Archaeological Dig for Digital Forensics

Thursday, February 7, 2013

Tools - GPS Tracker

If I have a GPS information, I will search these through APP like Google earth.

However if I get a lot of GPS information............

So I made a tool by python.

Download : http://dorumugs-tools.googlecode.com/files/GPS_Tracker.py

# GPS_Tracker.py --help

Usage: Python GPS_Tracker.py -l LINE.TXT -t TACK.TXT

Options:
-h, --help show this help message and exit
-l LINE, --line=LINE Make a line from Start to End
-t TACK, --tack=TACK Tack a GPS on the map

Line.txt

37.3998107,127.1111664

37.3997000,127.1112142

37.3995925,127.1113009

37.3995006,127.1113432

37.3994119,127.1113712

......

37.4674538,127.0361924

37.4681327,127.0355551

.......

37.5343720,126.9972295

37.5342722,126.9969639

37.5342995,126.9966298

37.5342557,126.9965094

37.5344452,126.9964499

Tack.txt

37.4555342,127.0475550

37.5367527,127.0005321

EnScript - EntryClass (2)

I can search for something through
File Name,
Size,
Hash,
Full Path
.....

and

identify files inside zip.

Name	Return Type	Declaration
MountVolume	VolumeClass	const MountVolume (uint Options, const String &Password="")
MountVolume	VolumeClass	const MountVolume (uint Options, CredentialClass credentials)

I brought it from EnCase Help page.
########################### Code and Result ###########################

Black : Code
Red : Result

######################################################################

//Recurse all entries in the case and perform a 'View File Structure' on files that have an extension of ZIP.
//Print out the paths of the files inside the ZIPs

class MainClass;

class MainClass {
bool good;
void Main(CaseClass c) {
int notWorks;
uint opts; //can be any of EntryClass::MountOptions
for(ItemIteratorClass i(c); EntryClass e = i.GetNextEntry();) {
if (e.Extension().Compare("zip") == 0) {
Console.WriteLine("Mounting " + e.FullPath());

Mounting

Console.WriteLine(e.TruePath());

dorumugs\C\Program Files (x86)\Autopsy\java\docs\beansbinding-1.2.1-doc.zip

VolumeClass vol = e.MountVolume(opts, ""); //no password. If a zip is password protected, vol will be null
if (vol) {
forall (EntryClass mountedEntry in vol) {
/*
notice that the 'FullPath' property is not the same as what the Table View shows.
This is because the entries do not become part of the Case's Entry List until
AFTER the script ends. The only way to have the entries become part fo the case's
entry list immediately is to add the device or evidence file to a case that is not
part of the GlobalDataClass::CaseRoot().
*/
Console.WriteLine("Entry Name=" + mountedEntry.TruePath());
Console.WriteLine("Entry FullPath=" + mountedEntry.FullPath());

Entry Name=dorumugs\index-files

Entry FullPath=index-files

Entry Name=dorumugs\index-files\index-1.html

Entry FullPath=index-files\index-1.html

Entry Name=dorumugs\index-files\index-10.html

Entry FullPath=index-files\index-10.html

Entry Name=dorumugs\index-files\index-11.html

Entry FullPath=index-files\index-11.html

}
}
else {
Console.WriteLine("Could Not Mount " + e.FullPath());
notWorks++;
}
}
}
if (notWorks == 0)
Console.WriteLine("Worked");

Worked

else
Console.WriteLine("Does not work");

Does not work

}
}

Wednesday, February 6, 2013

EnScript - EntryClass (1)

I can search for something through
File Name,
Size,
Hash,
Full Path
ETC.............

BookmarkClass

Name	Return Type	Declaration
BookmarkClass	void	BookmarkClass (BookmarkClass parent=null, const String &Name="", uint Options=0)

- BookmarkClass -
parent - The parent folder for this node
Name - Name
Options - 32-bit unsigned integer

ItemIteratorClass

Name	Return Type	Declaration
ItemIteratorClass	ItemIteratorClass	ItemIteratorClass ()
ItemIteratorClass	ItemIteratorClass	ItemIteratorClass (CaseClass _case, uint Options=0, IterateModes mode=ItemIteratorClass::ALL, const String &Name="")
ItemIteratorClass	ItemIteratorClass	ItemIteratorClass (DeviceClass Device, uint Options=0)

Name	Return Type	Declaration
Compare	int	const Compare (const String &Text, uint Options=0)
Contains	bool	const Contains (const String &Expression)
Name	string	static File Name (const String & Name)

- Compare -
Returns < 0 if value is lexically less than, 0 if equal, > 0 if greater
Arguments:
Text - Input string
Options - CASE

- Contain -
Returns true if text is contained in this string
Arguments:
Expression - Search Expression

- Name -
Format string with argument
Arguments:
Format - File Name string

When you test this code, you must select items as picture.

