts?

Resources
How to create a timeline in Excel (free templates)
Free SmartDraw Timeline Software

Very Interesting Developments

I don't often get presented with issues of copyright violation and intellectual property theft, but I did see this one today. It seems someone has set up a blog where they are offering copyrighted ebooks for free, two of which I authored. I also know the authors of several of other offered ebooks.

Folks, one of the big myths about authoring books is that somehow the author gets rich. I'm here to tell you, in this niche market, that just is NOT true at all. If you're that hard up that you need to steal someone else's intellectual property...well, what can I say?

Suffice it to say, this just isn't cool.

SANS Forensic Summit

Folks, let's not forget that the SANS Forensic Summit is coming up! Check out the list of speakers, presentations, and panels...this conference is going to be great!

Also, I spoke to the marketing folks at Syngress, and they are going to have a table at the Summit (graciously provided by Rob Lee) where they're going to have books available. Now, the way cool...no, wait...the WAY COOL thing about this is that several of the authors are also speakers at the Summit! So, if you don't have Chris Pogue's book, get it and get it signed by none other than Chris Pogue himself! Eoghan Casey's going to be there, too!

Finally, I have pristine copies (one each) of Windows Forensic Analysis (first and second editions), as well as Perl Scripting for Windows Security. I am going to bundle all three of them together and provide them as a give-away following my presentation at the conference.

BTW...the presentations from the 2008 SANS Forensic Summit are archived here! Take a look!

PS: I had a meeting yesterday and got there a few minutes early...I was meeting a friend for lunch and took a minute or two to walk through a nearby bookstore. Guess what I saw on the shelf? I'll give you a hint...I went to the Computer section, and was browsing in the area where they keep the books on security and forensics... ;-)

More Links

NetWitness announced on 8 June the availability of NetWitness Insight. This is a very interesting announcement, in part because, IMHO, NetWitness is the premier product available today when it comes to seeing and understanding what's happening on your network. In this case, collection of network traffic isn't the issue...it's the analysis and presentation, and that's where NetWitness products excel. The inclusion of InSight now gives the NetWitness suite of products what appears to be a DLP and vulnerability assessment capability, so that customers can find out where that sensitive data resides, as well as (according to the press release) locate vulnerable systems and prioritize remediation. As an incident responder, this is a fantastic capability...but what's missing is still the host-based response capability. Sounds like a job for F-Response!

I recently heard about a tool called MIR-ROR, put together originally by Troy Larson and then expanded by Russ McRee, both of Microsoft. Russ blogged about it here, and there's a toolsmith article available on it, as well. MIR-ROR is a batch file that is useful for running tools on a system as part of incident response; what I like about this is that Russ isn't sitting back hoping that someone does something like this, he's taking advantage of his knowledge and capabilities to put this together. And he's made it available to the public, along with instructions on how to run it. I like tools like this because they're self-documenting...properly constructed and commented, they serve as their own documentation. As always, the standard caveat applies...use/deploy tools like this as part of an incident response plan. If your plan says you need to acquire a pristine image of the drive first, you will want to consider holding off on using a tool like this...

Didier updated his disitool...I'm not even going to try to explain this one; instead, go to his blog and check it out.

Win32dd has been updated...according to Matthieu, there are some bug fixes, improvements, and some additional information about the memory state is displayed when the tool is used. Thanks, Matthieu, for the great work you've done with this tool!

While we're on the subject of memory collection and analysis, Brendan has updated VolReg to support BIG_DATA data types, due in part to Matthieu's blog post on Undocumented Vista and later Registry Secrets. Also, be sure to check out Brendan's Volatility Plugins page.

If you're a follower of Lon Solomon, at this point, you might be thinking, "SO WHAT?!?" Well, take a look at this write-up from Sophos...the part I like about this bit of malware is:

Rather than creating another file on disk, the dropper logic writes an entire PE file into the registry. The executable is stored under the key HKLM\SOFTWARE\Licenses with a randomly generated entry name.

Years ago while I was working for a security company in New Jersey, I wrote some code that would go out to a web site and grab what appeared to be a GIF image, but was in reality a PE file. The code would then disassemble the PE file into various Registry keys...the idea being that disassembling and writing it into the Registry would avoid detection by AV scanners. Then another piece of code would reassemble the PE file into the Recycle Bin and launch it. I thought that was pretty cool...but that was 8 years ago. Reminds me of that song Round and Round, by RATT..."what comes around goes around...". Hey, I wonder if we'll "see" a resurgence in the use of NTFS Alternate Data Streams, say, to hide PCI data?

