Monitor Registry Changes

Abstract

Microsoft introduced the concept of registry in its operating system Windows 95.  It was introduced to accommodate the growing need of application and system settings that were kept in INI files prior to Win95.  Instead of the slow consecutive search, the registry created a fast and robust database for configuration settings.  Configurations are stored by applications in configuration files, INI files, or in most cases in the registry.  Understanding and monitoring the registry is a crucial skill in digital forensics in order to validate findings and to research application behaviors.  In this paper, we examine the process of searching of data and monitoring the results to locate artifacts that can identify if a user searched for keywords in the past and in what order.  Knowing the structure of the registry and the concept of hives, we can predict that user typed keywords will be kept user specific, thus if the keywords are saved in the registry, they will be saved in the ntused.dat user specific registry hive.  In this paper, we explore this assumption and show the process of locating answers to questions related to specific user activity on Windows 7 Professional operating system.

Summary

Value Characteristics: UNICODE encoded binary value

Registry Key:  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery

Registry Hive:C:\Users\<UID>\ntuser.dat

Time of Last Search:  Last written time to registry key \Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery

Search Order Determination:MRUListEX data value

Maximum Values Before Overwritten:100

Relevance: User Specific

Value terminator:UNICODE 00 or 0x00, 0x00

MRListEx Terminator:0xFF 0xFF 0xFF 0xFF

Example of Search History

The last data value searched can be identified by its name ( index value ) since if the keyword is already in the list, only its index value moved into the first position in MRUListEx.  If the keyword is not already in the list, a new name ( index value ) is created as the highest index value in the list.

	Index Value
Index Value ( 32 bits )	0	1	2	3	4	5	6	7	8
Data	zero	100	200	300	400	500	600	700	800
MRUListEx	876543210
Search for	400
MRUListEx	487653210
Search for	700
MRUListEx	748653210
Search for	200
MRUListEx	274865310

Base Case

If a user types in Windows Explorer a keyword, Windows seems to remember previously used keywords and suggest the user those keywords, see image below.  That suggests that Windows keeps a list of previously used keywords in a list somewhere. 

Figure 1: Suggested keywords as the search term is typed

If the keywords were saved in the registry, we could just do a simple keyword search and locate where Windows keeps these keywords.  Unfortunately, it is not the case with these keywords. 

Figure 2: Search registry for previously used keywords ( regedit )

If we search for these keywords, the result will be that these keywords are not located in the registry. 

Figure 3: Searching for keywords in the registry result in no "hits" at all

Setup and Monitoring

In order to minimize the irrelevant data captured by this process, we need to stop any unnecessary processes and applications.  Since the operating system can start tasks, updates, and applications can have triggered events, we do not want to capture those events that are not relevant to our tests.  We can’t avoid capturing irrelevant events since the operating system needs to function and will make changes to the registry and file system without human interaction.  We can only minimize this data and use heuristic approach to identify what is part of the “normal” operating system operation and what is part of the tested procedures.  We can build procedures for a test platform as our baseline to use as a testing machine and to create a scientific base of all such tests. 

In our case, we’ll be using InCtrl5 (http://www.hiren.info/downloads/freeware-tools/page/8 ).  This application will allow us to take a basic snapshot of the operating system registry and file system, perform our test and compare the results to the original snapshot.  This way, we will only capture our interaction with the operating system and changes saved as a result.

Install InCtrl5 ( on Windows 7 or higher, you might have to run it in compatibility mode )

Figure 4: Set compatibility mode for InCtrl5 executable

Run InCtrl5 as administrator to get access to the whole system and registry.

Run InCtrl5 and adjust the drive list it will monitor.  If you have the operating system on C:\ drive and the application will be installed onto the same drive, then only leave C:\ drive listed.

Figure 5: Remove drives from the list that will not be involved in the test procedures

Click GO! To take the baseline snapshot of the system.  InCtrl5 will reform the snapshot and will terminate.  After the application terminate only perform changes that you need to capture and do not perform any other functions since they will increase the “noise” in the captured data.

Figure 6: After the initial snapshot, the application terminates

Digital Forensics is about recognizing patterns and build hypothesis based on those patterns.  So, when you type in keywords to search for in Windows Explorer, type words that have minimum difference and the difference is consecutive in ASCII values.  In this case, I have chosen values that are text based, but a single digit is consecutively increasing.  The values were typed in were exampleSearch1, exampleSearch2,  exampleSearch3, exampleSearch4, exampleSearch5, and exampleSearch6.  We can see that Windows must be keeping these keywords in order of type from the latest to the earliest. 