I brought it from EnCase Help page.
########################### Code and Result ###########################

Black : Code
Picture : Result

#######################################################################

//Recurse all entries and bookmark entries named 'win.ini'

class MainClass;

class MainClass {
bool good;
void Main(CaseClass c) {
BookmarkClass folder(c.BookmarkRoot(), "EntryClass Example 1", NodeClass::FOLDER);

for(ItemIteratorClass i(c); EntryClass e = i.GetNextEntry();) {
if (e.Name() == "win.ini") {

BookmarkClass newMark(folder);
newMark.CopyItemData(e);
newMark.SetComment("Bookmarked win.ini");

good = true;
}
}
if (good)
Console.WriteLine("Worked");
else
Console.WriteLine("Does not work");
}

}

Monday, February 4, 2013

EnScript - DateClass

DateClass gives functions about date and time.
So it's useful when i configure time like GMT.

Let's start DateClass!

NameListClass	void	NameListClass (NameListClass parent, const String &Name="", uint Options=0)
DayOfWeek	int	const DayOfWeek ()
Month	int	const Month ()
Day	int	const Day ()
Year	int	const Year ()
GetUnix	uint	const GetUnix ()
GetDateFormat	String	static GetDateFormat ()
GetTimeFormat	String	static GetTimeFormat ()
GetString	String	const GetString (const String &dateformat, const String &timeformat, int timezonebias)

- NameListClass -
parent - The parent folder for this node
Name - Name
Options - 32-bit unsigned integer

- DayofWeek -
Day of the week (0...6), Sunday = 0

- Month -
Month value (1..12)

- Day -
Day value (1..31)

- Year -
Year value in 4 digit format (1970..2040)

- GetUnix -
Retrieves the date as the number of seconds since 1970

- GetString -
Converts the date to the specified string format
Arguments:
dateformat - MM/dd/yy
timeformat - hh:mm:sstt
timezonebias - Time zone bias in seconds

- GetDateFormat -
Returns the global date format string

- GetTo,eFormat -
Returns the global time format string

I brought it from EnCase Help page.
########################### Code and Result ###########################

Black : Code
Red : Result

######################################################################

class MainClass;

class MainClass {

void Main(CaseClass c) {

DateClass date();
date.Now();

NameListClass days();

days.Parse("Sunday,Monday,Tuesday,Wednesday,Thursday,Friday,Saturday", ",");

NameListClass months();

months.Parse("Jan,Feb,Mar,April,May,June,July,Aug,Sep,Oct,Nov,Dec", ",");

Console.WriteLine("Today's date is " + days.ChildName(date.DayOfWeek()) + " " + months.ChildName(date.Month() - 1) + " " + date.Day() + ", " + date.Year());

Today's date is Monday Feb 4, 2013

Console.WriteLine("number of seconds since 1/1/1970 12:00AM = " + date.GetUnix());

number of seconds since 1/1/1970 12:00AM = 1359945233

//The GetString(String, String int) method subtracts the bias from GMT

Console.WriteLine("Current Time In Los Angeles:" + date.GetString(DateClass::GetDateFormat(), DateClass::GetTimeFormat(), 8 * 3600));

Current Time In Los Angeles:02/03/13 06:33:53오후

Console.WriteLine("Current Time In New York:" + date.GetString(DateClass::GetDateFormat(), DateClass::GetTimeFormat(), 5 * 3600));

Current Time In New York:02/03/13 09:33:53오후

Console.WriteLine("Current Time In Moscow:" + date.GetString(DateClass::GetDateFormat(), DateClass::GetTimeFormat(), -3 * 3600));

Current Time In Moscow:02/04/13 05:33:53오전

Console.WriteLine("Current Time In Beijing:" + date.GetString(DateClass::GetDateFormat(), DateClass::GetTimeFormat(), -8 * 3600));

Current Time In Beijing:02/04/13 10:33:53오전

Console.WriteLine("Note that the above times are not adjusted for Daylight Savings Time and thus may be off by an hour.");

Note that the above times are not adjusted for Daylight Savings Time and thus may be off by an hour.

