Forensically Important Artifacts in Windows Operating systems

Transcription

1 1. Introduction Forensically Important Artifacts in Windows Operating systems Bhanu Prakash Kondapally Digital Forensic Lead, Digital Forensic CoE TCS Enterprise Security And Risk Management. Windows is the most commonly examined operating system among other Operating Systems in the field of Digital/ Host forensics. With versions ranging from windows XP to Windows 10, the windows system store different types of evidence related to the user activity on the computer systems. Most of the forensic investigations will revolve around traditional areas (user created, user protected data) such as active, deleted files, password/encrypted files etc., but not around non traditional areas (System created data/ Artifacts). This write-up talks about some of the areas which are often ignored/overlooked by several forensic examiners while working on the digital evidence. 2. Artifacts Artifacts are objects or areas within a computer system that hold important information relevant to the activities performed on the computer by the user. The Location and type of information contained in the artefacts differs from one operating system to another. These artefacts have to be identified, properly processed and information contained in them has to be analyzed to prove or disprove an observation made during the forensic analysis. However, absence of information in a particular artifact doesn t mean that the activity did not occur in the computer system. There are multiple artefacts in Windows environment that serve as important evidence in the forensic analysis of Digital media. The types and location of artefacts may also vary among the different versions of Windows operating system. Below is the list of important artefacts that have been explained further in the document. S.No Artifact Name Location/Information 1 Registry Artefacts C:\Windows\System 32\Registry hive files 2 Windows event Logs C:\Windows\System32\winevt\Logs 3 Volume shadow copies System volume information of each partition 4 MFT in NTFS File systems Boot partition of the system 5 Browser Artifacts Contained in the browser installation folders 6 Link Files C:\Users\User\AppData\Roaming\Microsoft\Windows\Recent 7 Prefetch Files C:\Windows\Prefetch 8 User-assist keys Windows Registry 9 USNJRNL Partition\Extend\$UsnJrnl:$J 10 Shell bags C:\User\ Local Settings\Software\Microsoft\Windows\Shell 11 Taskbar Jumplists C:\Users\Default\AppData\Roaming\Microsoft\Windows\Rece nt

2 2.1 Registry Registry is a treasure trove of information for a forensic analyst. It is a hierarchical database that contains the default/system and user-defined setting in a Windows computer system. Registry serves as repository, monitoring and recording the activities that a user performs on the systems in the form of registry entries. Windows registry is organized into Hives, Keys and sub-keys which contain relevant values. The registry can be rebuild off-line from the hive files such as SYSTEM, SOFTWARE, SAM, SECURITY, and USERDIFF contained in the path C:\Windows\System32. Information such Computer Name, OS installation dates, Programs installed & uninstalled, USB devices connected, most recently used/accessed files, IP addresses, Network shared information, information about the user-level activity and malware activity can be obtained from the analysis of registry. Tools such as Regripper, regview, Mitec Registry viewer and many commercial forensic tools have the ability to parse the off-line registry files and display the information contained in them. 2.2 Windows event logs Figure-1 Registry Information Windows event logs record the computers notifications and alerts that are generated as a result of user activity. These instances are referred as events and are identified with event id. Windows event logs can be viewed from in-built application known as EventViewer.exe when system is up and running. In an off-line state or from the forensic image these windows event log files can be located in the path C:\Windows\System32\winevt\Logs. Log files such as SecEvent.evtx, SysEvent.evtx, AppEvent.evtx are the most commonly examined event log files. The Parsing and examination of event log files reveals important information about user logins and log outs, application activity, user activity, changes that have been made to the default settings such as date & time changing, changes made by the malware activity etc. which would be useful in an investigation.

3 2.2 Volume Shadow Copies Figure-2 Event Log Information Volume shadow copies are the backups/snapshots that are periodically created for each volume in the disk by Volume Shadow copy service. These shadow copies serve as historical snapshots and reveal important information about the files and data that is not readily available during examination. By identifying, parsing and examining the volume shadow copies the forensic examiner can obtain information about the previous versions of files, directories and volumes on the subject hard drive. Volume shadow copies also will have historical versions of registry hives, SQL lite databases and other important artifacts that usually do not store much of historical data. Tools such as shadow explorer, Internet Evidence Finder (IEF) can mount and display the volume shadow copies for further analysis. 2.3 Master File Table (MFT) Master File Table is a database in NTFS environment which has information about all the files and folder that are present in the volume. Examination of MFT reveals important information about File sizes, paths, Deleted files etc. MFT sometimes also contain whole files stored in it. These are known as resident files. Because of their smaller size these files are stored in MFT. During the Malware analysis the MFT is also examined to identify any IOCs relevant to the malware activity. Many of the Forensic tools such as Encase, FTK, X-ways and utilities such as MFT ripper, MFTDump, AnalyzeMFT have the ability to parse the MFT file and display its contents. Date Description :54:34 MA.B [8225] C:/$OrphanFiles/ Fraudulent / jpg (deleted) :25:45..C. [8225] C:/$OrphanFiles/Fraudulent/ jpg (deleted) :38:37 MACB [124] C:/$OrphanFiles/ Fraudulent / jpg ($FILE_NAME) (deleted

