ZENA FORENSICS

Windows 10 prefetch files (*.pf) show a different file format compared to previous ones.  At first glance you'll spot no   textual   strings inside, and this was the initial reason that make me try to understand how they changed. quick&dirty journey I guess that neither you nor I will run into Windows 10 DFIR cases for a while. That's what I thought when Claudia Meda ( @KlodiaMaida ) contacted me, showing me a couple of Windows 10 prefetch files. She then provided me some interesting clues that tickled the curious george monkey  in me. Officially I do not have spare time, since it's already allocated, so I illegally used the non-existent spare time of spare time: please don't betray me... so I hope you'll tolerate any shortcuts in my quick&dirty  journey into the entrails of windows (disgusting, isn't it?). first lead First, what a nude prefetch file has to say? Check the first bytes in the next figure, which shows a prefetch file...

The latest iOS update (iOS 8.3) is a real nightmare for digital forensics specialists. This article will try to clarify what can you really obtain from an iOS device with iOS 8.3. As we already know from Jonathan Zdziarski blog , with the introduction of iOS 8 is no longer possible to obtain a so called "Advanced Logical" acquisition based on lockdown service. However, when we find a device without passocode it is still possible to obtain a backup, although it may be password protected if the user has previously set a password for the local backup. In the same way we can perform a backup if we find a turned on and locked device, but only if we are able to find a pairing lockdown certificate and the device has been unlocked at least once by the user before the seizure. The same problem about an eventual backup password previously set by the device owner applies to this case too. The real nightmare is when, and this is the most common case, we have to acquire...

In my own vocabulary, undesxing is the action of decrypting something encrypted with the Microsoft version of the DESX algorithm: a bit obfuscated title but I liked to make a scenographic use of it. DESX is a variant of the Data Encryption Standard in that a XOR step is added to the plaintext before and after the encryption: you can find a description on wikipedia . So, what is the issue with it? Let me provide the context. windows lsass The Windows Local Security Authority ( LSA ) Subsystem Service ( lsass ) process is in charge, among other things, to authenticate and log users on to the local system: see Microsoft info here . It's well known that it keeps some sensitive information regarding the logon sessions: for example users' passwords and tokens. This kind of storage - basically due to the SSO capability - is exploited by the never-loved-enough mimikatz , which is able to provide some cool passive (not considering its active operation modalities) informa...

Last October, I participated as speaker at the SANS DFIR Summit in Prague . It was a great meeting and I am very happy to have been able to participate. My speech was focused on DPAPI , the Windows Data Protection API , and how it could be used during a post-mortem digital investigation to access protected information: overcoming system's security it's sometimes necessary to access data otherwise not available. I like to call this "process" ODI , Offensive Digital Investigations . I want to be brief, skipping any DPAPI introduction and only providing some links for readers who don't know what DPAPI might be. Consider simply the fact that the technology was introduced with Windows2000(!!) and you and/or your system/applications use it every day... Moreover, if you wonder how wifi passwords are protected, how IE or Chrome treats saved credentials, how Dropbox encrypts its databases, how iCloud protects user credentials, how EFS ( Encrypting File System ) gets...

We want to share with you a list of bookmarks related to hardware and software tools for Digital Forensics acquisition and analysis. The bookmark file is in Mozilla Firefox, so it can be directly imported into it. You can download the file from http://www.realitynet.it/bookmarks.html If you are interested in adding a tool to our list, please contact me at mattia @ realitynet.it.

I must admit I did not expect so many acknowledgments by writing the  volatility mimikatz plugin . I want to say thanks to all people that tweeted, emailed - and so on - me: it is just a piece of the puzzle, and the big pieces are those from  volatility  and from  mimikatz . First, I want to say thanks to  Andrew Case , for the support and for having tweeted about the plugin: probably all those  acks  are because Andrew is an uber-well-known DFIR expert! Then I want to say thanks to  Kristinn Gudjonsson , my favorite  plaso  “ harsh ” reviewer, who spotted some “ devil ” (you wrote it! ;) issues in my code, as the multiple inheritance I used… lol, I will fix it! Last but not least I want to once again say thanks to  Benjamin  aka  gentilkiwi , who wrote an e-mail to me making the congratulations for the plugin. With this post, I want to point out some  features of mimikatz  that I had not considered in t...

In one of my recent cases, I needed to recover the windows user password: I had different OSes with various levels of cryptography, mainly at file level. Usually I think it's a good approach to recover as many hints as possible, to derive a scheme and/or to find a way to access the data.  ODI I like to call it ODI ( Offensive Digital Investigations , in Italian "odi" means hear , find out ). I remember an old case where I got 500+ strong encrypted archives... too many without a password catalog. I searched for the weakest protection and I found three zip-crypto (not a strong protection) archives: I cracked them in few days and then I was able to derive the schema to access all of them. I was lucky. This time I felt that the Windows user password was the... key. Usually the dirty work is made with rainbow tables, but no way: I was unable to crack the Windows 7 user password. mimikatz I don't remember exactly why I was playing with mimikatz (hem, c...

Some days ago I was working on four images coming from a QNAP storage: so, four disk whose partitions were used to build up RAID volumes. " No problem " I said to myself, knowing that QNAP are *nix based and that XWF (X-Ways Forensics) is so powerful that I'll not need to switch on Linux. Which RAID? That's true, but you need to instruct XWF about which type and parameters the RAID is using. Easy again, let's find the configuration  raidtab file. Here is it:    raiddev /dev/md0     raid-level               0     nr-raid-disks            4     nr-spare-disks           0     chunk-size               4     persistent...