More on Autopsy and WInFE

I was right.  This is cool.

Using Autopsy on WinFE Lite worked as expected; however, I wanted to test it with a WinBuilder build of WinFE to address limitations found on WinFE Lite (notably, the inability to view videos or inside zip files).

In short, the WinBuilder build allowed viewing of videos and accessing zip files with Autopsy.  There were a few other customizations that I made for appearance and ease of use that you may find helpful in presenting training on WinFE (if you do that) or in creating your own WinFE for onsite preview/triage.

2013-07-15-17-33-1247
Add Autopsy to the WinFE start menu.

Basically, with Autopsy, any first responder or parole supervisor can triage/preview an evidence machine, onsite, without cost of software or hardware.  You just need a CD, DVD, or USB with WinFE and Autopsy.  For the first responders who are not forensic examiners, a WinFE boot disc/USB can be made with Autopsy clearly presented on the desktop and start menu.  I would suggest that other forensic tools be included in the event they may be needed by a forensic analyst.  An example would be a first responder finding evidence on a machine during a triage/preview and the machine needs to be imaged.  Either the first responder can image the machine or preferably, a trained person should be called to image the machine.  Having the apps pre-installed eliminates the need to reboot the machine to another build of WinFE, or plugging in additional drives with programs, and so forth.

In order to get you in gear with the potential of a completely free WinFE and software (you need a license for Windows to build it…but otherwise, it’s all free), I’ve posted the steps below.  Before you ask for help with WinBuilder, go to www.reboot.pro and read the help forums.  There is as much documentation you need for directions on how to download and run WinBuilder along with as many scripts (added features) as you could ever need.

The steps:

1)      Download Autopsy and install to your workstation.

2)      Download Winbuilder

3)      Download the WinFE write protection script (place in the WinBuilder tweaks folder)

4)      Build your WinFE

Step 1

2013-07-15-17-34-1250
It's free!

Download and install Autopsy to your workstation. http://sleuthkit.org/autopsy/

Step 2

2013-07-15-17-34-1251
It's free!

Download and install WinBuilder (go to www.reboot.pro on how the program works).  This is based on the Win7PE_SE project.

Step 3

2013-07-15-17-34-1252
Guess what? This is free too.

Download the WinFE write protect script.  http://winfe.wordpress.com

Place the write protect script (WP.script) in the Tweaks folder of WinBuilder

2013-07-15-17-34-1253
Without this one little thing (wp.script), you only making a "PE", not a "FE" build.

Step 4

2013-07-15-17-35-1254

Run WinBuilder.  Read my previous write up on how to do this to save time in trying to figure it out.  I’ve already spent more than a few hours which you don’t have to go through.  Be prepared, you will have errors and builds that don’t work.  But once you get it right and see how it works, you will have a tool which will provide invaluable use for years.  Trust me on this; you will not regret spending the time.  The only regret you will ever have is waiting to try it out.

2760 Hits

Is it worth the time to figure out WinFE?

Yes, no question about it.

WinFE is one of those things in forensics you hear about and move on to something else because you don't want to spend the time to "build an ISO" (maybe you've not
533 Hits

C4All X-tension update

Update November 14, 2014

Download link to version 3.6.2.d https://www.dropbox.com/s/zewn7myskf...6.2.d.zip?dl=0
This update changes the way the video stills are treated when extracting movies.
-now video stills are extracted if the parent movie is extracted, regardless of whehter
the video still has been type verified.

 

 

 

 

That is for version 3.6.2.d that fixes a few issues with C4All not handling some characters.

 

 

 
 
 
Videos and links to updated guides.
 
 
 
Steps for c4all X-tension updated November 2014.doc
www.dropbox.com/s/sfd3...4.doc?dl=0

Steps to prepare and run C4All X november 2014.doc
www.dropbox.com/s/23ts...4.doc?dl=0

I recommend downloading both guides. ***both Udpated November 2014***

Links to Youtube videos to run X-Tension
www.youtube.com/watch?v=HP6DTzpG0KI - part 1 of 3
www.youtube.com/watch?v=zCIcrA9CldI - part 2 of 3
www.youtube.com/watch?v=53cLlcogr40 - part 3 of 3

 

775 Hits

Barely any updates to WinFE :(

winfeUnfortunately there are so few updates nowadays to WinFE, that this blog is woefully neglected...on a positive note, since WinFE practically needs no updates, there is hardly a need to keep up on WinFE once you have mastered building it.

