What are the hash values (MD5 & SHA-1) of all images?#

Does the acquisition and verification hash value match?#

Identify the partition information of PC image.#

Explain installed OS information in detail. (OS name, install date, registered owner…)#

What is the time zone setting?#

• HKLM\SYSTEM\ControlSet###\Control\TimeZoneInformation

What is the computer name?#

• `HKLM\SYSTEM\ControlSet###\Control\ComputerName\ComputerName
• `HKLM\SYSTEM\ControlSet###\Services\Tcpip\Parameters

List all accounts in OS except system accounts. (Account name, login count, last logon date…)#

• HKLM\SAM\USERS

Who was the last user to logon into PC?#

When was the last recorded shutdown date/time?#

• HKLM\SYSTEM\ControlSet###\Control\Windows (value: ShutdownTime)

1
57-A9-48-B5-10-67-D0-01

Explain network interface(s) with DHCP assigned IP.#

• HKLM\System\ControlSet00x\Services\Tcpip\Parameters\Interfaces\{GUID}

What applications were installed by the suspect after installing OS?#

• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
• 64-bit Systems: HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall

List application execution logs. (Executable path, execution time, execution count…)#

• UserAssist

• Application Compatibility (Shimcache)

• Application Compatibility Cache

• (Some Windows executables and duplicated items are excluded)
• Execution Count may not be accurate.
• Timestamps of UserAssist and Prefetch: Execution Time
• Timestamps of Shimcache: Last Modified Time from filesystem metadata

List all traces about the system on/off and the user logon/logoff. (Time range: 09:00–18:00)#

• For this task, we have to carve all the Event logs from C:\Windows\System32\winevt\Logs\*,
• So i carved all the logs include important one,
  • Application.evtx
  • Security.evtx
  • System.evtx
  • Setup.evtx
• Parse all the important logs and convert it to csv using EvtxeCmd tool.

1
EvtxECmd.exe -f "Evtx Logs\<LogFileName>.evtx" --csv <DirectoryName>

• Now we can analyze it using Timeline Explorer,

What web browsers were used?#

• HKLM\SOFTWARE\Microsoft\Internet Explorer (value: svcVersion)
• HKU\informant\Software\Google\Chrome\BLBeacon (value: version)

Identify browser history paths.#

• MS IE (9 or lower) :

  • C:\Users\informant\AppData\Local\Microsoft\Windows\History\
  • C:\Users\informant\AppData\Local\Microsoft\Windows\Temporary Internet Files\
  • C:\Users\informant\AppData\Roaming\Microsoft\Windows\Cookies\

• MS IE 11 :

  • C:\Users\informant\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat

• Chrome :

  • C:\Users\informant\AppData\Local\Google\Chrome\User Data\Default\History
  • C:\Users\informant\AppData\Local\Google\Chrome\User Data\Default\Application Cache\
  • C:\Users\informant\AppData\Local\Google\Chrome\User Data\Default\Media Cache\
  • C:\Users\informant\AppData\Local\Google\Chrome\User Data\Default\GPUCache\
  • C:\Users\informant\AppData\Local\Google\Chrome\User Data\Default\Cookies\
  • C:\Users\informant\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
  • C:\Users\informant\AppData\Local\Google\Chrome\User Data\Default\Extensions\

• Considerations

  • History, Cache, Cookie… -
    • Windows Search database ([[Digital Forensics Investigation Questions#Windows Search Analysis]])
    • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb

What websites were accessed? (Timestamp, URL)#

• To analyze Internet Explorer History,
• C:\Users\informant\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat file, we need some kind of parser IE10Analyzer.

• For Chrome Browser History,
  • C:\Users\informant\AppData\Local\Google\Chrome\User Data\Default\History
  • This website is useful to parse SQLite Database file, https://inloop.github.io/sqlite-viewer/.

