Latest / Parsing the Truth: One Byte at a Time / 12 Days of DFIR

Transcript

12 Days of DFIR · Parsing the Truth: One Byte at a Time

0:01
Join former FBI Senior Forensic Examiner's Becky Passmore and
0:05
Stacey Eldridge as they dig into the world of digital forensics
0:08
one bite at a time. Now leading their own consulting
0:11
firms and educating the next generation of cyber sleuths,
0:14
these badass babes of digital forensics bring sharp insight,
0:18
real world case experience, and a dose of humor to the bits and
0:21
bites that filled today's investigations.
0:23
From deep dives into business e-mail compromise and ransomware
0:26
attacks, Becky's specialty to cracking the complexities of
0:29
iPhone forensics, Stacy's obsession, this podcast delivers
0:33
insider knowledge for professionals, students, and
0:36
true crime techies alike. If you've ever wondered what
0:39
really happens when the digital trail is all that's left, TuneIn
0:42
and start parsing the truth. Welcome back to Parsing the
0:53
Truth One bite at a time. I'm your host, Stacey Eldridge.
0:56
And as always, I'm joined by my fabulous Co host Becky Passmore.
1:00
And today we're kicking off a festive forensic countdown to
1:06
get you in the holiday spirit. Defer style.
1:10
Or is it defer Becky? Defer.
1:12
Well, anyways, we are going to bring you the 12 days of digital
1:16
forensics and incident response artifacts.
1:19
How about that 12 digital clues that every investigator should
1:25
know, love, and collect before they deck the halls or testify
1:31
in court? So grab your coffee, your cocoa,
1:34
your hot toddy, or that evidence bag that you still need to seal
1:39
and let's get started. Let's get started.
1:41
OK, so day one on the first day of forensics, the disc gave to
1:48
me the master file table entry, the MFT.
1:53
The MFT is the heartbeat of NTFS.
1:56
Every file, directory, time stamp and record of existence
2:02
lives here. If you want to know what really
2:05
happened, the MFT is your first stop.
2:08
On the second day of forensics, Windows gave to me two shell bag
2:15
entries and they tell us what folders a user viewed, even the
2:19
ones that it no longer exists. Deleted directory, hidden stash?
2:24
Shell bag saw it. Why did the shell bag see it?
2:27
Because they're tracking the users viewing preferences as
2:31
they're using Windows Explorer to view those files.
2:34
If they change the view from thumbnails to details, shell bag
2:37
saw it and tracked it. To get those shell bags, you're
2:40
going to need a couple of shell keys from both the NT user dot
2:44
dat and the user dot dat or excuse me, the user class dot
2:50
dat registry files. That's right.
2:53
So on the third day of forensics execution gave to ME3 prefetch
3:02
loads. Prefetch shows program
3:05
execution, run count and last runtime.
3:10
If malware ran, you will see it. If they swear they never opened
3:15
that executable, well, prefetch says otherwise.
3:20
Each prefetch file records up to the 1st 10 seconds of
3:25
application load behavior. That includes reference,
3:28
reference to DLLS, resource files, and sometimes even pass
3:33
that point back to external or removable media.
3:38
So if malware is launched from a USB drive or a network share,
3:43
prefetch often exposes that. Trail nice all right On the 4th
3:50
day of forensics logging gave to me 4 EBT logs.
3:56
They were security, system, application, and of course
4:00
setup. These logs tell the story of
4:03
authentication, process creation, network connections,
4:08
and much much more. You have to be aware though that
4:11
these logs can be pretty noisy, and if you don't know what
4:15
you're looking for, they might just lead you down the wrong
4:19
strong path of thinking that is. And I had a recent case where it
4:22
looked like the user account was actually being logged in, but it
4:27
was happening a lot like login, login, login.
4:30
But after some digging and some research, according to the event
4:34
log, they were actually not logging in.
4:38
It was not a person, it was not a user account logging in.
4:41
It was the system doing some work in the background, but on
4:46
first glance kind of looked like the user.
4:49
So dig deep through those EBT logs.
4:52
Yeah, those EBT logs can tell us a lot.
4:55
So on the 5th day of forensics Chrome, I gave to me 5 browser
5:07
histories, history, cookies, cash, auto fill, and downloads.
