ADFIRWMC - 3. Files of Forensic Interest

Each and every one of these artifacts is a deep world of details all to themselves but I tried to boil them down for this list. We will cover most of these in greater detail further in this course.

  • NTFS Master File Table ($MFT)
    • Description: Each file on an NTFS volume is represented by a record in a special file called the master file table (MFT).
    • Importance: ★★★★★
      • This contains the vast majority of the filesystem information for an NTFS volume.
      • Once parsed, you can establish file paths and a variety of timestamps that make timelining events easier.
      • So much info can be derived from the MFT that I refuse to try to explain it here.
    • Line to add to collection script: $filestocollect += 'c:\$MFT'
  • NTFS Transaction Log ($LogFile)
    • Description: NTFS is designed to be recoverable in case something borks. To do that, every file operation is logged so in case of unexpected system shutdown due to power error or critical system failure, the operating system can recover the status of file system to the previous status with saved information in $LogFile file.
    • Importance: ★★★☆☆
      • While you can pull off some geeky cool stuff from the data in the $LogFile, I usually don’t need to dig into it much because the MFT is largely full of the relevant info.
    • Line to add to collection script: $filestocollect += 'c:\$LogFile'
  • NTFS Change Journal ($Usnjrnl:$J)
    • Description: Update Sequence Number Journal is a feature of NTFS which maintains a record of changes made to the volume. Whenever a change is made to the volume, a record is added to the file. Each record is identified by a 64-bit Update Sequence Number or USN. (For this reason Change Journals are sometimes called USN Journals.) Each record in the Change Journal contains the USN, the name of the file, and information about what the change was.
    • Importance: ★★★☆☆
      • This is another one of those files you don’t need on a day-to-day basis, mostly for the deep forensic dives where you need to know exactly what changes took place at the volume level during a period of time.
      • Using the $MFT, $LogFile, and $USNJrnl:$J in concert can paint a very high-fidelity picture of file system events. Using them together can help shed light on things like timestomping.
    • Line to add to collection script
      • $filestocollect += 'c:\$Extend\$UsnJrnl:$J'
  • System Registry Hives
    • Description: The SYSTEM, SOFTWARE, SAM and SECURITY hives in System32\config hold the machine’s configuration: installed software, services, network interfaces, local accounts, every USB device that has been plugged in, and the time zone the box thinks it lives in.
    • Importance: ★★★★★
      • The time zone setting alone (SYSTEM\CurrentControlSet\Control\TimeZoneInformation) decides whether every other timestamp you collect lines up. Check it first.
      • Services and Run keys are where a lot of persistence lives, and ShimCache rides along in SYSTEM too. Covered in 5.1.
      • The pattern below also picks up the .LOG1 and .LOG2 transaction logs. Keep them: recent changes may still be sitting in the logs and not in the hive yet.
    • Line to add to collection script:
      • $filesigs += '^c:\\Windows\\System32\\config\\.*'
  • User Registry Hives
    • Description: NTUSER.DAT and UsrClass.dat are each user’s personal slice of the registry: what they ran, what they opened, what they typed into Explorer’s address bar and the Run box, and which folders they browsed.
    • Importance: ★★★★★
      • This is where user activity hides. UserAssist counts the GUI programs a user launched, RecentDocs and the MRU lists remember what they opened, and ShellBags in UsrClass.dat remember folders even after the folders are deleted.
      • Grab the transaction logs with the hives, same as the system hives.
    • Lines to add to collection script:
      • $filesigs += '^c:\\Users\\.*\\ntuser\.dat(\.LOG[12])?$'
      • $filesigs += '^c:\\Users\\.*\\AppData\\Local\\Microsoft\\Windows\\usrclass\.dat(\.LOG[12])?$'
  • Windows Event Logs
    • Description: The .evtx files are Windows’ own diary: logons, new services, PowerShell activity, RDP sessions, process creation if auditing is turned on, and the logs themselves being cleared.
    • Importance: ★★★★★
      • Security (4624 and 4625 logons, 4688 process creation, 1102 log cleared), System (7045 new service) and PowerShell Operational (4104 script blocks) are the ones I open first.
      • They roll over. The default sizes are small, so on a busy server the Security log may only reach back a few days. Collect early.