Figure 7: Typed keywords

After typing the keywords, we have to launch InCtrl5 again, but this time the interface will be different.  This time, we have to tell the application that we are completed our installation process.  Even though we have not installed anything, our interaction with Windows Explorer will be captured with other events that happened while we type our keywords.  Even if we’ll have some “noise” in our capture, it will still be much less data to analyze than analyzing the entire registry.

Click on “Install complete” to finish the process.

Figure 8: After the user interaction, we have to take another snapshot and compare the results to the baseline

The results can be viewed as HTML, CSV, or text.  I like to use the HTML for initial review and searching.  Click on the HTM radio button and click Launch to open the report in your default browser. 

Figure 9: Report view options

This is where experience in pattern recognition can come handy, but we can see the simple consecutive pattern emerging in the report.  I know, I selected digits as my consecutive variables and started it with 1 where 1 is represented as 0x31 in hex value.  Therefore, the pattern was easy to recognize as something to do with the keywords that were typed in.  We can see that we are looking at HKEY_CURRENT_USER top level key that is user specific and related to the ntuser.dat file of the currently logged in user.  

Figure 10: Registry pattern recognized in report

We can take the identified sting and try to convert it to see if we can identify any more patterns.  It does look like that each hex value is followed by a double zero that is a pattern for UNICODE characters.  Using a quick search on the web, we can identify websites that can help us in this conversion.  The results might not be exact, but as you can see below, the keyword string is visible and we can see that we located our keywords.

http://www.rishida.net/tools/conversion/

65, 00, 78, 00, 61, 00, 6D, 00, 70, 00, 6C, 00, 65, 00, 53, 00, 65, 00, 61, 00, 72, 00, 63, 00, 68, 00, 36, 00, 00, 00

Figure 11: Converting Hex to ASCII

Another method we can use is using Notepad++ or any other text editor were we can replace the pattern , 00, with : for other websites to convert for a better looking results.

Figure 12: Use Notepad++ to identify pattern to replace

We can use the software to help us quickly replace the pattern without removing anything relevant to our message.

Figure 13: Global replace of pattern

The result might not be very clean, but we will only have format discrepancies at the end of the string that we can easily correct by hand.  This format will work better with tools to convert to ASCII format.

http://www.dolcevie.com/js/converter.html

65:78:61:6D:70:6C:65:53:65:61:72:63:68:36

This time, the conversion will be cleaner without extensive extra work and the result is verifiable.

Figure 14: Clean conversion of Hex to ASCII

At this point, we can open the identified registry key and verify our findings by searching for more keywords and pressing F5 in regedit to refresh the screen.  We can see that we have located the correct subkey that keeps track of typed keywords, but it keeps the keywords as UNICODE encoded binary string that was not identified by the built in regedit search feature.  Now we know why. 

Figure 15: Registry Subkey is identified and verified in regedit

We can select the values and delete them for further verification and to learn about the MRUListEx data values.

Figure 16: Clear the registry subkey for further test

Since the identified subkey HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery does not have any other subkeys, so we can identify by the last time this subkey was updated the last time the user searched for a keyword.  In order to do that, we can export the registry subkey as text to see the time stamp the registry subkey was last updated.

Figure 17: Export the registry subkey as "text" to reveal the time stamp the user last search for keyword

Key Name:          HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery

Class Name:        <NO CLASS>

Last Write Time:   7/25/2012 - 12:37 PM

Further testing established that index values start at 0 and extend to 99 at that point the list rolls over to itself and starts overwriting keywords at index 0.

Figure 18:  Index maximum 99 ( 100 values are listed and then the old values overwritten )

Appendix

Process of order determination

MRUListEx shows 2,1,0 for values typed 1,2,3 where index 0=1, index 1=2, index 2=3. 

Typed 1 again, the MRUListEx changed to 0,2,1 or equivalent value list of 1,3,2, moving the value 1 to the front as the most recently searched value.

Typed 2 again, the MRUListEx changed to 1,0,2 or equivalent value list of 2,1,3  moving the value 2 to the front as the most recently searched value.

This is a “blind” example to see if the prediction can be verified.  In this case, MRUListEx shows index list of 4,7,6,5,3,…, therefore the last value search was the value at name ( index ) 4, that is 3400 3500 0000.  Converting the hex values to UNICODE shows 45 was searched last time.

Tracking Copy vs. Move

In this test procedures, we wanted to examine the time stamp ( metadata ) changes between copying and moving files between the same and different file systems.