4 2.4 Windows Shell Bags Figure-3 MFT entries relevant to a case Windows shell bags record/maintain attributes such as the views, shapes, sizes, icons and positions of folder windows that were browsed using windows explorer. The examination of shell bags may provide insights into the folders, browsing history of the user, details of the folders that are currently in deleted condition. The Shellbags are organized in the BagMRU key of the windows registry and are found in different locations of the registry depending on the Windows version of the subject system. Since Shellbags retain information about directories even after the directories are removed/deleted, the parsing and analysis of these artifacts may provide useful information in reconstructing user activity. 2.5 Taskbar Jump lists Jumplists are one of the task bar features introduced from windows 7 that helps the user to view all the recently accessed files based on the file category. It also allows the user to pin their favorite files so that they can be easily accessed. Jumplists are present in *.automaticdestinations-ms format under user profile path C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations and also as *.customdestination-ms files in compound binary format. The jumplist records help the forensic examiner in identifying the files/applications that have been created and accessed by the user. Below figure is an example for the jumplist created for internet explorer application. 2.6 USNJRNL Figure-4 - Jumplists The USNJRNL (Update Sequence Number Journal) file, also known as NTFS Change Journal records all the changes that happens to a file in windows environment. One such journal file is maintained each NTFS volume and stored in the file $Extend\$UsnJrnl. The $UsnJrnl file contains a wealth of information that is useful for a forensic examiner in figuring out what changes have been made in the system. The $UsnJrnl analysis may reveal information about File or directory names, their MFT record numbers, type of change that happened to the files, time of change, reason for change, Security ID and information about the source of such change which would help the examiner to identify the activities that have taken place with respect to the files and folder of the subject computer system. Below figure shows some $UsnJrnl entries that were parsed.

5 2.7 Userassist keys Figure-5 UsnJrnl entries Userassist are a set of registry keys that contain information about the applications and shortcuts accessed by particular user using windows GUI. The information also includes execution count the date of last execution which helps in determining whether a given application has been executed by a particular user of not. The userassist keys are located in the path HKEY_CURRENT_USER\Software\Microsoft\Windows \CurrentVersion\Explorer\UserAssist 2.8 Prefetch Files Prefetch files are created by the windows operating system whenever an application is run from a specific location for the first time. Prefetch files are used to speed up the application startup process. These files are named in a predefined format and the prefetch name consists name of the application, hash notifying the location from which the application was run, and a.pf file extension. The prefetch files are stored in \Root\Windows\Prefetch folder. Analysis of prefetch files reveals the evidence of program execution for a particular user or from a particular location. Prefetch entry may still remain event after the program has been deleted or un-installed. This information together with timeline analysis helps in determining what programs have been executed in the system. 2.9 Link files Link files are also known as Windows shortcut files and are created by both user and operating system, for the files which are frequently used, double-clicked or accessed from a different location apart from system drives such as attached storage or file shares etc. Link files help establishing the existence of files that were accessed using the system and the link file metadata contains information such as MAC (Modified, Accessed, Created) timings of the original file, original path of the file, information about the volume of the system where the file was present (such as volume serial number), Network details if it is stored on a remote system, size of the original file etc. Link files can be parsed by majority of the forensic tools Browser Artifacts Browser Artifacts are generated as a result of user activity on system using different types of internet browsers such as Internet Explorer, Google Chrome, Mozilla Firefox and Safari. The data the gets stored and format in which it is stored may vary from browser to browser but overall the browser artifacts stored important information about user s internet activity such as Websites visited, visit count, date & time Content accessed, uploaded and downloaded fragments/content Chat message contents Google or other searches etc.

6 Significant amount of these artifact s information remains even after the browser data is cleared by the user by using browser in-built options or third party cleaners such as ccleaner. Hence, identification and analysis of browser artifacts helps an investigator to track the internet activity of the user. Figure-6 Internet Browsing History Apart from the above mentioned artifacts there are many other artifacts that will have information about the user activity on the system such as network and cloud storage artifacts (e.g. Google drive), File sharing and P2P applications information, Wi-Fi and Bluetooth hotspots information etc. 3. Conclusion Windows Operating system creates multiple artifacts as a result of user activity on the computer system. When properly identified, processed and analyzed, these artifacts help the forensic examiner in determining the user activities that have taken place in the system, the timeline of such activity and frequency of activity. This information also helps in re-constructing a specific activity or security incident. ***