Forensic4Cast and Links

Lee Whitfield of the Forensic4Cast podcast reached out to me this past week, and asked me to be a guest on his podcast on Wed, 10 June.

If you've never listened to Lee's podcast, give it a shot...Matt Shannon of F-Response.com was interviewed, as well as others. Lee's also got a section for technical articles, many of which look to be extremely useful.

Lee's also taking nominations now through 21 June for Forensic4Cast Awards; be sure to place your vote in any or all of the various nomination categories. Take a look at the page to see how everything works, and dates for submissions, voting and the posting of the final results. While this isn't something huge that's going to get you a free pass to RSA next year or something, I do think that it's a great opportunity to show your appreciation for the work done in the various categories. See what Matt's posted as his nominations!

Speaking of podcasts, did you know that CERT has podcasts? Another security podcast out there is ExoticLiability. Man, there's just too much to check out!

Didier's posted some links to PDF analysis tidbits...very cool! Didier's done a great deal of work in the area, and his work reminds me a lot of the ComputerBytesMan's work in the area of MSWord metadata extraction. Now, some folks are going to look at these links and ask, "...okay, but how can I use this?" Far too often, folks will post links to other blogs or blogposts without any real explanation of how the information is useful, valuable, or important. Well, when conducting analysis of a compromised system, one of the questions that comes up very often is, how was the system compromised? What was the infection vector? It's pretty trivial, really, to scan a mounted image with AV software or to locate files that an intruder may have copied onto the system...but sometimes (many times?) we need to find out how they got in. One means of doing so is to run file signature analysis tools across web browser and email attachment cache directories to locate things like PDF documents or Excel spreadsheets the may have been downloaded. Finding such documents, which have recently been identified as having vulnerabilities, may lead to identifying the initial source of compromise or infection.

Moyix recently posted some Windows 7 Registry hives for examination, based on a request from Tim Morgan. I'd taken a look at hives from a Windows 7 VM earlier this year, and found that while key locations may change between various revs and versions of the OS, the binary structure appears to remain the same. Thankfully, MS hasn't moved to an all-XML format for the Registry (right now, a lot of you out there are going, "Dude, shut up!!"). I've been running my RegRipper plugins against the hives and dude...they work great!

Speaking of Registry hives, reviews of Windows Forensic Analysis 2/e are already starting to appear! It appears that some folks really like the Registry analysis chapter...maybe this is something to take off on it's own...what do you think? Should Registry Analysis become it's own book? Personally, I think that there's more than enough information out there for this...let me know your thoughts. Or let Syngress know your thoughts.

Finally, more reviews of WFA 2/e are being posted, and I've gotta thank Larry for his review of Perl Scripting for Windows Security! I greatly appreciate the efforts of those who are posting reviews, regardless of the forum. Thanks, folks!

First Amazon Review!

The first review of WFA 2/e has been posted on Amazon! Check it out! Thanks, Dave!

Links and stuff

First off...for anyone who purchased a copy of Windows Forensic Analysis Second Edition at the TechnoSecurity conference...I'd greatly appreciate it if you'd post a review on Amazon! Thanks!

Richard Bejtlich has an interesting post regarding incident ratings. I find Richard to have well-thought out and -reasoned views, and this is yet another example of that. When writing CSIRPs, we include things such as incident severity ratings for classification and escalation purposes, so having something like this, while perhaps a little complex for many organizations, is very important.

JL's been nice enough to post on some CEIC materials...cool stuff. Thanks for posting and making these materials available!

Over on OffensiveComputing, there's a link for OfficeMalScanner, which scans Office documents for malware, embedded PE files, and OLE streams. If VB code is found, it's reportedly extracted for analysis. This sounds pretty cool and a good thing to have in your toolkit, along with other means for malware detection.

The eEvidence site has been updated again! Christine has a way of finding some really cool papers and presentations...while they may not always be brand-spanking new, they are definitely topical and well worth reading and discussing.

Ed posted some good command-line kung fu for getting user and group information from a live system. For post-mortem analysis, I use RegRipper's samparse plugin for this...it not only parses out the user information, but also the group membership information, as well. Another interesting bit of analysis you can use this for is to determine all local users on the system; dumping the contents of the ProfileList key (from the Software hive) or during a 'dir' on the Documents and Settings directory will give you the list of users with profiles on the system, but this will not distinguish between local and domain users.