 Findings
We can distinguish between copy and move of a file from FATxx and from NTFS to NTFS file system, but we can not distinguish if we are performing these operations to a FATxx files system as a destination.  The main difference is the created time stamp in the Standard Information Attribute ( SIA ) is updated to the time the action was performed while moving the file did not make changes to the create time stamp.  In the case of copying files from FAT32 to NTFS, the modified time stamp did not change while all other time values reflected the time the file was originally created.  In the case of moving a file from FAT32 to NTFS, the created and modified time stamps did not change and all other fields were filled in reflecting the time the move was performed.  FAT16 showed a difference since SIA updated the accessed time stamp in a case of moving it to an NTFS volume while moving the file did not update SIA file accessed time stamp.

Eventtrigers and their danger - attacker

This is the second part of "Eventtrigers and their danger - victim" video where the attacker point of view is examined.  In this case, knowing internal logging policy can be used against the victim by purposely triggering a log event.

SNORT with Database Setup

In this video, I continue setting up SNORT and configure logging to MySQL database.  I also show the testing methodology and monitoring of the database using SNORT Alert Monitor Jr. I modify a rules file to generate quick alerts at different priority levels.

Pivot Charts

Use of pivot charts in Excel makes triage and/or indicators of compromise discovery easier just by examining file metadata and ownership by plotting them on charts.  Pivot charts can be used in many other type of analysis where specific patterns can help the analysis.  Patterns can be easily identified by a visual reference like a chart and pivot charts make the creation and identification much easier.

Be Prepared, not Afraid

This video shows you how to setup SNORT on Windows 7.  As I setup SNORT, I also show you how to troubleshoot problems that you might face in configuring a primarily Linux application on Windows.  One of the most common issues will be the interpretation of folder separators.

Enjoy!

Digital Forensics is not just HOW but WHY

Digital Forensics is not just HOW but WHY

This paper will focus on the proper understanding of Digital Forensics from the educational point-of-view and explain the problem with certification based skill validation to establish "expert" skills since education did not really existed up to just a few years ago.  Since Digital Forensics is a discipline of Forensic Science when it comes to properly identifying relevant evidence, strong education should be enforced.  The term forensics, by definition, deal with presenting evidence to a forum, so forensics is not automatically means the discipline of forensic science and does not need the deep technical knowledge as Digital Forensics does.  Forensics is the presentation of artifacts located by a digital forensic expert who is properly educated on technology and the scientific method to evaluate the reliability of the located artifacts.

Methodology Based Discussion

The practice of digital forensics is based on three basic premises:

- Risk management  
(due diligence to find, handle, and protect evidence) 
- Pattern recognition 
(patterns can lead to conclusions and speedier processing of data in question)
- Process control      
(following laws, regulations, and policies that control how data needs to be examined)

Digital forensics is the process of acquiring, analyzing, and presenting relevant and admissible digital data from different data states in a forensically sound manner suitable for litigation support.  Procedures involve digital evidence is used in many type of crimes scenes where digital evidence must be preserved and protected since digital evidence is easily altered and never assume that it was destroyed.[4] Tools and procedures are generally following the Daubert standard and the process of analysis based on the scientific method.  Daubert v. Merrell, 509 U.S. 579 (1993), established the base for the admissibility of expert witnesses’ testimony in federal legal proceedings.  Texas is one of the states accepting Daubert as a rule of admissibility [2].  The scientific method [3] establishes procedures to aid the methodology of determining events that occurred and testing hypotheses in analyzing digital evidence.  Digital forensics key aspects are reliability, repeatability, and verifiable results.

 “A digital investigation is a process to answer questions about digital states and events.”[1]
 “A digital forensic investigation is a special case of a digital investigation where the procedures and techniques that are used will allow the results to be entered into a court of law.  The digital investigation process involves formulating and testing hypotheses about the state of a computer.”[1]
“Digital evidence is data that supports or refutes a hypothesis that was formulated during the investigation.  This is a general notion of evidence and may include data that may not be court admissible because it was not properly or legally acquired.”[1]

References:
1.Brian D. Carrier , “Basic Digital Forensic Investigation Concepts “,June 07, 2006 , http://www.digital-evidence.org/di_basics.html, Accessed: January 20, 2009
2.“ADMISSIBILITY OF SCIENTIFIC EVIDENCE UNDER DAUBERT”, http://faculty.ncwc.edu/mstevens/425/lecture02.htm, Accessed: January 20, 2009
3.Kenneth Lafferty Hess Family Charitable Foundation , “Steps of the Scientific Method”, http://www.sciencebuddies.org/science-fair-projects/project_scientific_method.shtml, Accessed: January 20, 2009
4.U.S. Department of Justice, “Digital Evidence Field Guide Version 1.1”, http://www.rcfl.gov/downloads/documents/FieldGuide_sc.pdf, Accessed: January 20, 2009

