Friday, February 1, 2013

EnScript - SystemClass


System Class has a lot of Functions
like

Selecting a file and Folder,
Writing result in console,
Popping up Message,
ETC.....

I brought it from EnCase Help page.
###########################  Code and Result  ###########################

Black : Code
Red : Result

######################################################################


class MainClass;

class MainClass {

  void Main(CaseClass c) {
    String path;
    int i;
    bool pluginExist;
    path = "C:\\";
 
    //ClearConsole()
    SystemClass::ClearConsole(); // clears the console



    //Message()
    SystemClass::Message(SystemClass::ICONINFORMATION, "Message Example", "You are in the SystemClass Example");



    //ScriptPath()
    Console.WriteLine("The path of the script is " +SystemClass::ScriptPath()); // return full path of script


The path of the script is C:\Users\dorumugs\Desktop\dorumugs\mytest_1.EnScript


    //Random()
    Console.WriteLine("The random number generated was "+SystemClass::Random(300)); // returns a random integer


The random number generated was 96


    //FolderDialog()
    SystemClass::FolderDialog(path, "FolderDialog Example :: Choose a Folder");//FolderDialog can be used to select a folder
    Console.WriteLine("Folder that was selected from FolderDialog is "+path);
    path.Close(); // setting path to an empty string\



Folder that was selected from FolderDialog is C:\CASES

    //PathDialog()
    //PathDialog can be used with SystemClass::OPEN to open an existing file or SystemClass::CREATE to create a new file
    SystemClass::PathDialog(path, "PathDialog Example :: Choose a File", "doc","TextFiles\0*.txt\0Word Document\0*.doc", SystemClass::OPEN);
    Console.WriteLine("File that was selected from PathDialog is "+path);



File that was selected from PathDialog is C:\Program Files\EnCase7\winen.txt

    //StatusRange()
    SystemClass::StatusRange("Example Status Range", 20000000); //bottom right corner status blinks with "Example Status Range"

    //StatusInc()
    SystemClass::StatusMessage("Example Status Message"); //sets the status message for the StatusInc
    for (i = 0; i < 20000000; i++)
      SystemClass::StatusInc(1); //bottom right corner status blinks with Enscript name if the StatusMessage is not set



    //PluginInstalled()
    pluginExist = SystemClass::PluginInstalled(SystemClass::FBSE); // the option can be changed to any option in SystemClass::PluginTypes
    if (pluginExist)                                               //and Encase can be tested to see if that Plugin is installed
      Console.WriteLine("Plugin Type FBSE is installed");
    else
      Console.WriteLine("Plugin Type FBSE is not installed");


Plugin Type FBSE is installed


    //MajorVersion()
    Console.WriteLine("Major Version of Encase = "+SystemClass::MajorVersion());

Major Version of Encase = 7

    //MinorVersion()
    Console.WriteLine("Minor Version of Encase = "+SystemClass::MinorVersion());


Minor Version of Encase = 5


    //SubMinorVersion()
    Console.WriteLine("Sub Minor Version of Encase = "+SystemClass::SubMinorVersion());


Sub Minor Version of Encase = 219


  }
}




EnScript - Making a Dialog


I introduce the usage of DialogClass.
Sometimes i make a EnScript, I Always  use these classes.
These give convenient functions.

GroupBoxClass void GroupBoxClass (WindowClass parent, const String &Title, int x, int y, int width, int height, ulong style, uint Count=0)
PathEditClass void PathEditClass (WindowClass parent, const String &Title, int x, int y, int width, int height, ulong style, String &Value, uint Options, const String &filelist="")
CheckBoxClass void CheckBoxClass (WindowClass parent, const String &Title, int x, int y, int width, int height, ulong style, bool &Value)
CheckBoxClass void CheckBoxClass (WindowClass parent, const String &Title, int x, int y, int width, int height, ulong style, NodeClass Node, uint prop)
DialogClass void DialogClass (WindowClass parent=null, const String &Name="")

- GroupBoxClass -
parent - The parent window
Title - Title bar text
x - The left coordinate of the control in dialog box units
y - The top coordinate of the control in dialog box units
width - The left coordinate of the control in dialog box units
height - The top coordinate of the control in dialog box units
style - BORDER | CAPTION | SIZEBOX | SYSMENU | TABSTOP | VSCROLL | HSCROLL | GROUP | MAXIMIZEBOX | MINIMIZEBOX | AUTOHSCROLL | AUTOVSCROLL | CENTER | LEFT | LOWERCASE | MULTILINE | NOHIDESEL | NUMBER | OEMCONVERT | PASSWORD | READONLY | RIGHT | UPPERCASE | WANTRETURN | DEFPUSHBUTTON | GROUPBOX | HORIZONTAL | LEFTTEXT | PUSHBUTTON
Count - Control count