According to SANS, the key ingredient to team development is...beer! Amen to that!

The Case of the "Default User"

Ever run across a case during which, while examining Internet browser history, you found that the "Default User" had browser history? Ever wondered about that?

Rob "van" Hensing was one of the first I know of to blog about this issue, almost three years ago. Given the time frame, this is a good time to bring this subject up again, don't'cha think?

I've seen this sort of thing in a couple of instances, specifically when SQL injection has been used to gain access to an infrastructure, and the bad guy gets a copy of wget.exe (static PE analysis will tell you if the program accesses the WinInet APIs) onto the system, and then uses that to pull down other files - in many cases, they'd use echo to create an FTP script, then launch the native command line FTP client using the script, or use wget.exe to pull the files down. Why? Well, most times FTP and/or HTTP are allowed out through the firewall.

Good stuff.

WFA 2/e Published!

I caught a note over on Facebook yesterday from Syngress that Windows Forensic Analysis, 2/e was published today! Awesome!

The info posted on Facebook is the same information posted on Elsevier's site. Aside from the "?" where there should be quotes, the information itself looks good...just one of those things I kinda wish the publisher would've picked up on earlier in the game, and corrected.

I'm told that the book is available, right now, at the TechnoSecurity conference in Myrtle Beach, but I haven't received any confirmation of that, nor any feedback from the Syngress marketing folks who are on-site. Speaking of which, the SANS Forensic Summit is rapidly approaching, and I'm trying to get copies of WFA and other books there. Rob Lee has been gracious enough to offer table at the Summit, and I've let the Syngress folks know that I'm not the only author who will be at the Summit.

Speaking of the TechnoSecurity conference, here's a picture of WFA 2/e on sale!

So, if you're going to be at the Summit (or someone you know is going), and you want Syngress to have books there for purchase, either post something publicly (blog) and send me a link, or comment here! Let the Syngress marketing folks know that if a computer conference has the word "forensics" in the title, then they should have books with the same word in the title available...particularly if there are going to be authors at the conference (and speaking)!

Another thing...if you are a college educator who uses WFA in computer forensics courses, or if you know of an academic institution (community college, college, academy, university, etc.) where WFA is part of required or recommended reading...please contact me at keydet89 at yahoo dot com. Thanks!

Stuff

"Links" seemed like an overdone title...I couldn't of anything else witty, and I wanted to get right to the content anyway...so "stuff" will have to suffice for now.

First, more good news about F-Response! Matt's done a truly awesome job with this product...absolutely amazing. F-Response is a real-world example of what happens when someone who does the work decides that there's a better way to do it...and then goes out creates that better way to do the job.

I posted a PDF document to RegRipper.net, in the Downloads section, under Documents...this is trifold "cheat sheet" for RegRipper v2.02. It's pretty simple, and has some basic usage information, as well as some space for notes. I got the idea from a trifold that Rob Lee posted for SANS, and it seemed like an awesome idea. I mean, I know that I can't remember everything, and having a trifold available with the most frequently used commands or CLI options is very helpful. I'd greatly appreciate your thoughts on this...what you like, what you don't like, and anything that might be done to improve it.

I finished up an engagement recently, and one of the interesting things I found was that the Security Event Log was full, and only covered a couple of hours on the day that the system was acquired. One of the questions I was trying to answer included whether or not a shared Admin account was being used to log into the system locally or remotely. I found a single event record with ID 528, type 2, indicating login to the console. I also found a single event ID 683, indicating that an RDP session had been successfully disconnected. Both pertained to the same user account. Now, most folks are aware that Windows did not include the ability to log source IP addresses for network logons until Windows 2003...but on XP systems, the event ID 683 includes the remote system name and IP from which the user logged in. Cool! As a follow-on, what I had hoped to find (and didn't) was the event ID 528, type 10, showing the remote interactive login for the session what was disconnected.

cmdLabs has a blog post on document metadata that mentions the wmd.pl script that ships with Windows Forensic Analysis (first and second editions). Embedded metadata is a huge issue, and something I've used quite successfully during examinations...I even have a case study illustrating this in the second edition of WFA (due out next week).