5:18
Show me. Show me a suspect's search terms
5:22
and I'll show you motive, curiosity, or browser history.
5:28
Browser artifacts collectively reveal a user's intent, behavior
5:34
patterns, and interaction with online content.
5:38
Search terms in particular can expose motive.
5:41
We know that planning, curiosity, or last minute panic
5:46
as events unfold, even deleted browser data often lingers in
5:52
SQLite databases, journal files, or system level artifacts that
5:58
preserve the truth long after the user thinks it's.
6:03
Gone. Yep, absolutely.
6:04
And with those browser artifacts, like you said,
6:07
sometimes you're really getting into the persons mind and seeing
6:11
what the heck is going on in there, what's happening on the
6:15
keyboard. That's right all.
6:16
Right, moving on. On the 6th day of forensics, iOS
6:21
gave to me 6 app usage artifacts.
6:25
All right so moving on to day six, we got knowledge C and it
6:30
is going to give you incredibly rich info about user behaviors
6:34
on iPhones. Think what app was in the
6:37
foreground, what was sent to the background screen locks,
6:41
unlocks, charging history, battery level, audio output
6:45
changes. Basically it's the what are they
6:48
doing database on the iPhone. Now some stuff has to move to
6:52
biomes, but Knowledge C has a lot of great info you should be
6:57
looking at. That is correct.
7:00
So on the 7th day of forensics Windows gave to me 7 jump list
7:08
jumping. So jump list track recently
7:14
accessed files. Folders.
7:16
And applications, including items open from USB drives or
7:21
network shares. They store both automatic and
7:24
custom destination lists, giving investigators granular insights
7:30
into user activity. Even if a file is deleted, it's
7:34
jump list entry often survives, proving it was opened and when.
7:40
On the 8th day of forensics, the registry gave to me 8 registry
7:46
keys. And the registry canes contains
7:49
a wealth of knowledge about the operating system, the computer
7:53
itself and the user. Think installation date, time
7:58
zones, connected USB devices, Wi-Fi connections, MUI cache,
8:03
recent docs, user assist and even BAM data.
8:07
How to throw that in there? Because who doesn't like BAM
8:11
data which is program execution. But anyways, each key in the
8:16
registry can tell a different piece of the story about what
8:20
was going on on the computer and what the user was doing.
8:24
So even after a programs been deleted, residue can live on in
8:28
the registry and give you clues. So if you're not looking here to
8:32
try to figure out what the heck was going on, you're definitely
8:35
missing out. That's right.
8:36
That is so right and a great place to find evidence.
8:41
So on the 9th day of forensics, the NTFS gave to me 9 journal
8:51
updaters or updates. Yeah, so the US journal records
8:57
nearly every change to the file system.
9:00
Creations, solutions, renames, modifications, even when the
9:04
files themselves are long gone. It's entries persist
9:10
independently of the data, making it invaluable for
9:15
reconstructing activity and uncovering attempts at
9:19
concealment when someone wipes evidence and TFs journals, or
9:24
are often the artifacts that tell the real.
9:27
Story Yeah. And Becky, you and I have worked
9:29
on some stuff recently where we had to do some deep digging.
9:33
And some of these, I don't know, we'll call them modern tools,
9:37
fancy tools, expensive tools are not going to give you some of
9:41
this granular data. And so you've got to switch to a
9:47
different tool. Some of the older tools were
9:50
doing a really great job of, of digging into this stuff.
9:53
Some of the tools that have been around there kind of since the
9:55
beginning did a great job at some of this stuff.
9:58
Or alternatively, you've got to get into like a hex editor and
10:02
and manually parse some of that stuff.
10:04
Well, and we also have to remember that in the end, we
10:08
should know where our artifacts live in the file system because
10:14
you may have to manually parse out every little artifact.
10:19
And we're talking about anything that was on the system before,
10:25
such as an update occurred to now if someone had reformatted
10:31
the drive. Whatever the case may be, you
10:34
may have to manually export the data from more than one location
10:39
to be able to tell the story. So knowing where your artifacts
10:44
live, your event logs, your registry files, your your
10:50
journal entries, knowing where that stuff lives is key.
