Forensic Blogs

An aggregator for digital forensics blogs

October 24, 2017 by LCDI

VMWare Analysis Update 1

Introduction

The VMWare Analysis team is researching the differences between a Windows 7 machine and Windows 7 virtual machine (VM) as well as the changes between a Windows 10 machine and VM. The end goal for this project is a quad comparison between the both operating system versions and their respective VMs.  

VMWare/Physical Machines Used

Three VMs have been set up for this project: a Windows 7 VM; Windows 10 VM; and a SANS SIFT VM running Ubuntu. The SANS SIFT is a free VM built by SANS DFIR (Digital Forensics and Incident Response). It has a variety of Digital Forensics tools, such as Volatility and Bulk Extractor. This VM is being used for memory forensics analysis of the four machines. The VMWare Analysis team is going to be extracting, analyzing, and comparing Windows artifacts. These include Prefetch files, LNK files, Jump Lists, and Windows Memory.

Progress

Thus far, the team has completed datagen and analysis of the Windows 7 machine and Windows 7 VM. Both machines used the same data generation process to keep the results consistent. There are a few specific things that we analyze for the comparisons. One is network information within the registries. Another is what changes VMware tools makes to the virtual machine. And the last is general information on artifacts. This includes where the system stores them and what information they reveal about the system.

VMWare

The team was having troubles generating Prefetch data for Notepad, Notepad ++, and Adobe Reader. After a few minutes of troubleshooting, the team discovered that the Prefetch folder only allows up to 168 “.pf” files at one time. The folder had reached capacity and could not fit files for those applications.

Conclusion

So far, the only identified difference between the VM and the Machine is in the prefetch files. The Windows 7 Machine had 140 prefetch files, while the VM only had 114. It is also noted that the VM image contained a prefetch for VMware (VMTOOLSD.EXE-CD82EC13.pf). The physical machine did not.

VMWare

In the upcoming weeks, the VMware analysis team is planning on starting the Windows 10 physical machine and VM. Once we complete data generation and analysis, we’ll start comparing differences between the virtual machine and physical machine. We’ll also compare Windows 10 and Windows 7.

Like the Leahy Center for Digital Investigation (LCDI) on Facebook and follow us on Twitter to get notified of more project updates.

The post VMWare Analysis Update 1 appeared first on The Leahy Center for Digital Investigation.

Read the original at: The Leahy Center for Digital InvestigationFiled Under: Digital Forensics, Uncategorized Tagged With: artifacts, Blog Post, Projects, Student Work, Update, Virtual Machine, VMware, windows, Windows 10, Windows 7

April 5, 2017 by Sara Martin

Application Analysis: A Closer Look At Business Apps

Application Analysis Introduction 

The Application Analysis team has continued examining the desktop-based web applications for both Mac and PC. We are currently finalizing our tests with Slack and DropBox. They were searching for files that could hold company, user, and file information. While these are only tests in the context of a real world scenario, this info represents important organization information from things like employee info to upcoming projects and intellectual property.

Application Analysis: Slack Artifacts

Prior to starting our tests on Slack, our goals were to recover user data and messages. Using Guidance Software’s EnCase 8, we were able to meet our goals and research our findings.
We found several useful artifacts from our macOS Sierra data generation with Encase.  The relevant data we found was located at:\Users\test\Library\Application Support\Slack\Cache. In the file slack-teams, we managed to find the username the person logged in used, their userID, and the ID of the team they were a part of. There are also urls to different sizes of the team’s logo on slack. The urls (example: https://s3-us-west-2.amazonaws.com/slack-files2/avatars/2016-08-23/72112878551_1f33a19b4d74ef683b3e_original.png) contain the date of when the avatar was uploaded.

application analysis

In the file slack-settings we found data about the client itself such as the version number, version name, and platform. This entry also has a field for isWin10 and isBeforeWin10, which raises questions about the differences between the Windows 10 version of Slack and other versions.

application analysis

Application Analysis: Dropbox Artifacts

In our investigation of Dropbox we focused on what document data Dropbox stores and what it leaves on a client computer through its Web App. One of the most lofty statements made by Dropbox is it encrypts data at rest with AES 256-bit encryption, but what we found was a little bit more interesting. To investigate the team used the default Dropbox settings, and to our surprise the desktop folder for Dropbox is not encrypted.

application analysis

The issue here is that the AES 256-bit encryption applies to the data on their servers at rest; while leaving the user’s folder unencrypted. Another interesting bit of data was .drop.cache containing a deleted file that was not on the user machine before deletion, but still showed up even though it was deleted on the web browser the file in question is: Get Started with Dropbox (deleted 44ddbfbbf1afaa31a4c4909fe4a9690b).pdf