Here's an interesting blog post from Damballa. The Damballa product has to do with botnets, and I ran across it not long ago during an engagement...like many other tools, I don't think that the customer necessarily understood the use of the tool, or what it was doing. I do agree with the author (a former ISSer) to some extent...a botnet infestation should not be considered an inconvenience, but rather a breach. This is true with respect to much of the malware that's out there today...blended, compound threats, and I've also seen malware go from quarantined by most AV products to completely and utterly undetected in a matter of hours. But the fact of the matter is that most IT folks simply do not understand what's going on with malware...in some cases, it's considered an inconvenience, while in others, everyone up to the CEO goes completely nuts because someone speculated that the malware had keystroke logging capabilities...

A question popped up in the forums recently with respect to encryption and Truecrypt volumes, and some tools were mentioned (TCHunt, EDD) that may be helpful.

Lance Mueller posted a nice article about file system creation date vs OS install date...take a look.

For anyone analyzing systems where they suspect that a torrent client may have been used, Jamie Acorn wrote this PDF document on the Forensics of BitTorrent.

Finally, for those of us who've been around for a while, L0phtcrack is back! Go here to check it out!

More giggity, news, links and stuff

I guess just "Links" as a post title is getting old, and besides, I don't want to keep stealing Claus's thunder...

Peter Norris reached out to me (and others) and let me know that he's completed his MSc thesis work on the Internal Structure of the Windows Registry. I've had trouble downloading the ISO image, but I have been able to take a look at some of the tools. I hope that Peter's work, like JT's regslack Perl script, will serve to motivate examiners and analysts to start looking more and more into the Registry. I know, for example, that there's been a great deal of concern in the "differences" in the Registry between XP and Vista, and Peter's work illustrates that from a binary level, there really isn't much difference; however, the differences in the Registry's for the two Windows versions rest in things like key names, functionality locations, etc. Like Tim Morgan and JT's work, Peter's work is excellent, and something we need more of; IMHO, Registry analysis is much more than sitting down with a spreadsheet of keys, maybe some presentations from conferences, and a Registry viewer, and going through things manually. I wrote RegRipper for the purpose of optimizing extraction (as well as translation and correlation, as necessary) of Registry data, allowing for quicker and more thorough analysis.

Speaking of the structure of the Registry, Lance has a great post on locating the user's password hash in the SAM hive file.

On a side note, the second edition of Windows Forensic Analysis is due out in about two weeks (I'm told); one of the comments I received from a couple of folks who reviewed the content was that the chapter on Registry Analysis (chapter 4) was too long, and there is enough content that it should be split into multiple subchapters. I mentioned writing a completely separate book on the topic to the publisher and there seems to be some interest. I'd like to hear what others think about that.

Richard Bejtlich listened to the TalkForensics podcast, during which Larry Daniels and I spoke. Richard made mention of my reference to SQL injection obfuscation, in which hex or character set encoding allowed the attacker to achieve their goals, but hampered detection and analysis...and by that, I mean, for those using nothing more than a "traditional" approach. I mentioned the "declare" statement during the interview...encoding the keyword would turn up no hits during a search, but the statement would still be processed. Therefore, an analyst would need to seek another means of detection; for example, parsing the IIS web server logs and mapping the various cs_uri_stem fields to the length of their corresponding cs_uri_query fields, and looking for unusually long queries.

On the topic of log analysis, check out LogAnalysis.org. There are some great resources at the site on a wide range of log-type topics. Be sure to check out the app-specific log parser page for some Perly goodness!

Andrew Martin posted an excellent writeup on the Gumblar attack. I really like stuff like this as it's often more comprehensive, and (for me) far more useful than the stuff produced by AV companies. For example, given the information in the post, you can do things such as network-based detection for infected systems, as well as scanning of the infrastructure for infected systems (using reg.exe, RegRipper, etc.). Analysts can use this same information to determine if a system was infected, even if all they have is an image acquired from the system (Note: I did something similar myself recently...I found a Conficker.B infection in an acquired image...)

Speaking of Gumblar, one of the things that the malware does is steal FTP credentials; the MMPC blog has a post about cleaning password stealing malware off of infected systems.

Didier Stevens, who's done a great deal of work with respect to parsing files, has posted a link to his Hakin9 article on malicious PDF docs. Didier's code has been included on VirusTotal, and is definitely worth a look for anyone performing forensic analysis, and interested in determining infection and compromise vectors.

