Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

FOR 500 - GIAC > 500.3 - USB & Shell Items > Flashcards

500.3 - USB & Shell Items Flashcards

1
Q

Shell Item Artifact Attributes

A
  • Type of Drive Target - Fixed, Removable, Netowork
  • Path of Target File -
  • Target Medata - MAC Timestamps, Size, MFT Record, Sequence #
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

“Recent Docs” Shortcut Files (.lnk)

A
  • Autocreated by Win in Recent Folder when a file is OPENED
  • .lnk files point to = Target file MAC times, vol info (name, type, vol sn), orig path, fixed/ removable/ network target
  • Non-exe generates generates 2 .lnk Files = 1. Target File & 2. Parent Folder of Target File
  • MAX # of files - 149
    • Files edited in USB are in recent items folder under user account
    • Date Created = First Opened
    • Date Modified = Last Opened

Location

  • Win7 - C:\Users|AppData\Roaming\Microsoft\Windows\Recent (Win7 ) &
  • XP - Doc & Settings\user
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Windows 10 Recent Doc changes

A
  • When a file is created, a LNK file will also be created in the RECENT folder
  • Only when the user opens the fire will the LNK file be created
  • Folder Creation = Link of Folder, Parrent Folder, & Grand parrent Folder
  • File Creation = Link of Folder & File
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

LeCMD.exe and lp.exe

A
  • LeCMD.exe - LNK Explorer command line edition

- LNK file analysis and parsing be

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

LNK File Data Structure

A
  • Header & other info
    • Source file, source created, source modified, source accessed
    • Target created time, Modified time, and accessed time, target size, flags
  • Link Info = Volume info = SN & drive type
  • Target ID - Only shows if a flag is present
    • contains shell items that are similar to what is found in Shellbags
    • MFT info, timestamps, no absolute path
  • Extra - Console properties, serialized property store structures
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Win 7 - Win 10 JumpLists

A
  • Jumplists makes up both Destinations and Tasks
  • Shows the most recent or frequently used media for an app
  • Shows default tasks (pin app, start app, & close all windows of apps)
  • Two types of Jumplists: Automatic & Custom
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Automatic Destinations

A
  • Automatically created for each app by Windows - (Controled by the Window)
  • Created when files are open in an app
  • Found in Recents Folder
  • List of Apps sorted by AppID (Unique identifier) & 16 digits of a name
  • Files contain:
    • Creation Time = First exe w/ file Open
    • Mod Time = Last time of exe w/ file open

Location
- C:\Users(Profile)\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Custom Destinations

A
  • Created with specific development info from the app developer
  • Found in Recents Folder
  • Files contain:
    • Creation Time = First time item is added to the AppID / First exe of App
    • Mod Time = Last time an item was added to an AppID

Location
- C:\Users(Profile)\AppData\Roaming\Microsoft\Windows\Recent\CustomeDestinations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

AppIDs

A
  • Unique Identifiers to the OS & App
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Shellbags

Tracking Folder/Directory Usage Win 7-10

A
  • Shows folders that were access on the local Machine, Network, & Removeable Devices
  • Evidence of previously existing/deletion/overwirte Folders
  • When folders were accessed & by who

Location

- Explorer = USERCLASS.DAT\Local setting\Software\Microsoft\Windows\Shell\ Bags OR BagMRU
- Desktop - NTUSER.DAT\Software\Microsoft\Windows\Shell\Bags OR BagMRU
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Shellbags - Based on Windows Explorer

A
  • Only First time folder was opened / settings changed

- Example: Setting the window size, changing file viewing option, looking at thumbnails, sorting options

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Parsing Win7 - Win10 Shellbags / What do Shellbags consist of

A
  • BagMRU = Desktop/Computer
    • Keys = Specific Drives (C:, E:, D:)
    • SubKeys = Users
    • Values = Which Folder is what
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Shellbags Analysis Key items

A
  • MRUListEx indicator - Last Time directly accessed (Last key write time)
    • FAT/NTFS - File record & Sequence # allow you to separate drives
    • FAT32 = Sequence numbers NULL
    • NTFS = Sequence numbers Exists
    • Match returned device to directories accessed to make sure you are looking at the right device
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Purpose of USB Device Forensics