    • Line to add to collection script:
      • $filesigs += '^c:\\Windows\\System32\\winevt\\Logs\\.*.evtx$'
  • Prefetch Files
    • Description: Windows records what a program loads in its first few seconds so it can launch faster next time. As a side effect, you get the program’s run count, last run times (up to eight on Windows 8 and later), and the files it touched. Disabled by default on Windows Server. Covered in 5.1.
    • Importance: ★★★★★
    • Line to add to collection script:
      • $filesigs += '^c:\\Windows\\Prefetch\\.*\.pf$'
  • Application Experience Service Artifacts
    • Description: Amcache.hve is a registry hive that inventories programs on the system, including their full path and SHA1 hash. An entry means Windows knew about the file, not that it ran. RecentFileCache.bcf is its Windows 7 predecessor. Covered in 5.1.
    • Importance: ★★★★☆
    • Line to add to collection script (includes the hive’s transaction logs):
      • $filesigs += '^c:\\Windows\\AppCompat\\Programs\\Amcache\.hve(\.LOG[12])?$'
      • $filesigs += '^C:\\Windows\\AppCompat\\Programs\\RecentFilecache.bcf$' (Windows 7 only)
  • Jump Lists
    • Description: Right-click a program on the taskbar and you get a list of the files it opened recently. Windows keeps those lists per application, in AutomaticDestinations (built by Windows) and CustomDestinations (built by the app).
    • Importance: ★★★★☆
      • Each entry records the file’s path and timestamps, and often the volume and machine it lived on. They stick around after the file itself is deleted.
      • Great for “did Bob open that file,” including files on USB drives and network shares.
    • Lines to add to collection script:
      • $filesigs += '^c:\\Users\\.*\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\.*$'
      • $filesigs += '^c:\\Users\\.*\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\.*$'
  • Shortcuts
    • Description: Windows quietly drops a .lnk file in the user’s Recent folder every time they open a file. Each one records the target’s path, size and timestamps, plus the volume and sometimes the machine it came from.
    • Importance: ★★★★☆
      • Like jump lists, they outlive their targets, so they can prove a file existed and was opened after it’s long gone.
    • Line to add to collection script:
      • $filesigs += '^c:\\Users\\.*\\AppData\\Roaming\\Microsoft\\(Windows|Office)\\Recent\\.*\.lnk$'
  • USB First and Last times used
    • Description: setupapi.dev.log records every driver installation, including the first time each USB device was plugged into the machine. The rest of the story lives in the registry and the event logs.
    • Importance: ★★★☆☆ (★★★★★ when the question is data theft)
      • setupapi gives you first connection. The SYSTEM hive (USBSTOR and the device’s Properties keys) gives you serial numbers, friendly names, and last connected and removed times, and each user’s NTUSER.DAT (MountPoints2) tells you who had the drive mounted.
      • On Windows 10 and later, the Microsoft-Windows-Partition/Diagnostic event log (event 1006) records connections too, and you’re already collecting it with the event logs.
    • Line to add to collection script:
      • $filesigs += '^C:\\Windows\\inf\\setupapi.dev.log$'
  • Browser Artifacts
    • Description: Turns out the internet works faster if people don’t download things they have already downloaded before. To keep track of all the places you have been and the files you have locally cached already, browsers store a ton of info in a variety of databases.
    • Importance: ★★★★★
      • This is a pretty important item to grab because it collects information on Windows Explorer in addition to Internet Explorer.
    • Lines to add to collection script:
      • IE
        • $filesigs += '^c:\\Users\\.*\\AppData\\.*\\Microsoft\\Windows\\WebCache\\.*'
      • FireFox
        • $filesigs += '^c:\\Users\\.*\\AppData\\.*\\Mozilla\\Firefox\\Profiles\\.*'
      • Chrome
        • $filesigs += '^c:\\Users\\.*\\AppData\\.*\\Google\\Chrome\\User\ Data\\Default\\.*'
      • Edge
        • $filesigs += '^c:\\Users\\.*\\AppData\\.*\\Microsoft\\Edge\\User\ Data\\Default\\.*'
      • This will grab all of the associated files from all of the profiles