Practical Windows Forensics — LetsDefend
Hello,
Today, I will explain some important points covered in the Practical Windows Forensics and solve the module questions.
This module explains the basics of Digital Forensics on Windows systems and how to collect and analyze digital evidence from Windows devices.
It also covers Windows Live Response, File Systems, Disk Image Analysis, Windows Event Log Analysis, Windows Registry Forensics, as well as tools and techniques used to collect digital evidence.
Let’s get started.
1- Windows Live Response
Windows Live Response is the process of collecting evidence and information from a Windows system while it is still running. This is important because some Volatile Evidence can be lost once the system is shut down or restarted.
During Live Response, we collect important information that helps us understand the Incident, such as:
- System Time: Check the system time and Time Zone to build an accurate timeline of events.
- Running Processes: Examine the current Processes and identify any suspicious Process or Malware.
- Clipboard: Check the data copied by the user, which may contain sensitive information.
- Logged Users: Identify the users and active Sessions on the system.
- Command History: Check the commands that were executed through PowerShell or CMD, which may help identify attacker activity.
- Open Files: Identify currently open files and the Processes or users interacting with them.
- Network Connections: Examine current connections and Listening Ports to identify suspicious connections or services.
- Memory Forensics: Analyze the RAM to obtain information such as Processes, Network Connections, and data stored in memory.
Note: In real-world DFIR, we need to be careful about restarting the system because this can lead to the loss of Volatile Evidence. Therefore, it is preferable to collect Volatile Data first before performing any action that may change the system’s state.
Q1: What is the time zone of the system you are accessing?
We will start the Lab and connect to it using RDP with:
- Username:
letsdefend - Password: No password
After connecting to the Lab, we will open PowerShell and run:
Get-TimeZoneThis command displays the system’s Time Zone.
From the Output, we can see:
Id : UTC
DisplayName : (UTC) Coordinated Universal TimeTherefore, the system’s Time Zone is:
Answer: Coordinated Universal TimeQ2: Check the commands run on Powershell. What is the name of the file downloaded by the ‘wget’ command? Answer Format: filename.extension
This question asks us to find the name of the file that was downloaded using the wget command.
At first, I thought about using Get-History, but this command only shows the Command History of the current PowerShell Session.
So, I searched for the location of the file that stores the PowerShell History using:
(Get-PSReadlineOption).HistorySavePathIt showed us the location of the History file:
C:\Users\LetsDefend\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
Then, I used the type command to read the file:
type C:\Users\LetsDefend\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txtFrom the History, we can find the following command:
wget https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0-20220919/mimikatz_trunk.zip
Therefore, the name of the downloaded file is:
Answer: mimikatz_trunk.zipQ3: Examine commands executed on PowerShell. What is the name of the application used for the ‘MITRE T1490 — Inhibit System Recovery’ technique? Answer Format: toolname.extension
At first, I did not know what MITRE ATT&CK T1490 — Inhibit System Recovery meant or how to identify it. So, I went to the MITRE ATT&CK website and read about the technique.
I found that this technique is related to deleting or disabling System Recovery features, such as Volume Shadow Copies, to prevent the system from being recovered.
While checking the PowerShell history, I found this command:
vssadmin.exe delete shadows /all /quiet
This command deletes all Volume Shadow Copies from the system, which matches the T1490 — Inhibit System Recovery technique.
Therefore, the application used for this technique is:
Answer: vssadmin.exeQ4: What is the name of the process listening on port 5458 on the system you are accessing? Answer Format: powershell.exe
First, we will use the following command:
netstat -abno | findstr 5458This command displays Network Connections and Listening Ports. We use findstr 5458 to search for the required port.
From the output, we can see that port 5458 is in the LISTENING state, and the PID of the Process is:
7804Next, we use:
Get-Process -Id 7804This command displays information about the Process using its PID.