While it is a simple Dropbox default file if important documents are deleted and still accessible that would pose a security issue, as it could providing people attempting to steal information with the info they need. The usage of SQL databases was found in Dropbox’s app data with the file C\Users\User\AppData\Local\Dropbox\instance1\aggregation.dbx being a example of this.

application analysis

It stored info of all files currently on Dropbox with timestamp server paths and even had a spot for editor names. As this information was easily accessible it would leak what documents the organization stores, the timestamps could help build a timeline and editor name reveal who is working on what document. In the real world, an organization’s information could be leaked and intellectual property could be copied, tracked, and pinpointed to who works on what.  
After deletion the program data (86x), program data, along with the User’s app data was deleted. However the C:\Users\User\Dropbox folder stayed along with the shared folder allowing the user keep all the Dropbox files. If a company tries to issue a deletion of Dropbox from a user’s computer, they would need to take extra precautions, as a terminated employee could still have the files stored on their computer even through the app itself was deleted.

application analysis

Process: Through Windows and Mac

The artifacts we were able to acquire in Windows 7 and Windows 10 on Slack and Dropbox were almost all but the same. Slack on Windows 10 had all the data we found on Windows 7 but because of reasons unknown, we could not view image files pulled from Windows 10. Windows 10 and 7 yielded the same artifact results for Dropbox. We were able to find different cache files and images. However, similar to Slack, while some files could be viewed in Windows 7, larger files could not be viewed in Windows 10.

Windows 7 was interesting as Encase identified the Data_2 and Data_3, which consisted of images, after it was parsed as information from Google Chrome Browsers. The same case occurred on Mac with the Windows 10, which did not have the Data_2 and Data_3 images. The usage of SQL Databases was, in the same way, was present for both Mac and Windows for both Dropbox and Slack. The parsing of these Databases was able to provide info on what apps it is ready to use and what files were stored by the App as in Dropbox’s case.

Conclusion

The usage of SQLite databases by Web Apps is interesting as it ended up being one of the primary sources of evidence of file activity as well as storage information. The caches were unsurprisingly vital to the investigation as cached files gave up a lot of data such as Slack revealing user portraits and Dropbox showing deleted files. Despite the OS differences, the Web Applications all followed the similar file layout across all three OS systems; however, differences were still present. Windows 10s differed in its method of storing cache causing Encase not to parse the data. Oddly enough, all three systems featured the Web Apps using SQLite databases for parts of local storage. Overall, while they did reveal user information, the data could only be used primarily for phishing attacks and Intellectual Property theft. Stay tuned for our final results.

Questions or comments? Please share with us in the comment section below! You can also reach out to our Twitter and Facebook or email us at lcdi@champlain.edu.

The post Application Analysis: A Closer Look At Business Apps appeared first on The Leahy Center for Digital Investigation.

Read the original at: The Leahy Center for Digital InvestigationFiled Under: Digital Forensics, Uncategorized Tagged With: application, Application Analysis, Apps, Blog Post, Champlain College, computer forensics, desktop app, desktop application, desktop applications, desktop apps, Digital forensics, Digital Investigation, Dropbox, forensics, LCDI, Mac, Projects, Slack, Student Work, Update, windows, Windows 10, Windows 7

February 15, 2016 by LCDI

Windows 10 Final Report Release

the final report is here! The Windows 10 Final Report is finally ready to be released. This project was a continuation from the Windows 10 project done earlier last year. In the Fall 2015 semester, the LCDI team did further exploration into tasks that remained unfinished at the conclusion of the previous part of the project. […]

The post Windows 10 Final Report Release appeared first on Computer & Digital Forensics Blog.

Read the original at: Computer & Digital Forensics BlogFiled Under: Digital Forensics, Uncategorized Tagged With: Accomplishments, Champlain College, computer forensics, DFA, Digital forensics, Digital Forensics Association, Digital Investigation, forensics, LCDI, Projects, Students, Update, windows, Windows 10, Windows 10 Forensics

  • « Previous Page
  • 1
  • 2
  • 3
  • 4
  • Next Page »

About

This site aggregates posts from various digital forensics blogs. Feel free to take a look around, and make sure to visit the original sites.

  • Contact
  • Aggregated Sites

Suggest a Site

Know of a site we should add? Enter it below

Sending

Jump to Category

All content is copyright the respective author(s)