Giggity giggity

I know, interesting post title, right...just couldn't come up with anything witty...sorry.

Well, Rob Lee ran us (me, Chris Pogue, and David Hull) through the SANS Essential Incident Response WebCast yesterday, and two out of three panelists agree that Cory Altheide is THE indispensable incident response tool! The mini-panel was a lot of fun and I hope folks listening to it take it as a harbinger of things to come this summer at the Summit.

Speaking of conferences, I ran across SecureArtisan's comments (day 1, day 2, day 3) from attending the CEIC Conference. It appears that there were some interesting presentations, some of which may have been interesting in title only. Reading through his comments, I have to agree with some of them from my own experiences, as this is why I've stopped trying to attend some conferences. What have you seen?

Also, I wanted to share some comments (posted with the author's permission) I've received lately from folks regarding tools...the first is from Brian Perkins, who said:

I just wanted to drop you a quick note regarding a recent success story using your FRUC client and the FSP Server. One of the data points I collect is autorunsc.exe –a. With this collection of data I was able to identify the malicious software in a matter of minutes even before acquiring an image. I have made great use of your FRUC client and server to the point that it serves as my first tool to deploy for Incident Response, and it now sits at the core of my Forensic Investigation Protocol . Getting the volatile data first and then the static data (hdd image) second is my order of priority. Using your tools has made my time well spent when as we all know how efficient a tools performs depends upon its success. Now I going to let Reg Ripper have a go at the hives!

If you remember, the FSP is one of the tools available on the DVD that accompanies the first edition of Windows Forensic Analysis (and yes, it is on the DVD with the second edition, as well).

The second comment is from Ian Hutchison, and has to do with the rp.pl Perl script that I mentioned in a previous post; Ian asked for a copy and ran it after I sent it, and this is what he had to say:

I ran this and it chewed threw 114 restore points in less than a second. That would have taken me hours if not days to do manually, and seriously messed with my sanity.

I want to thank both Brian and Ian for their comments, and for allowing me to post them. While it's nice to see comments like this out in public view, more than anything else, these comments show that there are folks out there looking for answers in other areas of a system or an image aside from just the file system, and moving beyond the traditional, purist approach to computer forensic analysis.

SANS WebCast today at 1pm, EST

I'll be participating in a SANS mini-IR panel webcast today at 1pm, EST, along with Chris Pogue and David Hull. Our intrepid host is Rob Lee, Mr. SANS-Forensics himself! This webcast is a bit of a taste of what's to come at the SANS Forensics Summit this summer, so be sure to check it out and participate!

Be sure to check it out!

Links and Stuff

After traveling last week, I thought I'd throw up some updates and interesting things I've run across...

JL's got a good blog post on sources of info, including podcasts, listservs, etc. I hadn't heard of the Exotic Liability podcast before, I'll have to check that one out...checking out the web page, it looks pretty cool, especially the post about controlling web cams. JL also provides her blogroll, etc...anyone have anything to add to any of the lists she's provided?

Matt's got some new goings-on over at F-Response with the release of the F-Response EMC version 3.09.1 (Don talks it up, as well), and has posted about F-Response working with something called the Revealer Toolkit. If anyone's seen or used this before, would you care to post a review?

Links for file system stuff:
WikiPedia Common Filesystem Features
MS TechNet NTFS Time Stamps

What else? Oh, yeah...put in a little work on merging the code from two separate Prefetch (XP and Vista) file parsing scripts into one unified script, updating the code that is currently on the DVD that ships with my book. The updates to the code are based, in part, on my desire to not have a ton of code just lying around, as well as information from this blog post. I haven't actually looked at the EnScripts that are available, as the code I'm working on is intended to work on a live system, Prefetch files extracted from an acquired image, and Prefetch files accessible via a mounted (SmartMount, ImDisk, etc.) image or via F-Response. The script parses items such as the volume information block from the .pf file, getting things such as the volume serial number. Here's an example of the output of the script run against a Prefetch file on my local system:

C:\Perl>pref.pl -f c:\Windows\prefetch\MRT.EXE-1B4A8D49.pf -i
c:\Windows\prefetch\MRT.EXE-1B4A8D49.pf Fri May 15 00:37:33 2009 (1)

Volume Path : \DEVICE\HARDDISKVOLUME1
Volume Creation Date: Mon Aug 7 16:05:41 2006 Z
Volume Serial Number: 8456-B799

Since the file is from my local system, I can verify the volume serial number:

C:\Perl>vol
Volume in drive C has no label.
Volume Serial Number is 8456-B799

Pretty sweet. Analysis of the Prefetch files can lead to some interesting information, particularly when using the entire capability of the script to output such things as the embedded file paths. Prefetch files are perhaps most often tied to the named application being run on the system, the last time that application was run, and how many times it has been run. Keep in mind, though...Prefetch files by themselves do not tie the launch of the application to a user.