The best and most current source of all-things-WinFE is from a free online course at http://courses.dfironlinetraining.com/windows-forensic-environment so other than taking the course, this blog will not have additional information building WinFE.

The course includes downloads and links to downloads to build every publicly known version and build type of WinFE, from the basic WinFE, WinFE Lite, WTE WinFE, Mini-WinFE, and WinBuilder WinFE.

The WinFE wordpress blog will be used only for sporadic WinFE updates and related information since WinFE has practically reached the best it can be at current software standards (Windows 8).  The only posts that may be original from here on out would be case examples, but that quickly grows old (I booted a machine to WinFE and imaged it...).  A few instances are very neat, like imaging a Surface Pro, and for those interesting cases, I'll post them as I come across them or am sent information about them.

At its foundation, WinFE is a strong forensic OS platform, built on the latest Windows operating system, which can run most types of forensic software.  That's about it.  Simple, but amazingly effective at a forensic boot platform.  Since it is so very simple, the updates to the WinFE blog become less and less.  Therefore, the free webinar course covers everything you need to learn about WinFE along with every download needed, plus tips on building, using, and testifying to the use of WinFE.

After you view the course and build a few WinFEs, you'll see that WinFE is only a forensic boot OS.  But you will also see that because it is a Windows boot OS, you can do so many things with it that you can not do with a Linux forensic OS or with a hardware writeblocker.  That is the beauty of WinFE.  Simple. Ingenious. Hard to improve upon (at this point...).

You have my permission to use the WinFE course and its materials in a manner that benefits WinFE at no cost.  That means you can use information from the course to teach WinFE at conferences or any training session.  WinFE is free (technically, you need a Windows OS license...but otherwise its free), and I've made the course free as well.  When teaching or writing about WinFE related to the source and you choose to attribute to the source, that's nice of you, but not necessary if you don't want.

Take a run at the WinFE course.  Watch all the videos or only the videos of interest. They are broken down by build types and how-to videos.  The most important benefit you can get out of the course (other than learning how to build/use WInFE) is getting some formalized training in front of you about WinFE.  It's one thing to spend hours (days?) figuring out something but quite another when you can get the meat-and-potatoes of what you need to know in the shortest period of time.  I'd reckon that even if you attend a presentation on WinFE, you will get so much more out of the online course that you won't regret the time spent.

I've also said a few times, that once you build and use a WinFE, you will regret not having done so years earlier.  Don't forget, WinFE has been around since 2008...it works even better now than back then.

outline

Tags:
1035 Hits

Updates to X-tension and Hash File Manipultator

Hashbrown program 64 bit version only http://1drv.ms/1tLsNnG updated October 10 2014

instructions http://1drv.ms/XNdgeJ
-New Version that handles many duplicates and many unsorted more efficiently posted.

 

 

 

 

X-tension

 

 

Update October 19 2014
download link to version 3.6.2.c http://1drv.ms/1prWU2h
-Fixed issue with extended character support of UTF-16 in XML. should show all but those 0xD800 – 0xDFFF characters.
-Adds the functions of 3.5.12.k as well as option to create a Picture/video library based on MD5 hash value as name and the option to include not confirmed files when extracting pictures and movies. (before the file had to have a type status of Confirmed or newly identified. see post from 27 September in this thread for more details)
- 3.5.12.k
option to include or not include metadata in XML
-The option to run against multiple evidence objects and better naming of folders in c4all folder tree.
-CETS users have toggle to create a CETS XML or not.