- PathEditClass -
parent - The parent window
Title - Title bar text
x - The left coordinate of the control in dialog box units
y - The top coordinate of the control in dialog box units
width - The left coordinate of the control in dialog box units
height - The top coordinate of the control in dialog box units
style - BORDER | CAPTION | SIZEBOX | SYSMENU | TABSTOP | VSCROLL | HSCROLL | GROUP | MAXIMIZEBOX | MINIMIZEBOX | AUTOHSCROLL | AUTOVSCROLL | CENTER | LEFT | LOWERCASE | MULTILINE | NOHIDESEL | NUMBER | OEMCONVERT | PASSWORD | READONLY | RIGHT | UPPERCASE | WANTRETURN | DEFPUSHBUTTON | GROUPBOX | HORIZONTAL | LEFTTEXT | PUSHBUTTON
Value - The name of the control
Options - DISABLED | REQUIRED | FILEOPEN | FILECREATE | FOLDEROPEN
filelist - A list file types separated by \t. Ex: "Text Files\t*.txt\tData Files\t*.data"

- CheckBoxClass - 
Constructor
Arguments:
parent - Window that this object will belong to
title - Caption to be display above the checkbox
x - horizontal position where the top left corner of the control will be painted - can be a number or one of WindowClass::PlacementOptions flags
y - vertical position where the top left cornert of the control will be painted - can be a number or one of WindowClass::PlacementOptions flags
width - an integer value specifying the width of the control
height - an integer value specifying the height of the control
style - any of the WindowsClass::Styles flags Choose one of the following: BORDER, CAPTION, SIZEBOX, SYSMENU, TABSTOP, VSCROLL, HSCROLL, AUTOHSCROLL, AUTOVSCROLL, CENTER, GROUP, LEFT, LOWERCASE, MULTILINE, NOHIDESEL, NUMBER, OEMCONVERT, PASSWORD, READONLY, RIGHT, UPPERCASE, WANTRETURN, DEFPUSHBUTTON, GROUPBOX, HORIZONTAL, LEFTTEXT, PUSHBUTTON, MAXIMIZEBOX, MINIMIZEBOX.
value - the variable that holds the value of the control 

- DiallogClass - 
Constructor (does not paint the dialog)
parent - dialog
name - title bar caption 


It's a example.
class MainClass;
class ArtDialogClass: DialogClass {
    MainClass Main;
    GroupBoxClass group1, group2;
    PathEditClass saveFolder;
    CheckBoxClass ckMft, ckEvent, ckRegistry, ckPrefetch;
    CheckBoxClass ckDoc, ckDocx, ckXls,ckXlsx;
    ArtDialogClass(DialogClass parent, MainClass main):
    DialogClass(parent, "Artifacts EnScript for EnCase 7"),
    Main = main,
    saveFolder(this, "Artifacts Save Directory", 5, 5, 200, 15, 0, main.saveFolderPath, FOLDEROPEN|REQUIRED),
    group1(this, "log2timeline", 5, 30, 200, 90, 0),
    ckMft(this, "MFT File", 15, 45, 100, 12, 0, main.isMft),
    ckEvent(this, "Event Log File", 15, 60, 100, 12, 0, main.isEvent),
    ckRegistry(this, "Registry File", 15, 75, 100, 12, 0, main.isRegistry),
    ckPrefetch(this, "Prefetch File", 15, 90, 100, 12, 0, main.isPrefetch),
    group2(this, "documents", 5, 140, 200, 90, 0),
    ckDoc(this, "doc File", 15, 155, 100, 12, 0, main.isDoc),
    ckDocx(this, "docx File", 15, 170, 100, 12, 0, main.isDocx),
    ckXls(this, "xls File", 15, 185, 100, 12, 0, main.isXls),
    ckXlsx(this, "xlsx File", 15, 200, 100, 12, 0, main.isXlsx)
    {
    }
}

class MainClass {
  bool isMft, isEvent, isRegistry, isPrefetch;
  bool isDoc, isDocx, isXls, isXlsx;
  String saveFolderPath;
  void Main(CaseClass c) {
    saveFolderPath = "C:\\timeline";
    ArtDialogClass dlg(null, this);
    if (dlg.Execute() == SystemClass::OK) {
    String outPath = saveFolderPath + "\\";
    }
  }
}


If you copy upper code and paste and run, you can see the picture below.
It's just dialog.
But when you make a tool, upper code will make it more convenient.