10:53
Because you can go. Find a tool.
10:55
And like you said, you can go back to a legacy tool.
10:59
I was recently using one of my favorite registry tools which
11:04
was Access Datas Registry Viewer to look at some data recently.
11:09
So you can go back to some of those legacy tools and produce
11:12
the results just as well as you can with any of the newer tools
11:17
and utilities. Yeah, I still really like access
11:20
data as registry viewer. I don't know if that's kind of
11:22
because that's what we got trained on 1st.
11:24
So we're super comfortable with it.
11:26
Maybe, you know, we're a little biased in that regards.
11:29
But in in some of the other ones it just kind of like when it
11:32
parses it, it like parses out a string but I can't see the rest
11:35
of the keys And and I kind of like to get granular like that.
11:39
Like the fact that it gives me the last right date right down
11:43
there in that lower corner and I can go, that's the last right
11:47
date. I don't have to find it up here.
11:49
And that's the other thing. When you get comfortable with a
11:52
tool, you know what that tool is doing.
11:55
And a lot of people don't realize Registry Viewer access
11:58
Data Registry Viewer. The demo mode is free and it
12:03
does exactly what we want it to do.
12:07
That's just between us and our listeners, right?
12:09
We're not going to tell anybody else that could make a change to
12:13
that tool, right? That's right.
12:15
That's right. It's.
12:16
Been like, it's been like that for like 20 years.
12:18
You don't think they know that yet, though?
12:20
They might not. They might not know that yet.
12:23
Yeah, but. Yeah.
12:25
So, well, and then I was talking to a good friend, Mark today
12:28
because I had another case, you know, I'm at up to about
12:31
56,000,000 emails and it's still going like 2 1/2 days later.
12:37
And we were talking about like the problems with emails and
12:40
parsing it. And even today still a problem
12:44
parsing emails to some of the different tools.
12:46
And then we were talking about like old problems.
12:49
And because, you know, we were talking about trying to find
12:51
this stuff in the NTFS manually or with a different tool.
12:55
And he was like, you remember way back when, when FTK and this
12:58
is probably, I don't know, 15-18 years ago, maybe, maybe maybe
13:03
20, probably was 20 years ago. God, how did that happen?
13:07
But anyways, and there was like, if a folder entry was somehow
13:11
slightly corrupted or just have like a little flip of something,
13:16
then FDK wouldn't report it. And people were like, I know
13:19
that's folders there. Or I can see it in like FDK
13:23
imager. I saw this folder, but now I'm
13:25
not seeing it in FDK. So like this stuff kind of
13:28
happens, it's your tools. And so you know that part of the
13:31
conversation was you don't know what you don't know.
13:34
And so if you're comfortable with the tool, you can kind of
13:36
be like, what is this strange, unusual behavior that's
13:39
happening? Either because it's a new
13:40
version of the tool, a new release, or something is wonky
13:45
with your evidence. And sometimes you know what you
13:47
have to look for and sometimes you know that it should be
13:50
there, but other times you just don't even know what you're
13:52
missing because you you never knew it was there in the 1st
13:54
place. So one of the great challenges
13:57
that continues to live on in our world.
14:01
And again, it goes back to you got to understand your tools
14:06
when you load it, load a program.
14:08
When you load a case into a tool and you think that it's
14:12
outputted everything and you're not seeing what you think you
14:16
should be seeing, then you probably need to move to another
14:19
tool and process it. So again, goes back to tools are
14:25
great, they're not the answer. You've got to understand those
14:28
artifacts. This is why we're doing 12 days
14:31
of deeper artifacts. Absolutely.
14:34
Okay, we've given you a break from the singing.
14:36
We're going to move on to Day 10.
14:39
Day 10, On the 10th day of forensics, the cloud gave to me
14:44
10 different options to store my data on someone else's computer.
14:48
So we're talking OneDrive, Google Drive, iCloud, Fox,
14:54
Dropbox, Proton Drive. But now we're going to get into
14:57
a couple of maybe not so popular, maybe you haven't heard
15:00
about them, but there's P cloud Mega Trisorit and Sync and sync
15:06
is at sync.com. Just to, to make it obvious if
15:09
you're like sync, what do you mean by sync?