We can see that the Process name is:
ncat
Therefore, the answer is:
Answer: ncat.exeQ5: What protocol does port 5458 use in LISTEN mode on the system you are accessing? Answer Format: UDP
We will use the following command:
netstat -abno | findstr 5458This command displays Network Connections and Listening Ports. We use findstr 5458 to identify the required port.
From the output, we can see that the Protocol at the beginning of the line is:
TCPSince port 5458 is in the LISTENING state, the protocol being used is:
Answer: TCPQ6: What is the last time the user ‘support01’ logged on to the system you are accessing? Answer Format: M/D/YYYY HH:MM:SS AM
We will use the following command:
net user support01This command displays information about the User Account, including the Last logon, which shows the last time the user logged into the system.
From the output, we can see:
Last logon 6/1/2024 10:04:46 PMTherefore:
Answer: 6/1/2024 10:04:46 PMQ7: From which directory in “C:\\Windows\\” does the process “ncat.exe” load files (modules, etc.)? Answer Format: directoryname
We will use the following command:
openfiles /query /fo list /vThis command displays currently open files and the Processes using them. This helps us identify the files or Modules that a Process can access.
We will search the output for the Process:
ncat.exe
From the output, we can see that ncat.exe is using files from:
C:\Windows\SysWOW64Since the question asks for the name of the Directory inside C:\Windows\, the answer is:
Answer: SysWOW642- Windows File Systems
A File System is responsible for organizing, storing, and managing files on Windows systems. The main types we work with are NTFS, FAT32, and exFAT.
NTFS
NTFS is the primary File System used in modern Windows versions. It provides important security features and capabilities for Forensics.
Get Mohammed Gbreil’s stories in your inbox
Join Medium for free to get updates from this writer.
Some of the main Security Features are:
- ACL: Defines the permissions of users and Groups on files and Folders.
- EFS: Used to encrypt files and protect them from unauthorized access.
Some important Forensic Artifacts in NTFS are:
- MFT (Master File Table): Contains Records for files and Folders, along with important information such as the name, timestamps, size, and file location.
- USN Journal: Records changes made to the File System, such as file creation, modification, and deletion.
FAT32 and exFAT
They are commonly used with USB Drives, SD Cards, and Portable Storage.
- FAT32: An older File System that is compatible with many devices and systems, but it has a maximum file size of 4 GB.
- exFAT: Designed to overcome the limitations of FAT32 and supports larger files and Partitions, making it suitable for Large Storage and Media Files.
In Forensics, FAT and exFAT can be used for Deleted File Recovery, Timestamp Analysis, and tracking user activity.
It is important to note that FAT32 does not contain an MFT, but deleted files may still remain on the Disk until they are overwritten, allowing them to be recovered in some cases.
Summary
Understanding the File System is very important in Windows Forensics because the way files are stored and managed determines the evidence we can extract.
NTFS → MFT + USN Journal
FAT32 → Common in Portable Media + 4 GB file size limit
exFAT → Portable Storage + Supports large files
Q1: What is the file system of the ‘C:’ drive of the system you are accessing? Note: Type the abbreviation of the answer.
We will use the following command:
Get-VolumeThis command displays information about the Volumes on the system, including the File System used by each Drive.
From the output, we can see that the C: Drive uses:
NTFSTherefore:
Answer: NTFSQ2: Which Windows file system does not support files larger than 4GB?
FAT32 does not support files larger than 4 GB, as the maximum file size supported by FAT32 is approximately 4 GB.
Answer: FAT323- Analyzing Windows Disk Images
In this section, we learned how to create a Disk Image and analyze it using Digital Forensics tools such as FTK Imager.
A Disk Image is a Bit-by-Bit copy of a Disk or Partition. It contains existing files, Deleted Data, and Free Space, along with the File System and Metadata.
Creating a Disk Image
Using FTK Imager, we can create an Image from:
- Physical Drive: Creates a copy of the entire Disk, including all Partitions, Free Space, and Deleted Data.
