Updates
Book Update
I've received the counter-signed contract from Syngress for Windows Forensic Analysis 3/e, and I'm finishing up a couple of the chapters to get in for review. This book is NOT the same as 2/e, in that I did not start with the manuscript from that edition (the way I did when I started 2/e). Instead, 3/e is a companion edition...if you already have 2/e, you will want to have 3/e, as well. This is because the information in 2/e is still valid, and in many instances (in particular information such as the PE file format, etc.) hasn't changed. Also, 2/e focused primarily on XP, and those systems are still around...there hasn't been a huge corporate shift to Windows 7 yet. As such, 3/e will shift focus to Windows 7...it will also focus more on solving problems, rather than simply depositing technical information in your lap and leaving you to figure out what to do with it.
Another new aspect of WFA 3/e is that rather than providing an accompanying DVD, the tools (as with WRF) will be provided online. Providing the tools in this manner is just so much easier for everyone, particularly when someone purchases the ebook/Kindle version of the book, or leaves their DVD at home. As with my previous books, I will do my best to provide functioning, tested code along with book, and provide links to other tools mentioned, described, or discussed in the book.
Accessing VSCs
I've posted before on accessing Volume Shadow Copies, but thanks to a recent blog post from Corey Harrell, I thought that it might be a good idea to revive the topic. In his post, A Little Help with Volume Shadow Copies, Corey walks through a means for automating access to several VSCs, as well as automating the collection of information from each. Corey does this through the use of a batch file.
Accessing VSCs in this manner is nothing new...it's been around for a while. This post appeared on the Forensics from the sausage factory blog over a year ago. In this post, copying of specific files via robocopy is demonstrated, showing how to use batch files to mount VSCs, copy files and then unmount the VSCs. Corey's script takes a different approach, in that rather than copying files, he rips Registry hives using RegRipper (more accurately, rip.exe). Corey was kind enough to provide a commented copy of one iteration of his batch file for inclusion in the materials associated with WFA 3/e (see above).
More than anything else, this is just the beginning. Corey's had a need and used already-available information as a stepping stone to meeting his needs. Whether you use the VHD method for mounting images, or the VMWare method (described by Rob Lee and Jimmy Weg), or some other method, the fact is that once you mount the VSC, it's simply a matter of getting the job done. You can either copy out the Registry hives, or do as Corey's done, and run RegRipper (you'll still have the image and VSCs to access if you need the original data) on the hives. You can copy or query for other files, as well, or use other tools (some I'll mention later). In fact, with the right tools and a little bit of thought, you can do pretty much anything...compare files by hash, look for specific files, etc. You may need to build some tools (or reach to someone for assistance), or download some tools, but you can piece some pretty decent automated (and self-documenting) functionality together and achieve a great deal.
Open Source Tools Book
Speaking of books, the book that Cory Altheide wrote (I was a minor co-author), Digital Forensics with Open Source Tools (aka, "DFwOST"), has been published and should be available to those who pre-ordered it soon. Also, a really good idea is to follow @syngress on Twitter...I've been asked a couple of times if I will be providing a discount; I didn't provide the discount, Syngress did via Twitter. I simply "RT'd" it. You should really check this book out. Cory's goal was to provide a means for folks with a basic understanding of digital forensics (and limited means) with an understanding of some of the open source tools available to them, and how to get them installed and configured. And he did a great job of it!
My books have focused on the analysis of Windows systems, and have discussed/described free and open source tools that can assist an analyst. Cory's book focuses on the open source tools, and covers several that you can use to analyze Linux, MacOSX and Windows systems.
SANS Forensic Summit
I don't know if you've seen it, but Rob's posted the agenda for this year's SANS Forensic Summit, to be held on 7 and 8 June, in Austin, TX. Check it out...there are a number of great speakers, and several panels, which have proven to be an excellent format for conferences, as opposed to just having speaker after speaker.