List browser search keywords.#

List all user keywords at the search bar in Windows Explorer. (Timestamp, Keyword)#

• HKU\informant\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery\

1
secret, 2015-03-23 18:40:17

What application was used for e-mail communication?#

Where is the e-mail file located and List all e-mails (including deleted). What was the e-mail account used?#

• File is located at,
• C:\Users\informant\AppData\Local\Microsoft\Outlook\iaman.informant@nist.gov.ost

• To read this email pff-tools this utility can be used,

1
sudo apt install pff-tools
2
pffexport iaman.informant@nist.gov.ost

• I found 4 deleted messages under,
  • iaman.informant@nist.gov.ost.expor/Root - Mailbox/IPM_SUBTREE/
  • /Sent Items/
    • Message00001
      • ConversationIndex.txt
      • InternetHeaders.txt
      • Message.html
      • OutlookHeaders.txt
      • Recipients.txt
    • Message00002
      • …
  • /Inbox/
    • Message00001
      • ConversationIndex.txt
      • InternetHeaders.txt
      • Message.html
      • OutlookHeaders.txt
      • Recipients.txt
    • Message00002
      • …
    • Message00003
      • …
    • Message00004
      • …
    • Message00005
      • …
  • /Deleted Items/
    • Message00001
      • ConversationIndex.txt
      • InternetHeaders.txt
      • Message.html
      • OutlookHeaders.txt
      • Recipients.txt
    • Message00002
      • …
    • Message00003
      • …
    • Message00004
      • …

1
https://drive.google.com/file/d/0Bz0ye6gXtiZaVl8yVU5mWHlGbWc/view?usp=sharing
2
https://drive.google.com/file/d/0Bz0ye6gXtiZaVl8yVU5mWHlGbWc/view?usp=sharing

1
I am trying.
2

3
-----Original Message-----
4
From: spy
5
Sent: Tuesday, March 24, 2015 3:33 PM
6
To: iaman
7
Subject: Watch out!
8

9
USB device may be easily detected.
10

11
So, try another method.

1
spy.conspirator@nist.gov <-> iaman.informant@nist.gov

List external storage devices.#

Identify file renaming traces (Desktop, date range).#

• (It should be considered only during a date range between 2015-03-23 and 2015-03-24.) [Hint: the parent directories of renamed files were deleted and their MFT entries were also overwritten. Therefore, you may not be able to find their full paths.]
• NTFS journal file analysis (UsnJrnl) - \$Extend\$UsnJrnl·$J (+ $MFT for identifying full paths of files)
• With NTFS journal file only, it may be hard to find full paths.
• We can consider the Registry ShellBags for further information.
• I carved both UsnJournal and Master File Table files from \$Extend,

1
MFTECmd.exe -f "$MFT" --csv MFT
2
MFTECmd.exe -f "$J" --csv J

IP address of company shared network drive?#

1
\\10.11.11.128\secured_drive  : 2015-03-23 20:23:28

Directories traversed in RM#2.#

• Timestamp may not be accurate.
• E:\ can be inferred from external storage devices attached to PC in Question 22.
• You can consider a created timestamp and a last accessed timestamp of each ShellBag entry.
• HKU\informant\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1~
• We can open the UsrClass.dat into ShellBags Explorer.

List all files that were opened in RM#2.#

Directories in company network drive.#

• ‘Timestamp’ may not be accurate.

• V:\ is mapped on \\10.11.11.128

• HKU\informant\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\8\0\~

• \User\informant\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations

• \User\informant\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations

• \User\informant\AppData\Roaming\Microsoft\Windows\Recent\*.lnk

• \User\informant\AppData\Roaming\Microsoft\Office\Recent\*.lnk

Files opened in company network drive.#

Find traces related to cloud services on PC. (Service name, log files…)#

• Installation directory
• Registry (Configuration, Uninstall Information, Autoruns, UserAssist, Classes…)

Deleted files from Google Drive.#

• Path of google drive logs,
  • \User\informant\AppData\Google\Drive\user_default\sync_log.log
• We carve it and parse it using this tool, https://toolbox.googleapps.com/apps/loggershark/.

1
2015-03-23 16:32:35.072 -0400 INFO pid=2576 4004:LocalWatcher common.change_buffer:1017
2

3
Adding event to change buffer: RawEvent(
4
  CREATE, path=u'\\\\?\\C:\\Users\\informant\\Google Drive\\happy_holiday.jpg', time=1427142755.056, is_dir=False,
5
  ino=4503599627374809L, size=440517L, mtime=1422563714.5256062, parent_ino=844424930207017L,
6
  is_cancelled=<RawEventIsCancelledFlag.FALSE: 0>, backup=<Backup.NO_BACKUP_CONTENT: (False, False)>)

• It indicates that C:\\Users\\informant\\Google Drive\\happy_holiday.jpg this file is uploaded to drive.
• Another one,

Google Drive account information.#