- Logical Drive: Creates a copy of a specific Partition or Drive, such as
C:.
After creating the Image, we use a Hash such as MD5 or SHA-1 to make sure the Evidence has not been changed.
Analyzing the Image
After adding the Image to FTK Imager, we can analyze:
- File Systems such as NTFS, FAT, and exFAT.
- File Metadata and Timestamps.
- Deleted Files and attempt to recover them.
- Windows and Application Logs.
- Raw Data using the Hex View.
- File Hashes.
One important example is that deleted files from Windows may be found inside:
$RECYCLE.BINFTK Imager Interface
The main parts of the interface are:
- Evidence Tree: Displays the Directory Structure and allows us to navigate through Folders.
- File List: Displays files and information such as the name, type, size, and Modified Date.
- Custom Content Sources: Used to select and collect specific data sources for analysis.
- Hex Value: Displays the Raw Data in Hex and allows us to analyze File Headers, Metadata, and deleted or hidden data.
Summary
Disk Imaging is an essential step in Digital Forensics because it allows us to work on a copy of the Evidence instead of the Original Disk, while preserving the integrity of the evidence and verifying it using Hashing.
FTK Imager helps us examine the File System, recover deleted files, analyze Metadata and Logs, and inspect Raw Data.
Q1: What is the file system format of the ‘DATA’ partition in the disk image file ‘datadisk.001’ in ‘C:\\images\’ on the system that you have accessed?
I used FTK Imager and opened the Disk Image:
C:\images\datadisk.001After opening Partition 1, we can see a partition named DATA, and the File System is shown as:
DATA [FAT32]
Therefore, the File System of the DATA partition is:
Answer: FAT32Q2: Analyze the ‘datadisk.001’ disk image under ‘C:\\images\’ in the system you accessed with FTK Imager, what is the filename in ‘$RECYCLE.BIN’ of the ‘C:\\images\\wp-config.php’ file? Answer Format: $AOSDHJ97.ASP
I used FTK Imager and opened the Disk Image:
C:\images\datadisk.001Then, I navigated to:
DATA → [root] → $RECYCLE.BINWe can see two files with almost the same ID:
$IRVN8R9.PHP
$RRVN8R9.PHP
In the Windows Recycle Bin, deleted files have an $R file that contains the actual deleted file, while the $I file contains the file’s Metadata.
Therefore, the file corresponding to wp-config.php is:
Answer: $RRVN8R9.PHPQ3: What is the password for the Wordpress database in the ‘wp-config.php’ file that has been deleted from the ‘wordpress’ directory in the ‘datadisk.001’ disk image under ‘C:\\images\’ on the system that you are accessing?
This question asks us to find the Password for the WordPress Database stored in the deleted wp-config.php file inside the wordpress directory.
At first, I had a problem using FTK Imager, because the file content was not displayed even after exporting the file.
So, I used Autopsy to analyze the Disk Image. I searched for the deleted wp-config.php file inside the wordpress directory.
After opening the file, we can find the Database Password:
define('DB_PASSWORD', 'S3CR3T');
Therefore, the WordPress Database Password is:
Answer: S3CR3TQ4: What is the MD5 hash value of the file ‘employees.sql’ in the ‘db’ directory in the ‘datadisk.001’ disk image in ‘C:\\images\’ in the system that you are accessing?
This question asks us to find the MD5 Hash of the employees.sql file.
I used FTK Imager and opened the Disk Image:
C:\images\datadisk.001Then, I navigated to:
DATA → [root] → dbI right-clicked on the employees.sql file and selected:
Export File Hash List
FTK Imager created a file containing the MD5 and SHA1 Hashes of the file.
From the generated file, we can see that the MD5 value is:
Answer: cf6f344038f0e6ce62743d95e782a8d4That’s the end of this write-up.
Don’t forget to follow me on Medium for more CTF and DFIR write-ups.
For networking and professional connections, you can also reach me on LinkedIn.
Thank you for reading .