Friday, January 25, 2013

File System Geography - NTFS


- Create a NTFS file
Prior to Test, I made a NTFS file named ntfs.dd.
Procedures are as below.

(1) Create a File filled with zeros
# dd if=/dev/zero of=./ntfs.dd bs=1024000 count=10
10+0 records in
10+0 records out
10240000 bytes (10 MB) copied, 0.239294 s, 42.8 MB/s

(2) Identify loop device not to use
# losetup -a
# losetup -f
/dev/loop0

(3) Connect ntfs.dd and /dev/loop0
# losetup /dev/loop0 ntfs.dd
# losetup -a
/dev/loop0: [0803]:516098 (/test/ntfs.dd)

(4) format loop0 as NTFS
# mkfs.ntfs /dev/loop0
The partition start sector was not specified for /dev/loop0 and it could not be obtained automatically.  It has been set to 0.
The number of sectors per track was not specified for /dev/loop0 and it could not be obtained automatically.  It has been set to 0.
The number of heads was not specified for /dev/loop0 and it could not be obtained automatically.  It has been set to 0.
Cluster size has been automatically set to 4096 bytes.
To boot from a device, Windows needs the 'partition start sector', the 'sectors per track' and the 'number of heads' to be set.
Windows will not be able to boot from this device.
Initializing device with zeroes: 100% - Done.
Creating NTFS volume structures.
mkntfs completed successfully. Have a nice day.

(5) Mount loop0 and Copy a file to test
# mount -o loop ./ntfs.dd ./NTFS/
# df
Filesystem           1K-blocks      Used Available Use% Mounted on
/dev/sda3             28755580   4829808  22465064  18% /
udev                    513268       232    513036   1% /dev
none                    513268       136    513132   1% /dev/shm
none                    513268       348    512920   1% /var/run
none                    513268         0    513268   0% /var/lock
none                    513268         0    513268   0% /lib/init/rw
none                  28755580   4829808  22465064  18% /var/lib/ureadahead/debugfs
/dev/sda1               233333     23889    197397  11% /boot
/dev/sdb1            206422036    191748 195744668   1% /cases
/dev/loop0                9996      2500      7496  26% /test/NTFS

# cp ~/Desktop/forensics.jpg ./NTFS/
# umount /dev/loop0



- NTFS Layout
VBR(Volume Boot Record) has a $MFT Offset.















- Tracking a NTFS
HexEditor shows file structure. there is the file inputed JPG.(forensics.jpg)







































- VBR(Volume Boot Record)
VBR is first sector of volume. So searching is very easy.
VBR = MBR + reserved

VBR has a $MFT Offset by cluster, size of sector, size of cluster... etc.
For indicating a file like forensics.jpg, Tester go to $MFT.
Because $MFT has all attributes about files.





































- MFT
I checked first cluster of MFT. it is 4. 4 is 4 cluster offset.
a sector is 512. a cluster is 4096. 4 cluster are 16384 => 0x4000.

In 0x4000
I can identify MFT record record signature. The Size of each record is 1024 => 0x400.
The Size of MFT is 0x010400 => 66560.
66560 / 1024 = 65. in other words, MFT has 65 record.

NTFS checks each record like 1024 -> 1024 -> 1024...... -> end of 1024.

































- MFT Record of JPEG(forensics.jpg)
I searched for forensics.jpg at 0x14000 =>81920.
The Start offset of MFT is 0x4000. So 0x14000 - 0x4000 = 0x10000.
0x10000 => 65536 / 1024 = 64. forensics.jpg is record 64.