Console.WriteLine("Current System Time:" + date.GetString());

Current System Time:02/04/13 11:33:53오전

}

Friday, February 1, 2013

EnScript - SystemClass

System Class has a lot of Functions
like

Selecting a file and Folder,
Writing result in console,
Popping up Message,
ETC.....

I brought it from EnCase Help page.
########################### Code and Result ###########################

Black : Code
Red : Result

######################################################################

class MainClass;

class MainClass {

void Main(CaseClass c) {
String path;
int i;
bool pluginExist;
path = "C:\\";

//ClearConsole()
SystemClass::ClearConsole(); // clears the console

//Message()
SystemClass::Message(SystemClass::ICONINFORMATION, "Message Example", "You are in the SystemClass Example");

//ScriptPath()
Console.WriteLine("The path of the script is " +SystemClass::ScriptPath()); // return full path of script

The path of the script is C:\Users\dorumugs\Desktop\dorumugs\mytest_1.EnScript

//Random()
Console.WriteLine("The random number generated was "+SystemClass::Random(300)); // returns a random integer

The random number generated was 96

//FolderDialog()
SystemClass::FolderDialog(path, "FolderDialog Example :: Choose a Folder");//FolderDialog can be used to select a folder
Console.WriteLine("Folder that was selected from FolderDialog is "+path);
path.Close(); // setting path to an empty string\

Folder that was selected from FolderDialog is C:\CASES

//PathDialog()
//PathDialog can be used with SystemClass::OPEN to open an existing file or SystemClass::CREATE to create a new file
SystemClass::PathDialog(path, "PathDialog Example :: Choose a File", "doc","TextFiles\0*.txt\0Word Document\0*.doc", SystemClass::OPEN);
Console.WriteLine("File that was selected from PathDialog is "+path);

File that was selected from PathDialog is C:\Program Files\EnCase7\winen.txt

//StatusRange()
SystemClass::StatusRange("Example Status Range", 20000000); //bottom right corner status blinks with "Example Status Range"

//StatusInc()
SystemClass::StatusMessage("Example Status Message"); //sets the status message for the StatusInc
for (i = 0; i < 20000000; i++)
SystemClass::StatusInc(1); //bottom right corner status blinks with Enscript name if the StatusMessage is not set

//PluginInstalled()
pluginExist = SystemClass::PluginInstalled(SystemClass::FBSE); // the option can be changed to any option in SystemClass::PluginTypes
if (pluginExist) //and Encase can be tested to see if that Plugin is installed
Console.WriteLine("Plugin Type FBSE is installed");
else
Console.WriteLine("Plugin Type FBSE is not installed");

Plugin Type FBSE is installed

//MajorVersion()
Console.WriteLine("Major Version of Encase = "+SystemClass::MajorVersion());

Major Version of Encase = 7

//MinorVersion()
Console.WriteLine("Minor Version of Encase = "+SystemClass::MinorVersion());

Minor Version of Encase = 5

//SubMinorVersion()
Console.WriteLine("Sub Minor Version of Encase = "+SystemClass::SubMinorVersion());

Sub Minor Version of Encase = 219

}
}

EnScript - Making a Dialog

I introduce the usage of DialogClass.
Sometimes i make a EnScript, I Always use these classes.
These give convenient functions.

