ZENA FORENSICS

I'm not really sure that everybody knows that Rekall memory forensics framework contains a Mimikatz   plugin: with this post I want to address this shortcoming, since the plugin has many good features and it can be easily extended. behind the scenes The act of rekall-ing Mimikatz started when I met Michael Cohen in Prague (SANS DFIR 2014) and a few months later in Dublin (DFRWS 2015). Despite the fact that I learnt so much by speaking with Michael, he deserves the credits to have pushed this plugin development: he released a first version on April 2015, based on what I did with Volatility (see et voilà le mimikatz offline ). So by hangout-ing during the night, we co-authored the actual Rekall mimikatz plugin : it was an awesome dive in Windows memory and Rekall internals, guided by Michael who truly has a talent for explaining complicated things in a simple way. Before going further credits and thanks must go to the awesome reverse engineering research made by Benjamin

Windows Phone  8 and greater allows the user to lock/unlock the phone by using a numeric PIN code: it's even possible to use a complex  alphanumeric password. This post addresses how to obtain the simple  numeric PIN code by cracking the authenticator  kept in the SOFTWARE hive. an useless quest? Actually if you have a physical  access to a Windows Phone you don't need the user pincode to examine the user data: with the proper hardware you can usually get a whole dump of the un-encrypted device memory. To my current knowledge the pincode is not used anywhere if not for device locking, so it's almost useless to know it. If the device is under a properly configured MDM, you could face a fully encrypted phone with TPM: in this case you'll have no chance to crack the pincode, even if more testing should be done. This is exactly what I thought when my colleague Mattia Epifani tried to lure me with the Windows Phone PIN issue: he knows the curious monkey inside me.

Windows 10 prefetch files (*.pf) show a different file format compared to previous ones.  At first glance you'll spot no   textual   strings inside, and this was the initial reason that make me try to understand how they changed. quick&dirty journey I guess that neither you nor I will run into Windows 10 DFIR cases for a while. That's what I thought when Claudia Meda ( @KlodiaMaida ) contacted me, showing me a couple of Windows 10 prefetch files. She then provided me some interesting clues that tickled the curious george monkey  in me. Officially I do not have spare time, since it's already allocated, so I illegally used the non-existent spare time of spare time: please don't betray me... so I hope you'll tolerate any shortcuts in my quick&dirty  journey into the entrails of windows (disgusting, isn't it?). first lead First, what a nude prefetch file has to say? Check the first bytes in the next figure, which shows a prefetch file

The latest iOS update (iOS 8.3) is a real nightmare for digital forensics specialists. This article will try to clarify what can you really obtain from an iOS device with iOS 8.3. As we already know from Jonathan Zdziarski blog , with the introduction of iOS 8 is no longer possible to obtain a so called "Advanced Logical" acquisition based on lockdown service. However, when we find a device without passocode it is still possible to obtain a backup, although it may be password protected if the user has previously set a password for the local backup. In the same way we can perform a backup if we find a turned on and locked device, but only if we are able to find a pairing lockdown certificate and the device has been unlocked at least once by the user before the seizure. The same problem about an eventual backup password previously set by the device owner applies to this case too. The real nightmare is when, and this is the most common case, we have to acquire

In my own vocabulary, undesxing is the action of decrypting something encrypted with the Microsoft version of the DESX algorithm: a bit obfuscated title but I liked to make a scenographic use of it. DESX is a variant of the Data Encryption Standard in that a XOR step is added to the plaintext before and after the encryption: you can find a description on wikipedia . So, what is the issue with it? Let me provide the context. windows lsass The Windows Local Security Authority ( LSA ) Subsystem Service ( lsass ) process is in charge, among other things, to authenticate and log users on to the local system: see Microsoft info here . It's well known that it keeps some sensitive information regarding the logon sessions: for example users' passwords and tokens. This kind of storage - basically due to the SSO capability - is exploited by the never-loved-enough mimikatz , which is able to provide some cool passive (not considering its active operation modalities) informa

Last October, I participated as speaker at the SANS DFIR Summit in Prague . It was a great meeting and I am very happy to have been able to participate. My speech was focused on DPAPI , the Windows Data Protection API , and how it could be used during a post-mortem digital investigation to access protected information: overcoming system's security it's sometimes necessary to access data otherwise not available. I like to call this "process" ODI , Offensive Digital Investigations . I want to be brief, skipping any DPAPI introduction and only providing some links for readers who don't know what DPAPI might be. Consider simply the fact that the technology was introduced with Windows2000(!!) and you and/or your system/applications use it every day... Moreover, if you wonder how wifi passwords are protected, how IE or Chrome treats saved credentials, how Dropbox encrypts its databases, how iCloud protects user credentials, how EFS ( Encrypting File System ) gets