Each Record has a lot of attributes like MAC times, File Size, File offset.....ETC

The offset of forensics.jpg is 0x1A2. but this value must Multiply 0x1000.
0x1A2 * 0x1000 = 1A21000

The size of forensics.jpg is 5 Cluster
0x1A2000 + 0x5000(5 Cluster) = 1A7000





























- DATA of JPEG(forensics.jpg)
0x1A2000 has JPEG header signature(FFD8). 0x1A6320 has JPEG footer signature(FFD9)




























- Idendify a JPEG(forensics.jpg)
For identification of forensics.jpg, I used dd tool.
if => input
of => output
bs => block size (=block is cluster in unix)
skip => skip as much as block size.

bash-3.2# dd if=ntfs.dd of=forensics.jpg bs=4096 count=5 skip=418
5+0 records in
5+0 records out
20480 bytes transferred in 0.000217 secs (94394886 bytes/sec)

File : forensics.jpg
URL : http://pchs.peachschools.org/sites/pchs.peachschools.org/files/computer-forensics.jpeg




Monday, January 21, 2013

File System Geography - FAT32



- Create a FAT32
# dd if=/dev/zero of=./fat32.dd bs=1024000 count=34
# mkfs.vfat -F 32 fat32.dd



- Identify created FAT32
# file fat32.dd
fat32.dd: x86 boot sector, mkdosfs boot message display, code offset 0x58, OEM-ID " mkdosfs", Media descriptor 0xf8, heads 64, sectors 68000 (volumes > 32 MB) , FAT (32 bit), sectors/FAT 523, serial number 0x98118991, label: " "



- FAT Layout

(1) FAT16
BR Reserved FAT #1 FAT #2 Root Directory               Data              


(2) FAT32
BR Reserved FAT #1 FAT #2     Root Directory             Data            



- Tracking a FAT32

For Tracking a file system, I input a jpeg file named forensics.jpg.
































- Boot Sector
You can identify total Sectors, size of per sector, root directory cluster, size of FAT.




- FAT32 Table



Media Type Partition State Cluster 2 Cluster 3
Cluster 4 Cluster 5 Cluster 6 Cluster 7
Cluster 8 Cluster 9 Cluster 10 Cluster 11
Cluster 12 Cluster 13 Cluster 14 Cluster 15
....................... ...................... ...................... ......................

# Medial Type    -       Hard Disk : F8 FF FF 0F
# Partition State -       Nomal : FF FF FF FF
# Cluster 2         -       Cluster of Root Directory

Hex Value Description
0x?0000000 Empty Cluster
0x?0000001 Reserved Cluster
0x?0000002 ~ 0x?FFFFFEF Used Cluster / Each number is cluster number
0x?FFFFFF0 ~ 0x?FFFFFF6 Reserved Cluster
0x?FFFFFF7 Bad Cluster like bad sector
0x?FFFFFF8 ~ 0x?FFFFFFF End of Cluster



- Moving to FAT1 and FAT2

(1) Moving to FAT1
512 * 32 = 16384 => 0x4000    Move to 0x4000 offset
Because The size of Reseved in FAT32 is 32Sector.

FAT size is 523 Sectors => 523 * 512 = 267776 => 0x41600






























(2) Moving to FAT2
The size of FAT is 26776. => 523 * 512 => 0x41600

Boot Sector + Reserved + FAT1         =    FAT2
        0         +   0x4000  + 0x41600     =    0x45600






























The end of FAT3 is 0x86C00 offset. => 0x45600 + 0x41600

The next of FAT2 is Directory Entry.



- Directory Entry
Name Extender Attr NT Res Reserved Create Time
Create Date Last Access Date First Cluster High Bytes Write Time Write Date First Cluster Low Bytes File Size

# 0 offset of Name
-> 0x00
This Directory is Empty. including under this directory.

-> 0xE5
Deleted Data

-> 0x05
Deleted Data for Japanese. / if it uses 0xE5, It will happen crash.

-> 0x20
If name length is below 8, it uses 0x20.


# Attribute
Hex Value Attribute/td> Description
0x01/td> Read Only Read Only Attribute
0x02/td> Hidden Hidden File Attribute
0x04/td> System OS File
0x08/td> Volume Label Volume Label, It must be root and only one.
0x10/td> Directory Directory
0x20/td> Archive Nomal File
0x0F/td> Long File Name Entry Long File Name Entry not Directory Entry


# Directory Entry Sample































The size of forensics.jpg is 33 Sectores. => 17192 / 512 = 33
forensics.jpg is From 3 sector to 36 Sectors.































File's First : From Data's 3 sector.































File's End :  To Data's 33 sector.































File : forensics.jpg
URL : http://pchs.peachschools.org/sites/pchs.peachschools.org/files/computer-forensics.jpeg