In forensic science, where computer forensics is one of the disciplines, the focus must be on the scientific method and on the location of relevant information to the case using tools and techniques that will result in a forensically sound reporting of the facts in the case.  What are those facts and where they come from?  Do you only look at the contents of the data or you consider the data states, the way the data was stored, and the types of data you encounter?  Would the text that was accessed from the suspect's My Documents folder, which was plain text saved by the user be more important than a text that was located in the 4th sector of the hard drive with Base64 encoding and no known user tools that can access that part of the drive?  I would consider a different intent in the second case.  The cube below explores all possibilities when we analyze data so we can present the findings based on the context and also on the circumstance we found that data.

The following methodology, cube will help you analyze your case with all the major technical aspects in mind.

Business Aspects and Keeping the Industry Viable

Besides the technical aspects, business aspects need to be considered when we talk about Digital Forensics and the future of the industry.  It would be nice not to pay for surgery if the patient did not make it out of surgery.  There are challenges and additional time that needs to be considered with allocated visible data vs. hidden data that is encrypted. Recovering data has its challenges on its own.  Data that has been wiped only once can introduce just as much challenge as data that has been over written many times.  Modern storage devices are manufactured based on more precise technology then older drives and newer drives also store data in a denser configuration.  Technology maturity makes data recovery not feasible in some cases.  The time, effort, and cost associated with data recovery needs to be examined before the proper tools are selected.  In digital forensics, most of the time we only need to result to use software utilities to do the job, but in some cases custom controller board, or in extreme cases a scanning tunneling microscope ( STM ) is required to recover data.  In some cases, we need to remove the chip containing the data and extract the raw data from the chip or JTAG the controller board to extract the raw information.  Even if all the efforts placed on recovering data, the results might only be partial structure of the lost data or just bits and bytes that will be full of missing information to really make sense out of.  In some cases, we can get lucky and recover the whole data and its structure using software tools that is cost prohibitive, effort less, and timely.
The following methodology can be used to point out these challenges and end results to clients to eliminate the “CSI effect” where customers expect full recovery of everything in 20 minutes ( including commercial breaks ).  It might be possible, but not feasible to recover data in a timely manner that can be relevant and admissible evidence.  Again, certifications do not prepare professionals to consider or to deal with such data recovery challenges.  I have yet to see a certification that requires the candidate to recover a partially overwritten image and reconstruct that image in a viewable form like forensic tools do it by shading the unrecoverable area of the image black.  Therefore, certifications cannot be considered, even a combination of them, as a measure of expertise of a person.  We have to point back to methodologies and education as the best measure of skills required to evaluate completeness and relevance of artifacts.

 Besides the understanding of basic premises and technical aspects of relevant evidence analysis, appropriate analysis cannot be done without proper education in the field of Computer Science or Information Technology.  Many people rely on certifications that only provide immediate training on a certain aspects of software usage, but do not provide education to understand why software behaves a certain way and how to test the error rate of the software.  There is not focus in certifications on failure detection and verification of located data.  That training cannot be recognized as a skill justification for a field that is a discipline of forensic science.  Certifications are not focusing on the time and cost associated with data analysis and the value of triage to reduce these factors.  Most professionals in this field take pride in their ability to triage a case and analyze a case faster than others, but certifications are not a validation of these important aspects of case work.

The stages of professional development are:
1. Awareness - introduces the WHAT concept without technical knowledge or skill
2. Training    - introduces the HOW concept where proper software/hardware usage established without understanding the implementation of tools validation of findings
3. Education  - establishes the WHY that is based on awareness and the training aspects including verification and detailed understanding of technology "behind" the software/hardware tools for a thorough understanding of artifacts resulted from those tools.

In the following methodology, awareness was referred to as tools since awareness of tools can help us locate data.  Tools are still requiring training to use them properly, but education that makes value of those findings.

Digital Forensic Analysis Flowchart

The basic flowchart of a thorough digital forensic analysis starts with the scope identification.  Analysis is only performed on a forensic duplicate of the evidence that was created utilizing reliable tools.  Every hypothesis is verified with experiments and observations.  The results are not drawn until verification of findings is verified by multiple tools or preferably by hand in a hex editor.

