500.1 - Data Triage Flashcards
1
Q
“Evidence of …” Categories
A
- User Communication
- File Download
- Program Execution
- File Opening/Creation
- File Knowledge
- Physical Location
- USB Key Usage
- Account Usage
- Browser Usage
2
Q
Whats in RAM (memory)?
A
- Volatile data
- Passwords (encrypted, non, Programs)
- Processes
- Open Files/ Files/ Directories
- Registry keys, and devices
- Network connections (active/open/listening)
- running apps
- configuration parameters
- memory-only exploits/root kit technology
3
Q
Windows Memory Acquisition: LIVE and DEAD system
A
- LIVE:
- Image the local drive (unencrypted) instead of the physical one (encrypted)
- DEAD:
- Hibernation File - created when computer hybernates/laptops closes (compressed RAM image) (SystemDrive/hiberfil.sys)
- Page File - parts of memory sent to disk - not complete (SystemDrive/pagefile.sys)
- Memory Dump - Crash dump files - (WinDIR/Memory.dmp)
4
Q
EDD.exe
A
Encryption checking tool - CMD line tool
5
Q
FTK Imager and DumpIT
A
Memory Imaging
6
Q
Mounting Disk Images Types
A
- RAW/DD - E01 - SO1 - Contains drive data, disk, partition, & full file structure
- AD1/LO1 - Have no drive geometry - Must be Logical image - contain full file structures, deleted files
- Two Key Tool Types: FTK Imager, Arsenal Image Mounter
7
Q
Characteristics of mounted images
A
- Logical (NTFS/FAT) - mounted to drive letter,
- AD1 & LO1 have no drive geometry - Must be Logical image- Physical (Win App) - cannot be viewed by Windows Explorer
- Can be viewed with a Win App that performs physical Name Querying
- Physical (Win App) - cannot be viewed by Windows Explorer
8
Q
FTK imager - Mounting Methods
A
- Block/Read Only - Treats the mounted image as a block device (disk). Image will be subject to NTFS permissions & Windows File/Folder protections
- can only be viewed with Win. App w/ Physical name querying - Block/Writable - Mounts image as a writable device, saving any changes in a cache file (no changes made to original image)
- Allows you to write to the evidence, make notes. Notes are saved in a Cache file, not no changed are made to the original.
- Filesystem/ReadOnly- Creates a virtualized folder structure, circumventing Windows File/Folder protection. Shows deleted files. Filesystem starts in the ROOT folder.
- Reads the device as a read-only device that you can view using Win Explorer. Show deleted & existing files.
- ** PREFERRED image ***
9
Q
File Allocation Table (FAT)
A
Provides a linked list of the clusters that a file is stored inside. The # at the end of the FAT is an exponent of how many clusters can be addressed on the filesystem. (2^#)
- FAT12/16 -
- MS-DOS, Win95/98/NT/2000 - FAT32 -
- Win95 (OSR2), Win2000 - ExFat (Newest Version) - Improves upon the FAT filesystem by reducing the overhead of the FAT by removing continual use of FAT too keep track of cluster allocations for continuous files
- 2008/2012/Vista//Win7/Win8/Win10 - Windows NT (NTFS) - Increased reliability & supports long & short files name. Is complex & has built in recovery capabilities in case of a crash
- Winxp/2003/2008/2012/Vista/Win7/Win8/Win10 - ReFS - Intended for file serbers - Made up of 3 layers (Data, Metadata, Filename)
- Server 2012/2016/Win8.1/Win10
10
Q
NTFS Clusters
A
- Allocated = data is being actively used by a file, exist on a file, not deleted
- Unallocated - data not being used, may/not exist in block/cluster, deleted/unused, file fragments
11
Q
Deleted file vs Wiped File
A
- Deleted = exits on disk, fully recoverable until unallocated
- Wiped = one wipe is all that is necessary to stop recovery
12
Q
Master File Table (MFT)
A
- 1024 bytes
- Saved in “MFT Zone”
- $MFT, $MFTMIRR, $LOGFILE, $Volume, $BOOT etc.
13
Q
Windows Time Rules
A
- Files Modified/Accessed/Created = (File Copy, File Access, File Modify, File Creation)
- NTFS records - Last mod time, Last access time, Last mod of MFT record, & File creation time MFT record in vol.
- File Copy - Modified= inherited from original file , Access= Changed, Creation= Changed
- File Access - Modified= No Change , Access= Changed (no change on NTFS/Win7+), Creation= No Change
- File Modify - Modified= Stamped , Access= No Change, Creation= No Change
- File Creation - Modified= Change , Access= Change, Creation= Change
- Last Access Time - Update when a file copy or move - not update for only opening the file
- Creation date changes when CMD is used
14
Q
Alternate Data Stream (ADS)
A
- Alternate content for a file - uses Zone.Identifier to identity type of connection used
- C:\Windows\System32 - will show all file that have a Zone.Identifier
- Nozone = -1
- MyComputer= 0
- Intranet= 1
- Trusted= 2
- Internet = 3
- Untrusted = 4
15
Q
Win7-10 Volume Shadow Copy
A
- New “System restore” for Vista/Win7 and 2008
- Revert/Restore/Copy to prev. version of an entire volume, folder, or file
- Previous version not stored every time a file is saved
- SnapShots are staggered - 1 a week (Win7) - 24hrs = Vista
- Created when a computer is idle, turned off/on, rebooted
- All shadow copies are stored in “System Volume Information” folder on ROOT
- 3808876b - unique identifier that is specific to shadow copies