GroupBoxClass	void	GroupBoxClass (WindowClass parent, const String &Title, int x, int y, int width, int height, ulong style, uint Count=0)
PathEditClass	void	PathEditClass (WindowClass parent, const String &Title, int x, int y, int width, int height, ulong style, String &Value, uint Options, const String &filelist="")
CheckBoxClass	void	CheckBoxClass (WindowClass parent, const String &Title, int x, int y, int width, int height, ulong style, bool &Value)
CheckBoxClass	void	CheckBoxClass (WindowClass parent, const String &Title, int x, int y, int width, int height, ulong style, NodeClass Node, uint prop)
DialogClass	void	DialogClass (WindowClass parent=null, const String &Name="")

- PathEditClass -

parent - The parent window

Title - Title bar text

x - The left coordinate of the control in dialog box units

y - The top coordinate of the control in dialog box units

width - The left coordinate of the control in dialog box units

height - The top coordinate of the control in dialog box units

Value - The name of the control

Options - DISABLED | REQUIRED | FILEOPEN | FILECREATE | FOLDEROPEN

filelist - A list file types separated by \t. Ex: "Text Files\t*.txt\tData Files\t*.data"

- CheckBoxClass -

Constructor
Arguments:
parent - Window that this object will belong to
title - Caption to be display above the checkbox
x - horizontal position where the top left corner of the control will be painted - can be a number or one of WindowClass::PlacementOptions flags
y - vertical position where the top left cornert of the control will be painted - can be a number or one of WindowClass::PlacementOptions flags
width - an integer value specifying the width of the control
height - an integer value specifying the height of the control
style - any of the WindowsClass::Styles flags Choose one of the following: BORDER, CAPTION, SIZEBOX, SYSMENU, TABSTOP, VSCROLL, HSCROLL, AUTOHSCROLL, AUTOVSCROLL, CENTER, GROUP, LEFT, LOWERCASE, MULTILINE, NOHIDESEL, NUMBER, OEMCONVERT, PASSWORD, READONLY, RIGHT, UPPERCASE, WANTRETURN, DEFPUSHBUTTON, GROUPBOX, HORIZONTAL, LEFTTEXT, PUSHBUTTON, MAXIMIZEBOX, MINIMIZEBOX.
value - the variable that holds the value of the control

- DiallogClass -

Constructor (does not paint the dialog)
parent - dialog
name - title bar caption

It's a example.

class MainClass;

class ArtDialogClass: DialogClass {

MainClass Main;

GroupBoxClass group1, group2;

PathEditClass saveFolder;

CheckBoxClass ckMft, ckEvent, ckRegistry, ckPrefetch;

CheckBoxClass ckDoc, ckDocx, ckXls,ckXlsx;

ArtDialogClass(DialogClass parent, MainClass main):

DialogClass(parent, "Artifacts EnScript for EnCase 7"),

Main = main,

saveFolder(this, "Artifacts Save Directory", 5, 5, 200, 15, 0, main.saveFolderPath, FOLDEROPEN|REQUIRED),

group1(this, "log2timeline", 5, 30, 200, 90, 0),

ckMft(this, "MFT File", 15, 45, 100, 12, 0, main.isMft),

ckEvent(this, "Event Log File", 15, 60, 100, 12, 0, main.isEvent),

ckRegistry(this, "Registry File", 15, 75, 100, 12, 0, main.isRegistry),

ckPrefetch(this, "Prefetch File", 15, 90, 100, 12, 0, main.isPrefetch),

group2(this, "documents", 5, 140, 200, 90, 0),

ckDoc(this, "doc File", 15, 155, 100, 12, 0, main.isDoc),

ckDocx(this, "docx File", 15, 170, 100, 12, 0, main.isDocx),

ckXls(this, "xls File", 15, 185, 100, 12, 0, main.isXls),

ckXlsx(this, "xlsx File", 15, 200, 100, 12, 0, main.isXlsx)

{

}

class MainClass {

bool isMft, isEvent, isRegistry, isPrefetch;

bool isDoc, isDocx, isXls, isXlsx;

String saveFolderPath;

void Main(CaseClass c) {

saveFolderPath = "C:\\timeline";

ArtDialogClass dlg(null, this);

if (dlg.Execute() == SystemClass::OK) {

String outPath = saveFolderPath + "\\";

}

If you copy upper code and paste and run, you can see the picture below.
It's just dialog.
But when you make a tool, upper code will make it more convenient.

Friday, January 25, 2013

File System Geography - NTFS

- Create a NTFS file
Prior to Test, I made a NTFS file named ntfs.dd.
Procedures are as below.