Speaking of Windows Forensic Analysis 2/e, one of the marketing folks at my publisher has said that copies of the book will be drop-shipped from the printer to TechnoSecurity in Myrtle Beach, SC. Unfortunately, I just found that out, and there's no way for me to get to the conference...but I'm hoping that we'll have copies of the book available at the SANS Forensic Summit in July.

Other Resources
ForensicWiki page on Visualization Software

Excellent Sunday Linkage

Thought I'd share a couple of posts, links and thoughts I've come across or had recently...

First, a while ago I provided information for a "lessons learned" ISS X-Force blog post on SQL injection, and it was posted last week. Hopefully, this post provides some insight into the dangers of the SQL injection attacks that the media did not pick up on; namely, leveraging the configuration issue to burrow deep, deep, deep inside the infrastructure.

The blog post was picked up by the SANS ISC, as well...thanks, guys!

Some additional resources regarding SQL injection, if you're not familiar with the issue:
SQL Injection Attacks by example
SecuriTeam: SQL Injection Walkthrough
What MS has to say...

The Illustrious Don Weber has a couple of excellent posts over on the Security RipCord blog, the latest regarding the use of F-Response and the FEMC v3.09. Don's posted lots of pictures, too, that clearly illustrate how easy Matt's product makes incident response. The title that Don used for the post includes "quick", as in, "the quick or the dead", because honestly, that's what it comes down to, doesn't it? At the first SANS Forensic Summit in Oct, 2008, AAron Walters used the term "temporal proximity" to indicate the need for better detection and quicker response to incidents in order to collect data for analysis. F-Response moves incident response ahead a quantum leap forward, providing responders with the capability to reach out and collect data faster than ever before. Not only are you not sacrificing accuracy or completeness for speed, but this isn't so complicated that you need to be a rocket scientist to use it.

Speaking of F-Response, be the first on your block...uh, blog...to get the new F-Response decal!

For those of us who are into Windows memory analysis, Andreas Schuster has posted links to more versions of the venerable PTFinder tool. Don's also spent some time talking about memory analysis tools and large memory acquisitions, as well.

Ryan Johnson posted to the SANS Forensic Blog on the Future of Digital Forensics; his post focuses primarily on the PI issue that has cropped up in many states already, to varying degrees requiring folks who do IR and CF work to be licensed as private investigators. IMHO, this does absolutely nothing to better the field or the community, nor does it do anything to serve the customer/victim...in fact, it hurts the victim. When someone calls for assistance, they're going to either have to pay some additional amortized fee for the cost of obtaining licensing in that state, or they're going to be told, "oh...sorry, no...we can't do work in YOUR state." Cllick. It's already happening, folks. Am I saying that you won't get the best of the best? No. What I am saying is that the purpose of the licensing has nothing whatsoever to do with the quality of the work, and in some cases, it prevents victim organizations from bringing in responders with whom they already have a relationship, and may know some pretty important things about their infrastructure.

Last but not least, Richard Bejtlich has posted some highlights from the 2009 Verizon Security Data Breach Report, and as always, he's got some pretty insightful things to say. One of his statements that I would suggest is accurate is, Detection methods continue to be pathetic. Harsh? Maybe. Look at the graphic from the report; 70% of breaches were reported by an outside third party. Ouch.

Finally, don't forget to check out episode 151 of the PaulDotCom podcast, and don't miss Larry Daniels' TalkForensics show...

PaulDotCom and TalkForensics Interviews

On Thursday night, I was interviewed by the guys from the PaulDotCom podcast. I have to say, while I've listened to several of their podcasts (albeit not all 150), it's a completely different experience to be on the hook with them live. Thanks, guys, for the wonderful opportunity!

Also, I'll be appearing as a guest on Larry Daniels' TalkForensics radio show on Sunday, 10 May. Be sure to listen in.