ZENA FORENSICS

I must admit I did not expect so many acknowledgments by writing the  volatility mimikatz plugin . I want to say thanks to all people that tweeted, emailed - and so on - me: it is just a piece of the puzzle, and the big pieces are those from  volatility  and from  mimikatz . First, I want to say thanks to  Andrew Case , for the support and for having tweeted about the plugin: probably all those  acks  are because Andrew is an uber-well-known DFIR expert! Then I want to say thanks to  Kristinn Gudjonsson , my favorite  plaso  “ harsh ” reviewer, who spotted some “ devil ” (you wrote it! ;) issues in my code, as the multiple inheritance I used… lol, I will fix it! Last but not least I want to once again say thanks to  Benjamin  aka  gentilkiwi , who wrote an e-mail to me making the congratulations for the plugin. With this post, I want to point out some  features of mimikatz  that I had not considered in t...

In one of my recent cases, I needed to recover the windows user password: I had different OSes with various levels of cryptography, mainly at file level. Usually I think it's a good approach to recover as many hints as possible, to derive a scheme and/or to find a way to access the data.  ODI I like to call it ODI ( Offensive Digital Investigations , in Italian "odi" means hear , find out ). I remember an old case where I got 500+ strong encrypted archives... too many without a password catalog. I searched for the weakest protection and I found three zip-crypto (not a strong protection) archives: I cracked them in few days and then I was able to derive the schema to access all of them. I was lucky. This time I felt that the Windows user password was the... key. Usually the dirty work is made with rainbow tables, but no way: I was unable to crack the Windows 7 user password. mimikatz I don't remember exactly why I was playing with mimikatz (hem, c...

Some days ago I was working on four images coming from a QNAP storage: so, four disk whose partitions were used to build up RAID volumes. " No problem " I said to myself, knowing that QNAP are *nix based and that XWF (X-Ways Forensics) is so powerful that I'll not need to switch on Linux. Which RAID? That's true, but you need to instruct XWF about which type and parameters the RAID is using. Easy again, let's find the configuration  raidtab file. Here is it:    raiddev /dev/md0     raid-level               0     nr-raid-disks            4     nr-spare-disks           0     chunk-size               4     persistent...

In DFIR activities timelines are often determinant to understand what happened (lot of refs here ). Luckily Kristinn Gudjonsson provided the community with the great log2timeline tool ( here , from now l2t ) that, along with the invaluable Brian Carrier 's SleuthKit , gives a (temporal) order to chaos . But l2t is not currently considering valuable artifacts coming from wtmp / btmp files on Linux systems. wtmp (utmp? btmp!) For a rapid introduction to those files let's see what wikipedia says about them: " utmp, wtmp, btmp and variants such as utmpx, wtmpx and btmpx are files on Unix-like systems that keeps track of all logins and logouts to the system . The utmp file keeps track of the current login state of each user . The wtmp file records all logins and logouts history . The btmp file records failed login attempts . The utmp, wtmp and btmp files were never a part of any official Unix standard, such as Single UNIX Specificat...

In the last case... I was feeling that some Internet Explorer artifacts were missing, so I decided to take a look at RegRipper plugins that parse the user registry NTUSER.DAT to see if they could help me. Honestly I have not a clear idea on where to search for a sign since I usually get information from IE cache files and not from registry. RegRipper IE plugins mini-survey Actually there exist 4 Internet Explorer plugins, being: ie_main: ( NTUSER ) despite the reported description in the source file header (" the plugin Checks keys/values set by new version of Trojan.Clampi ") the plugin parses (details later) the " Software\Microsoft\Internet Explorer\Main " key and it was written by Harlan Carvey at 19/09/2009. ie_settings: ( NTUSER ) the plugin reports the User Agent string used by IE when visiting sites and the ZoneSecurityUpgrade value inside the " Software\Microsoft\Windows\CurrentVersion\Inter...