(1) Create a File filled with zeros
# dd if=/dev/zero of=./ntfs.dd bs=1024000 count=10
10+0 records in
10+0 records out
10240000 bytes (10 MB) copied, 0.239294 s, 42.8 MB/s

(2) Identify loop device not to use
# losetup -a
# losetup -f
/dev/loop0

(3) Connect ntfs.dd and /dev/loop0
# losetup /dev/loop0 ntfs.dd
# losetup -a
/dev/loop0: [0803]:516098 (/test/ntfs.dd)

(4) format loop0 as NTFS
# mkfs.ntfs /dev/loop0
The partition start sector was not specified for /dev/loop0 and it could not be obtained automatically. It has been set to 0.
The number of sectors per track was not specified for /dev/loop0 and it could not be obtained automatically. It has been set to 0.
The number of heads was not specified for /dev/loop0 and it could not be obtained automatically. It has been set to 0.
Cluster size has been automatically set to 4096 bytes.
To boot from a device, Windows needs the 'partition start sector', the 'sectors per track' and the 'number of heads' to be set.
Windows will not be able to boot from this device.
Initializing device with zeroes: 100% - Done.
Creating NTFS volume structures.
mkntfs completed successfully. Have a nice day.

(5) Mount loop0 and Copy a file to test
# mount -o loop ./ntfs.dd ./NTFS/
# df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/sda3 28755580 4829808 22465064 18% /
udev 513268 232 513036 1% /dev
none 513268 136 513132 1% /dev/shm
none 513268 348 512920 1% /var/run
none 513268 0 513268 0% /var/lock
none 513268 0 513268 0% /lib/init/rw
none 28755580 4829808 22465064 18% /var/lib/ureadahead/debugfs
/dev/sda1 233333 23889 197397 11% /boot
/dev/sdb1 206422036 191748 195744668 1% /cases
/dev/loop0 9996 2500 7496 26% /test/NTFS

# cp ~/Desktop/forensics.jpg ./NTFS/
# umount /dev/loop0

- NTFS Layout
VBR(Volume Boot Record) has a $MFT Offset.

- Tracking a NTFS
HexEditor shows file structure. there is the file inputed JPG.(forensics.jpg)

- VBR(Volume Boot Record)
VBR is first sector of volume. So searching is very easy.
VBR = MBR + reserved

VBR has a $MFT Offset by cluster, size of sector, size of cluster... etc.
For indicating a file like forensics.jpg, Tester go to $MFT.
Because $MFT has all attributes about files.

- MFT
I checked first cluster of MFT. it is 4. 4 is 4 cluster offset.
a sector is 512. a cluster is 4096. 4 cluster are 16384 => 0x4000.

In 0x4000
I can identify MFT record record signature. The Size of each record is 1024 => 0x400.
The Size of MFT is 0x010400 => 66560.
66560 / 1024 = 65. in other words, MFT has 65 record.

NTFS checks each record like 1024 -> 1024 -> 1024...... -> end of 1024.

- MFT Record of JPEG(forensics.jpg)
I searched for forensics.jpg at 0x14000 =>81920.
The Start offset of MFT is 0x4000. So 0x14000 - 0x4000 = 0x10000.
0x10000 => 65536 / 1024 = 64. forensics.jpg is record 64.

Each Record has a lot of attributes like MAC times, File Size, File offset.....ETC

The offset of forensics.jpg is 0x1A2. but this value must Multiply 0x1000.
0x1A2 * 0x1000 = 1A21000

The size of forensics.jpg is 5 Cluster
0x1A2000 + 0x5000(5 Cluster) = 1A7000

- DATA of JPEG(forensics.jpg)
0x1A2000 has JPEG header signature(FFD8). 0x1A6320 has JPEG footer signature(FFD9)

- Idendify a JPEG(forensics.jpg)
For identification of forensics.jpg, I used dd tool.
if => input
of => output
bs => block size (=block is cluster in unix)
skip => skip as much as block size.

bash-3.2# dd if=ntfs.dd of=forensics.jpg bs=4096 count=5 skip=418
5+0 records in
5+0 records out
20480 bytes transferred in 0.000217 secs (94394886 bytes/sec)

File : forensics.jpg
URL : http://pchs.peachschools.org/sites/pchs.peachschools.org/files/computer-forensics.jpeg