A

Removable Device Info

  • Vendor/make/Version
  • Serial #

User Information & Activity w/ USB Device

  • Determine drive letter & volume name
  • Find user that used the specific USB device
  • Discover first time device was connected
  • Determine last time device was connected
  • Determine when device was moved

30 days of activity stored in Registry - USB & USBSTOR Keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Mass Storage Device (MSC)

*** USB Device Types

A
  • Removable storage devices
    • external drives, thumb drives, MP3 player
  • Mounts within Windows Explorer
    • Hard Disk Drives (Win7+)
    • Devices w/ removable storage (XP)
  • Also referred to as UMS (USB Mass Storage)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Picture Transfer Protocol (PTP)

*** USB Device Types

A
  • Deals only with images, videos, and their associated metadata
  • Unidirectional transfer of files - from device to computer but not back
  • Mounting happens at the logical level - cannot see underlying filesystem
  • Win XP and earlier using Windows Image Acquisition (WIA) handles PTP devices

Examples
- Cameras (images/videos), scanners, printers, smartphone, & tablets

17
Q

Media Transfer Protocol (MTP)

*** USB Device Types

A
  • An improvement of PTP - involves portable media
  • WinXP - MTP device shows up in WPD & appears in Window Explorer

Examples
- MP3 players, cameras, smartphones, & tablets

18
Q

Evidence of File Opening (USB)

A
  • MSC = Create LNK file for all opened, Wins Recent Folder, MS Recent Folder, Jumplist Auto Dest
  • MTP = May create LNK (depends on app/filetype), Some MTP LNK don’t point back to MTP source device but to WPDNSE folder on WIN 7/8 ONLY

Location
- C:\Users(Username)\AppData\Local\Tamp\WPDNSE{GUID}

19
Q

WPDNSE Folder - MTP Devices Win7/8

A
  • Maintains copy of file opened from device,
  • Folder is temp (reboot = gone),
  • GUID folder mapping obtained from BagMRU in Shell bags for the MTP device

Location
- C:\Users(Username)\AppData\Local\Tamp\WPDNSE{FolderGUID}

20
Q

USBSTOR - MSC Devices (Removable)

A
  • Used to track MSC USB devices that have been plugged into a machine
    • Identify vendor, product, version of USB
    • Unique USB device
    • Determine time plugged in (retained 30 Days )
  • USBSTOR Serial Number - (No SN will have “&” in 2nd Character)

Location
- SYSTEM\CuurentControlSet\Enum\USBSTOR

21
Q

MSC, PTP, and MTP USB Enumeration

A
  • VID & PID info ID
  • Unique Device Serial # (Only MSC requires)
  • Retained for 30 Days (Plug & Play Cleanup)

Locations
- SYSTEM\CuurentControlSet\Enum\USB

22
Q

Discover Volume name for MSC, MTP, PTP

A
  • Logs the last drive letter & volume name for each device
  • Can be linked to drive letters via LNK files

Locations
- SOFTWARE\Microsoft\Windows portable Devices\Devices

23
Q

Find User that used USB

A
  • Using Volume GUID via searching for SN in Value Data (retained 30 Days)

Locations
- NTUSER.DAT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Mountpoints

24
Q

MSC USB Device times to track

A
  • First Connection
  • Last Connection
  • Removal Time
25
Q

Event Logs related to Time Tracking Removable devices

A
  • System Log
  • Event ID
  • Timestamp
  • Device Info - Captured by “plug and play”
  • Device SN
  • Status - error code
26
Q

Object Access: Audit Removable Storage (Win 8+)

A
  • Logs every interaction/ device by user,
  • Included folder, Filenames, & App,
  • Successful & Failed are logged,
  • NO hardware details
  • Auditing Access to BYOD (logging removeable devices - ID: 4663)
27
Q

Volume Serial Number Analysis

A
  • Lnk analysis contains Volume Type, V. Label/Name, & V. SN
  • Used with Portable Device key & V. SN via EMDMgmt key you can prove a device had specific files, opened via Explorer in WS

FOR 500 - GIAC (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions