Windows Forensics

Windows Forensics is the method of gathering information about the target Windows system.

- [Windows Forensics](https://tryhackme.com/room/windowsforensics1)

System Information

Below are the location of the file which contains the information of IP address and MAC address.

# Look@LAN is a network monitoring tool. So if the system uses the tool, we can retrieve the information of the network.
# LANIP -> IP address
# LANNIC -> MAC address
c:\Program Files (x86)\Look@LAN\irunin.ini

The name of the network card is such like “Intel(R) PRO/1000 MT Desktop Adapter”.

c:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_DeviceProvisioning_2023_1_2_3_45_67.etl

Sometimes PowerShell command history contains the sensitive information about the system.

c:\Users\<username>\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt

Suspicious activities are likely detected by Windows Defender.

c:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\


Event Logs

Below is the list of item worth noting.

In each item, we can find the desired list by specifying the keyword in the “Find” action in the right pane.

Also we can see event logs from a logfile in PowerShell.

Get-WinEvent -Path  .\Example.evtx -FilterXPath '-/System/-' | Sort-Object TimeCreated


Processes


Registry Hives

A hive is a logical group of keys, subkeys, and values in the registry that has a set of supporting files loaded into memory when the operating system is started or a user logs in.

We can find registry keys in the Registry Editor.

  1. Click on the Windows icon and select Run.

  2. Enter “regedit” in the input form. Registry Editor opens.

  3. File Locations

--Registry Hives-- are located in C:\Windows\System32\config.

The other hives are located in user home directory (C:\Users\<username>)

--Amcache Hive-- is located in --C:\Windows\AppCompat\Programs\Amcache.hve-- .
It stores the information on programs that were recently run on the system.


Acquire Registry Data


Gather Information From Registry Hives

We can retrieve information using Registry Viewer or Registry Explorer.

OS Version

Current Control Set

Computer Name

Time Zone

Network

SAM Hive & User Information

Recent Files

Microsoft Office Recent Files

ShellBags

ShimCache

AmCache

BAM/DAM

UserAssist

Devices

Windows Disk Management

Disk Management is a system utility in Windows that enables you to perform advanced storage tasks.

Partitions

Check partitions with it.

  1. --Open the 'Disk Management'--

  2. --Right click the partition to view the properties--

  3. --Check 'Security' tab or 'Shadow Copies' tab--

  4. --Check Partition in Windows Explorer--

    1. Right click the partition and click 'Change Drive Letter and Paths'
    2. Open dialog.
    3. Click 'Add'. In the dropdown, choose a letter (ex. Z:) and click 'OK'.
    4. At the top, in the Volume column, you should see that the partition has a letter (Z:) assigned to.
    5. Open Windows Explorer and check if Z: exists on 'This PC'.
    6. Click the partition (Z:) and click 'View' tab at the top then check 'Hidden Items'.

  5. --Restore the previous version of partition--

    1. Right click the partition and click 'Properties' -> 'Previous Versions'
    2. Select shadow copy you want to restore and click 'Restore'. The Confirmation popup open, then click 'Restore'.

Windows Memory Dump Analysis

A memory dump file (.dmp), also called as 'crash dump' is a crash report file.

Investigation

file example.dmp
# Output
example.dmp: Mini DuMP crash report, 18 streams, Sat Nov ...

Static Analysis

We can also read contents of this file by usual static analysis such as below.

strings example.dmp
strings example.dmp | grep -i password
# Open pager
strings example.dmp | less

xxd example.dmp

This file can also be read with online DMP viewer.


Dump KeePass Master Key (CVE-2023-32784)

If the --.dmp-- file contains --KeePass-- memory, we might be able to dump the master key. This vulnerability exists in --KeePass 2.x before 2.54--. keepass-password-dumpter is useful to do that.

In Windows, run the follwoing command.

git clone https://github.com/vdohney/keepass-password-dumper.git
cd keepass-password-dumper
dotnet run example.dmp

Windows XML EventLog (EVTX)

EVTX is used for Microsoft Windows to store system log information.

We can parse --.evtx-- file in Linux using evtx_dump.

wget https://github.com/omerbenamram/evtx/releases/download/v0.8.1/evtx_dump-v0.8.1-x86_64-unknown-linux-gnu -O evtx_dump
chmod +x evtx_dump
./evtx_dump example.evtx > parsed.txt

Now we can find sensitive information from the parsed text.

grep -i TargetUserName parsed.txt
grep -i TargetDomainName parsed.txt


Chainsaw is a command-line tool to rapidly search and hunt through Windows Forensics Artifacts.

git clone https://github.com/WithSecureLabs/chainsaw.git
cd chainsaw
cargo build --release
./chainsaw hunt evtx_files/ -s sigma/rules --mapping mapping/sigma-event-logs-all.yml

Reading OneDrive Logs

OneDrive log files can be read by deobfuscating.

To read OneDrive logs, we need to deobfuscate log files (--.odl, .odlsent, .odlgz--).
These logs are located in the following on --Windows--:

This repository is useful to deobfuscate OneDrive logs.

python -m venv venv
# on Windows
.\venv\Scripts\activate
pip install construct pycryptodome
python odl.py -o .\output.csv c:\Users\\AppData\Local\Microsoft\OneDrive\logs\Personal\

After that, we can read the output file (output.csv) with tools such as VS Code and Excel.
This file contains sensitive information such as OneDrive account email, access token, etc.