Transfer of Evidence or a DNA of an Event

Let's start with a reference to this theory that has been used in forensic science, Locard's exchange principle. Edmond Locard (1877-1966) was the founder and director of the Institute of criminalistics at the University of Lyons in France. Locard believed that whenever a criminal came into contact with his environment, a cross-transference of evidence occurred. He believed that "every criminal can be connected to a crime by dust particles carried from the scene." (Saferstein, Richard, Criminalistics, Seventh Ed., 2001)
Here we'll be focusing on evidence or data location as a process based discovery where we have to triage the event in question. In any digital system, humans interact with an operating system by using applications in turn the operating system interacts with the hardware. Thus, relevant evidence transfer must take place at each of these interaction points.

Therefore, relevant evidence can connect a person to a crime scene by blood, semen, saliva, and hair, to paint, explosive, drugs, impressions, and chemicals. In digital device interaction or even network communication, the basic premise is that where ever we go ( browse or launch an application ), we will carry some evidence with us and leave some behind. We cannot interact with digital devices without a transfer of evidence occurring.

The main transfer points in local systems are:
- UA -User to Application ( i.e user starts IE browser )
- AOS -Application to Operating System ( i.e. IE browser stores recently typed URLs in the registry )
- UOS -User to Operating System ( i.e. user interrupts the boot process to load kernel drivers for a SCSI drive )
- OSH -Operating System to Hardware ( i.e. OS saves a file to the physical drive or temporarily stores data in physical memory )
- UH -User to Hardware (user changes the hard drive jumper or sets the thumb drive switch to read only)

Wiki page for methodology development: http://dfmethodologies.wikispaces.com/Digital+Forensics. 
On this Wiki, you can also contribute to improve on existing methodologies and help develop new ones.

Digital Forensics’ core idea is to not change digital evidence regardless of the storage formats being examined by following a forensic triage using forensically sound tools.  The triage is a hierarchical process where the first step is to acquire the data by a bit-by-bit copy method so the analysis can be done using that copy instead of the original storage device.  Before analysis of the data, the integrity of the data must be maintained by protecting the acquired and the original data.  The forensic triage or any type of data stored on any operating system must be performed by a tool accepted in the court of law.  The basic characteristic of the forensically sound tool is to be testable so the relevant scientific community can review its operations and determine its expected error rate.  Thus, tools must be made available for testing and peer review before the tools can be used to perform any of the stages in the forensic triage.  In most cases, in lieu of extended testing, using tools from different sources but with similar capabilities can be used to validate the accuracy of the findings.  Most IT practitioner overlooks the importance of the final stage of the investigation; PRESENTATION is just as much important as the other stages.  Report writing and presenting the findings of the case in an easy to understand manner is key to help decision makers understand the relevance of the located facts.  Presentation is an indirect part of digital forensics that is based on the located relevant evidence, thus we can only refer to it as forensics.

Note: eDiscovery and always-on devices like cell phones, PDAs, and the need for real time analysis of systems of volatile data will make the protection and validation a challenge if it is questioned based on the traditional methodology.

Note: In the methodology above, storage formats lists the major branches or operating system types since one of the function of the operating systems is to manage the file system, therefore the implementation of the operating system that controls how a data is actually stored on secondary storage.

Understanding of the concepts discussed before aid the development of specific methodologies, for example in application research.  Education provides understanding of what happens as a result or user interaction, how to identify those changes, and why we might misinterpret data if we do not look at all aspects us user interaction.  User interaction can create files on their desktop that is recorded by the operating system on the file system and applications can record that action in their logs.  Applications and operating systems can record changes in many different ways, but on Windows OS the most common place these days is one of the registry hives and/or their log files.

In the following methodology, you can see the focus on the registry and understanding that registry changes might be updated at different operating system states.  In this methodology, you can distinguish user, application, and operating system changes.  This way, you can establish if there were any user interactions at all or if an application was making changes without user interaction.  The user interaction might be that someone can schedule a task to run later in time, but the actual event will be taken place without that user's presence at that time.  This is the methodology that is hard to cross reference by automatic tools and partially analyzed by those tools, but only an educated user can identify flaws or finish the partial analysis of the software tools.

Conclusion

This paper was exploring the possible clarification of terminologies and to develop a methodology based explanation of aspects in Digital Forensics.  Methodologies like the ones presented in this paper can be used to develop more educated professionals in this industry and will help better tool development.  I hope to receive feedback on these methodologies and to develop others with the digital forensic community's help.