 

677 Hits

Image a Surface Pro using bootable UEFI WinFE

surfaceproCool WInFE work done by Jeffrey A. Cunningham, Sr Digital Forensic Examiner, US Army (ChiefCham), on imaging a Surface Pro using a bootable UEFI WinFE.  It is certainly neat to see this type of testing and research done on ANY forensic tool where the results can be shared with everyone.

Thanks ChiefCham!

Image a Surface Pro using bootable UEFI WINFE

Tags:
2834 Hits

Workarounds to Workarounds (and some hints & reminders)

Every now and then, I get email from readers who have difficulties, and some areas come up more often.  I also learn a few things as time goes by, and I gain some valuable pointers from colleagues who share my interests.  Therefore, I want to update or amend a few procedures as well as review some of the more basic steps that folks may overlook.

1. Building and booting EUFI/GPT systems and remembering the registry edit 

A little while back, I posted on building VMs from UEFI/GPT systems, found most often in Windows 8.  Since then, I’ve seen more of these outfits arrive in my shop, as the use of Windows 8 and large disk grows.  If you document your target system before an exam, which requires accessing the setup in most cases, you’re sure to recognize that the setup doesn’t resemble the BIOS of old.  There’s a sample screenshot in the above post.  Even if you dive straight away into your exam, you’ll find a clue when you study the partitioning of your target image file:

GPT Disk

X-Ways Forensics users will receive the answer to the clue without having to guess.  The GPT partitioning style with the four partitions, including the MS reserved partition, mean that you have a UEFI system.  The FAT32 partition likely holds your EFI boot data:

EFI

The first reminder is that we usually must edit the registry and at least one user’s password to boot into Windows 8.  Since the beginning of my blog, I described how to build your VM by selecting the option for a SCSI disk in VMware.

scsi

That option required an edit to the registry to enable the LSI SCSI service to start on boot:LSI SCSI

After mounting our VM, we loaded the target’s System hive into our own registry.  We navigated to the proper control set’s Services key and then to the LSI_SCSI subkey.  There, we edited the Start value’s data to 0x00, as above.

Well, what happens if you find a System hive that looks like this: SAS

As you can see, there is no LSI_SCSI key.  If you find this to be the case, you have a couple of choices.  You can start over and select the LSI Logic SAS option as in the Virtual Machine Wizard screenshot above that displays the controller types.  Then, edit the registry by setting the first LSI_SAS controller’s Start value data to 0x00.  A quicker alternative is  to edit the mounted registry hive and your VMX file by replacing the highlighted line the next screenshot with the one that follows.  Of course, if you examine the target registry in your forensic tools you can determine the configuration before you even consider building a VM.

scsi vmx

Replace the above parameter with this one:

SAS vmx

Please don’t forget to insert the firmware = “efi” parameter that I described in earlier posts!  If you edit the VMX and your VM hangs, reboot into the Boot Manager, which you usually can access by pressing F2 a few times during the boot process.  There, just select the virtual VMware Virtual SCSI disk and hit Enter.

Boot manager

 2. Password removal

Back here, I described the Windows 8 feature that allows users to log on to their systems with MS Account credentials.  This feature allows both local and online logon.  The required password strength makes a hash attack a little more difficult.  However, the most important thing to remember is that, to gain access to the system, a password is required.  You cannot “blank” the password using tools like the Linux-based boot CD or NTPwedit.  You must change the password.  Although some tools ostensibly allow you to change the password, I’ve found that they fail in that regard.  I still know of only one tool (commercial, but cheap) that works: Reset Windows Password (RWP), which is available at http://www.passcape.com/reset_windows_password and produced by Passcape Software.  I described its use and a UEFI workaround process here.

The workaround arose from the need to edit the password on a UEFI/GPT MS Account system with a tool on a bootable ISO/CD.  In hindsight, I should have suggested a quicker approach, which I will describe here.  As seen in one of the above screenshots, we edited our VMX file to enable the EFI firmware.  Passcape’s RWP is not yet available for use on a bootable UEFI, USB device.  So, if you use RWP or any tool on a bootable ISO, you need to re-edit your VMX as follows:

edit to bios

Once you re-edit the VMX file, you can boot to a non-EFI medium.  Just remember to change it back to EFI thereafter, or you system will not boot to Windows (“operating system not found” message).  I’ll add that RWP also allows you to invoke regedit and several other utilities directly from within the application.