15:10
It is a website. It's not just like an action,
15:12
but anyways, so while the cloud can make investigations more
15:17
complex in terms of trying to seize everything, but once you
15:22
got it, the cloud can provide you with a treasure of the data
15:26
the user forgot all about. And the cloud, the artifacts you
15:30
find there can reveal, you know, the deleted files, different
15:34
versions of files, maybe some of the travel history.
15:36
You know, all that Google stuff got a lot of stuff, especially
15:39
if they have an Android, all that stuff really lives together
15:42
in a Google Drive in the cloud and all that stuff in the Google
15:46
ecosystem. And you know, all their products
15:49
are intertwined. So you've got stuff syncing
15:51
across Everything, Everywhere, all your devices and phones and
15:54
the cloud. So it's very interwoven.
15:56
Lots of great stuff there. But you can also see what they
15:59
were uploading, you can see different shares and you might
16:03
even get some clues about devices of the past.
16:07
That's right. That's right.
16:08
And additional accounts, I mean like the amount of information
16:12
that the cloud can produce if you just if you know what to
16:16
look for. Yeah, absolutely.
16:17
OK. On the 11th day of forensics, AM
16:24
gave to me 11 volatile findings. So volatile I can't even say it.
16:33
Volatile memory captures credentials, running processes,
16:39
loaded modules, active network connections, and even artifacts
16:44
like ransomware notes. Before the malware finishes
16:48
encrypting the system, it reveals what was happening, the
16:51
exact moment of compromise, often exposing activity that
16:57
never touches the disk. Memory doesn't lie, and it
17:01
disappears too quickly to cover its tracks.
17:05
So this is one place that I think doesn't get enough credit
17:12
for where data can live and stay alive, right?
17:18
And we all, you know, just have to remember computer people like
17:23
ourselves, we have a lot of programs running, a lot of
17:26
things going on on our computer. And that memory is keeping up
17:30
with all of it, right? Especially in our big exam
17:33
machines because we got a lot of RAM on those.
17:35
So that's right, a treasure trove.
17:37
Right. And so you know, that's that's
17:40
exact and and you know, your suspects who don't understand
17:45
how it works don't realize that that data sit up in the in the
17:49
memory and can be. Captured can be.
17:53
Looked at and there's some good tools out there for volatile
17:57
memory forensics, so yeah, yeah. Well, and you know, we're so
18:01
old. I'm sorry experience that he he
18:05
started out in the days of, you know, we're just going to pull
18:07
the plug every time. And then we started getting more
18:11
encryption issues. So it became the motivator to,
18:14
OK, well, let's leave the machine on.
18:17
If it's on, at least, you know, look to see if there's
18:20
encryption. And then if there was
18:22
encryption, you know, sometimes we were capturing the RAM or we
18:25
were just imaging it live. But then because of that, we
18:29
finally kind of get more of the motive of if this was the victim
18:33
system before we were shutting it off, let's capture that RAM.
18:38
And then again, that required a lot of education with the case
18:42
agents who are going out there and seizing stuff and being
18:45
like, OK, you know, if it's this type of case, give me a call.
18:50
I will come with you. And let's not just pull the
18:52
plug. Let's see if we could do a RAM
18:54
capture and get some extra clues as to what is going on on the
18:58
system. So, you know, it's it's always a
19:02
constant communication battle. And I don't know how many
19:04
today's out there in the field, even though you know, it's 2025,
19:09
you know, how many times are the officers that are responding
19:12
just pulling the plug and and bringing stuff in?
19:15
How much more could we have known if we have a brand?
19:20
That's right. That's right.
19:21
That's right. I mean, and, and again, I don't
19:23
think it's, it's taught like it should be taught and and it's
19:27
trained like it should be trained.
19:29
That's right. I mean, because there's just not
19:31
enough people to do the amount of work that needs to be done on
19:36
digital evidence. But you know, if one person
19:39
knows not to pull the plug, grab the memory first.
19:42
I'd help you out. Yeah, for sure.