It looks like Chris is gonna kick right off with his "Sniper Forensics" presentation, which has been getting him a LOT of mileage. Richard Bejtlich is also presenting, in addition to being on a panel on the second day. All in all, it looks like this will be another great opportunity to hear some good presentations, as well as to mingle with some of the folks in the business who are right there in the trenches.
OSDFC
I wanted to give another plug for Brian Carrier's OSDFC, the open source conference coming up on 14 June in McLean, VA. Cory Altheide and I will both be presenting; I'm presenting in the morning, and Cory's got clean-up in the afternoon; that's Brian's tactic to get everyone to stay, by saving the best for last! ;-) I hope that this will be another great opportunity to mingle with others in the community...I had several interesting conversations with attendees at last year's conference. Also, don't forget...DFwOST is out! Bring your copy and get both of us to sign it...although you may have to wait for the cocktail reception at the end for that!
Scalpel
There's an announcement over at the DFS Forensics blog that scalpel 2.0 is available. There are some interesting enhancements, and the download contains pre-compiled Windows binaries and the source code.
USBStor
I received another question today that I see time and again, via email and in the lists/forums, having to do with LastWrite times on the USBStor subkeys and how they apply to the time that a USB device was last connected to the system.
In this particular case, the person who emailed me had confiscated and secured the thumb drive, and then found that the LastWrite time (apparently, the system itself was still active) for the USBStor subkey had been updated recently.
Folks, I really don't understand how this can be written and talked about so much, published in books (WFA 2/e, WRF, etc.) and STILL be so misunderstood. Rob Lee's even made PDFs available that describe very clearly how to perform USB device analysis (XP, Vista/Win7).
If you want to know more about what may have caused the USBStor subkey LastWrite time to be updated when the device hadn't been connected, or more about why all of the USBStor subkeys have the same LastWrite time, put together a timeline. Seriously. I've seen both of these questions (some even include, "...I need to explain this in court..."), and a great way to answer it is to create a timeline of activity on the system and see what occurred around that time.
I've received the counter-signed contract from Syngress for Windows Forensic Analysis 3/e, and I'm finishing up a couple of the chapters to get in for review. This book is NOT the same as 2/e, in that I did not start with the manuscript from that edition (the way I did when I started 2/e). Instead, 3/e is a companion edition...if you already have 2/e, you will want to have 3/e, as well. This is because the information in 2/e is still valid, and in many instances (in particular information such as the PE file format, etc.) hasn't changed. Also, 2/e focused primarily on XP, and those systems are still around...there hasn't been a huge corporate shift to Windows 7 yet. As such, 3/e will shift focus to Windows 7...it will also focus more on solving problems, rather than simply depositing technical information in your lap and leaving you to figure out what to do with it.
Another new aspect of WFA 3/e is that rather than providing an accompanying DVD, the tools (as with WRF) will be provided online. Providing the tools in this manner is just so much easier for everyone, particularly when someone purchases the ebook/Kindle version of the book, or leaves their DVD at home. As with my previous books, I will do my best to provide functioning, tested code along with book, and provide links to other tools mentioned, described, or discussed in the book.
Accessing VSCs
I've posted before on accessing Volume Shadow Copies, but thanks to a recent blog post from Corey Harrell, I thought that it might be a good idea to revive the topic. In his post, A Little Help with Volume Shadow Copies, Corey walks through a means for automating access to several VSCs, as well as automating the collection of information from each. Corey does this through the use of a batch file.
Accessing VSCs in this manner is nothing new...it's been around for a while. This post appeared on the Forensics from the sausage factory blog over a year ago. In this post, copying of specific files via robocopy is demonstrated, showing how to use batch files to mount VSCs, copy files and then unmount the VSCs. Corey's script takes a different approach, in that rather than copying files, he rips Registry hives using RegRipper (more accurately, rip.exe). Corey was kind enough to provide a commented copy of one iteration of his batch file for inclusion in the materials associated with WFA 3/e (see above).