3.  Shadow Volumes and Russian Dolls

This is another topic that folks bring up occasionally.  If we mount a shadow volume directly from an image or from an image that we boot in VMware, we’ll find that the shadow volume, itself, contains a System Volume Information (SVI) folder that contains shadow volumes.  Let’s say that we mount a shadow volume that was created on October 1, 2014, and was the earliest shadow volume in our target system.  When we look in the SVI folder of that mounted shadow volume, we may find a shadow volume that was created on September 1, 2014.  Now, it seems logical to assume that we can mount the latter shadow volume and go back in time even further, perhaps to the date when the system first was used.  We can’t.  I’ve tried a few approaches, including running vssadmin against the mapped shadow volume and attempting to boot the mapped shadow volume.  Neither method worked.  I wasn’t able to boot a shadow volume, even by reconstructing a physical disk with that volume.  I also ran this theory by one of the world’s leading Windows forensics experts, Troy Larson, who, not surprisingly, thought about this concept long before I did.  In short, Troy suspected that the shadow volume files and other data within a mounted shadow volume were incomplete and could not be reliably processed by the system.  Remember that shadow volumes really are “difference” files that depend on one another, and inconsistencies in any of them can affect their functionality.

NOTE: I’d like to direct readers to the comment posted by Joachim Metz.  He’s done a great job of documenting shadow volumes and provided a link to a paper that he published.  His comment and paper may provide  the precise answer.

For those who want to play around with UEFI, VMware has preview edition available that affords some undocumented (buggy) enhancements, so be careful if you give it a shot.  That’s all for now.

 

300 Hits

USB Malware and WinFE

The recent release of USB malware, in which any USB device is suspect of being infected after plugging into an unknown-if-clean machine, makes a problem for bootable USB devices in forensic collection.  Some of the very scary claims to the USB malware are (http://news.discovery.com/tech/gear-and-gadgets/warning-usb-malware-code-unleashed-141006.htm):


  • Alter files from thumb drives

  • Redirect Internet traffic

  • Tap and spy on USB-enabled smartphones

  • Hijack keyboards to type commands

  • Potentially inject malicious elements as files are being transferred

  • badusb


  •  


That is bad stuff for a forensic bootable USB device.   I've seen a few suggested solutions to the USB infection issue, but the fastest solution with WinFE is to burn to a CD/DVD instead of making a USB bootable.  Problem solved.

Building a WinFE is still very very very very easy.  Using the Mini-WinFE build, I just timed creating a WinFE DVD is less than 6 minutes.  That was a few minutes with Winbuilder and a few minutes burning the ISO to DVD, while taking my time in the short process.  If you haven't yet built a WinFE, the process is almost completely automated.  Just point Winbuilder to your Windows 7/8 source and press go.  Less than 5 minutes later, you have a forensically sound, bootable ISO/CD/DVD/or USB.

Granted, creating a WinFE CD/DVD in less than 10 minutes is not going to save you time compared to imaging a removed hard drive using a hardware imaging device.  But...if you have LOTS of machines to image, booting the machines to be seized to WinFE most likely will be faster than removing hard drives and sharing hardware imaging devices.  And for those pesky drives that won't come out, WinFE may be a good solution than fighting with an ultralight, can't-find-the-screws-to-remove-the-darn-hard-drive machines.

Tags:
1393 Hits

New version of X-Tension

New version of X-Tension
3.6.2.a http://1drv.ms/1rrCJ7s
Changes
-adds the functionality to create a picture/video library.
-adds the ability to extract pictures or movies that are type status of 'not confirmed'
(this was added as there are so many variations of avi formats, that even some valid working movies were not 'confirmed')
If the user does not want these files, they can be filtered out and the X-Tension run excluding filtered or excluded files

747 Hits

XWF II and III...

...are a little late coming out due to an emergency...but will be published soon.  sorry for the delay.

863 Hits