19:43
And, and you mentioned that, you know, the problem,
19:46
communication, training, personnel, time, resources,
19:50
priorities, you know, to just grab RAM in every single case,
19:55
you know, it's not going to happen, but to eventually get
19:58
people to understand when might it be a good idea to take that
20:02
extra step. And also one of the things I see
20:06
with my students a lot is they're like, we should turn the
20:09
computer back on and now capture the RAM.
20:12
And it's like, no, it's too late now to capture the RAM,
20:18
especially after that computer has been.
20:21
Sitting in evidence control for a while.
20:23
So please, please do not power the computer rack on and capture
20:26
the RAM. Especially do not do that before
20:28
you have pitched the hard drive. But that's learning.
20:32
They're students. So, you know, that's something
20:33
we need to make clear, you know, when should you capture the RAM?
20:37
Right when that's. Right when you get values from
20:39
it. Yeah, when will you get value?
20:42
All right. OK.
20:44
On the 12th day of forensics, the network gave to me 12 packet
20:50
captures. That was nice, right?
20:53
That was. Nice.
20:53
It was so nice. All right.
20:55
OK, so we've got think P caps, firewall logs, DNS queries.
21:01
The trail of compromise nearly always starts or ends on the
21:06
network. So if you want to understand
21:09
that attack chain network artifacts are going to be your
21:13
last and only bread, kelp bread from trail.
21:19
But remember this day and age, you know, we've got to go beyond
21:23
the physical devices and appliances themselves to get the
21:27
logs, especially if you're in a large, large organization.
21:31
Check with them and see if they're running a SIM like
21:34
Splunk or logarithm. There's a whole variety of them
21:37
out there. But because if they're running a
21:39
SIM, it is probably holding many, many more days worth of
21:44
logs than that actual appliance. So that can give you many clues.
21:49
I mean, the discovery days of finding the intrusion is
21:52
certainly going down, but it's still not like, you know, 15
21:56
days sort of situation. So you very well might need to
21:59
jump way back and hop on the SIM to get that stuff.
22:02
That's right. That is right.
22:04
So that was your 12 days. Let's go through them one more
22:07
time. Are we to sing them all for
22:09
everybody, or should we? Let's.
22:11
Just go through and seeing the one liner before we close out
22:15
tonight. OK, OK, Ready.
22:18
Me. Me.
22:18
Me. Me.
22:20
On the first day of forensics, the disc gave to me a master
22:25
file table entry. On the second day of forensics,
22:30
Windows gave to me two shell bag entries.
22:33
On the third day of forensics execution gave to ME3 prefetch
22:40
loads. On the 4th day of forensics
22:43
logging gave to me 4 EBT logs. On the 5th day of forensics,
22:49
Chrome gave to me 5 browser histories.
22:58
On the 6th day of forensics, iOS gave to me 6 app usage
23:03
artifacts. On the 7th day of forensics,
23:07
Windows gave to me 7 jump list jumping.
23:12
On the 8th day of forensics the registry gave to me 8 registry
23:17
keys. On the 9th day of Forensics, NT
23:22
FS gave to me 9 journal updates. On the 10th day of forensics,
23:29
the cloud gave to me 10 different options to store my
23:33
data on someone else's computer. On the 11th day of forensics
23:38
gave to me 11 volatile findings. On the 12th day of forensics,
23:45
the network gave to me well packet captures.
23:49
Well, thank you all for putting up with us.
23:52
We have had a wonderful time putting this together in our
23:55
little 12 days of deeper artifacts.
23:59
And that wraps up our forensic holiday countdown.
24:03
Whether you're investigating ransomware insider threads or
24:07
that mysterious I swear I didn't click it instant, these 12
24:13
artifacts are your go to's from all of us at parsing the truth
24:17
one bite at a time. We wish you safe, secure and
24:20
artific artifact rich holiday season.
24:25
So stay safe, stay sharp, and keep parsing the truth one bite
24:29
at a time. If you enjoyed this episode,
24:32
make sure to follow us to get notified the next time a new
24:36
episode drops. If you can do more, head on over
24:40
to parsingthetruth.com and donate by clicking on the donate
24:44
button. Parsing the Truth is a nonprofit
24:46
organization and we are raising money to send a new digital
24:49
forensic examiner to I Asus training next year in Orlando.
24:54
Thanks.