More than anything else, this is just the beginning. Corey's had a need and used already-available information as a stepping stone to meeting his needs. Whether you use the VHD method for mounting images, or the VMWare method (described by Rob Lee and Jimmy Weg), or some other method, the fact is that once you mount the VSC, it's simply a matter of getting the job done. You can either copy out the Registry hives, or do as Corey's done, and run RegRipper (you'll still have the image and VSCs to access if you need the original data) on the hives. You can copy or query for other files, as well, or use other tools (some I'll mention later). In fact, with the right tools and a little bit of thought, you can do pretty much anything...compare files by hash, look for specific files, etc. You may need to build some tools (or reach to someone for assistance), or download some tools, but you can piece some pretty decent automated (and self-documenting) functionality together and achieve a great deal.
Open Source Tools Book
Speaking of books, the book that Cory Altheide wrote (I was a minor co-author), Digital Forensics with Open Source Tools (aka, "DFwOST"), has been published and should be available to those who pre-ordered it soon. Also, a really good idea is to follow @syngress on Twitter...I've been asked a couple of times if I will be providing a discount; I didn't provide the discount, Syngress did via Twitter. I simply "RT'd" it. You should really check this book out. Cory's goal was to provide a means for folks with a basic understanding of digital forensics (and limited means) with an understanding of some of the open source tools available to them, and how to get them installed and configured. And he did a great job of it!
My books have focused on the analysis of Windows systems, and have discussed/described free and open source tools that can assist an analyst. Cory's book focuses on the open source tools, and covers several that you can use to analyze Linux, MacOSX and Windows systems.
SANS Forensic Summit
I don't know if you've seen it, but Rob's posted the agenda for this year's SANS Forensic Summit, to be held on 7 and 8 June, in Austin, TX. Check it out...there are a number of great speakers, and several panels, which have proven to be an excellent format for conferences, as opposed to just having speaker after speaker.
It looks like Chris is gonna kick right off with his "Sniper Forensics" presentation, which has been getting him a LOT of mileage. Richard Bejtlich is also presenting, in addition to being on a panel on the second day. All in all, it looks like this will be another great opportunity to hear some good presentations, as well as to mingle with some of the folks in the business who are right there in the trenches.
OSDFC
I wanted to give another plug for Brian Carrier's OSDFC, the open source conference coming up on 14 June in McLean, VA. Cory Altheide and I will both be presenting; I'm presenting in the morning, and Cory's got clean-up in the afternoon; that's Brian's tactic to get everyone to stay, by saving the best for last! ;-) I hope that this will be another great opportunity to mingle with others in the community...I had several interesting conversations with attendees at last year's conference. Also, don't forget...DFwOST is out! Bring your copy and get both of us to sign it...although you may have to wait for the cocktail reception at the end for that!
Scalpel
There's an announcement over at the DFS Forensics blog that scalpel 2.0 is available. There are some interesting enhancements, and the download contains pre-compiled Windows binaries and the source code.
USBStor
I received another question today that I see time and again, via email and in the lists/forums, having to do with LastWrite times on the USBStor subkeys and how they apply to the time that a USB device was last connected to the system.
In this particular case, the person who emailed me had confiscated and secured the thumb drive, and then found that the LastWrite time (apparently, the system itself was still active) for the USBStor subkey had been updated recently.
Folks, I really don't understand how this can be written and talked about so much, published in books (WFA 2/e, WRF, etc.) and STILL be so misunderstood. Rob Lee's even made PDFs available that describe very clearly how to perform USB device analysis (XP, Vista/Win7).
If you want to know more about what may have caused the USBStor subkey LastWrite time to be updated when the device hadn't been connected, or more about why all of the USBStor subkeys have the same LastWrite time, put together a timeline. Seriously. I've seen both of these questions (some even include, "...I need to explain this in court..."), and a great way to answer it is to create a timeline of activity on the system and see what occurred around that time.