UserAssist

We talk a lot about UseAssist key and its structure, but I don;t see much talk about what it really means to forensic investigators.  We've seen its structure change since WinXP and now the run count starts from 0 instead of 5 and it has some strange structures, but the time is still there to interpret. 

First of all, we need to understand what we have to check in order to see if it should keep the list of programs that were executed by the user.  If the values are empty, you should not jump to the conclusion that your suspect must have used an evidence eliminator.  It might have been set by the user previously or by the network administrator group policy.

The following image shows the settings that control is you see anything under your UserAssist key in the registry.  Un-checking the first check box not just disable the application logging, but it also clears the UserAssist key of any existing entries. 






The following registry keys correspond to the check boxes above.

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackDocs
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackProgs









Disabling the program logging ( TrackProgs ) will also update the following key.
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids\exefile

Since the start Menu properties window also includes the Power Button Action settings, every time you apply your settings changes, you will see this value also accessed.
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_PowerButtonAction

Note: Just in case if you are interested, its values are:
2             - shut down
1             - log off
256         - switch user
512         - lock
4             - restart
2097168 - sleep

So, the main question I wanted to answer was: Is UserAssist key keeps track of applications that were ran on a machine by a user?




Legend:
Green - Always 0s or Fs
Pink - Run count
Blue - Focus count
Orange - Focus time
Light orange - always same
green - always Fs
Purple - last run time
Red - unused

As you can see above, I can see that I launched calc.exe from its default location twice ( pink area ), but after I've moved it to c:\temp and wanted to start calc.exe, it did not launch and still showed the application run count.  Therefore, my conclusion is that you can not reliably determine how many times a user used an application, but how many time he/she tried to use it.

What is Digital Forensics?

Digital Forensics is nothing more than using Problem-Solving Strategies and Mathematical Reasoning to explain a digital events from the past that were labeled as incidents by policy or law.

Problem-Solving Strategies like
         1. UNDERSTAND          - scope / tool capability / indicators of [compromise / event* ]  / law / policy
         2. PLAN                          - look for patterns
         3. SOLVE & CHECK      -  solve a simpler problem
         4. EXPLAIN                    - simplify / report / present
* Every incident is subset of events and since we are obligated to identify inculpatory and excuplatory evidence, we can not label an investigation an incident.  We can only look at the case as a sequence of events that are recorded on systems and might not be permitted by law or policy.  Especially in civil cases, a personal feel is not considered an indicator, but a log record is.

is nothing new to the scientific process where inductive reasoning is utilized to identify an educated prediction ( or hypothesis ), so in investigations, we can use a deductive process to solve cases based on the identified hypothesis.

- Inductive reasoning is also known as hypothesis construction because any conclusions made are based on educated predictions.
i.e.
There are 20 balls—either black or white—in an urn. To estimate their respective numbers, you draw a sample of four balls and find that three are black and one is white. A good inductive generalization would be that there are 15 black, and five white, balls in the urn.

- Deductive reasoning, also called deductive logic, is the process of reasoning from one or more general statements regarding what is known to reach a logically certain conclusion.

i.e.
    All men are mortal.
    Socrates is a man.
    Therefore, Socrates is mortal.

The following is an example of an argument that is valid, but not sound:

    Everyone who eats steak is a quarterback.
    John eats steak.
    Therefore, John is a quarterback.

Timed Commands

 Before Windows Vista and Windows 7called timeit.exe was a great tools to use in performance testing for tools.  I've used it to measure effective transfer rates of command line tools.  In Windows 7, the powershell command measure-command works great in some cases.  I've written this script to aid this time monitoring that should work in all Windows versions.

PoweShell Example output

PS C:\> measure-command { notepad }
Days              : 0
Hours             : 0
Minutes           : 0
Seconds           : 0
Milliseconds      : 3
Ticks             : 34410
TotalDays         : 3.98263888888889E-08
TotalHours        : 9.55833333333333E-07
TotalMinutes      : 5.735E-05
TotalSeconds      : 0.003441
TotalMilliseconds : 3.441

DOS Script that will measure how long notepad.exe will run.  Replace the command to fit your needs.

@echo off
set i=0
:start
:: Get the time
FOR /f "tokens=1-4 delims=:. " %%G in ('echo %time%') do call :s_setvar %%G-%%H-%%I-%%J
IF %i% == 0 goto process
IF %i% == 1 goto last
goto last

:s_setvar
SET _mstime=%10
goto :eof

:last
::Arithmetic Operations
SET /a e_h=%_mstime:~0,2% * 3600000
SET /a e_m=%_mstime:~3,2% * 60000
SET /a e_s=%_mstime:~6,2% * 1000
SET /a e_ms=%_mstime:~9,3%
SET /a e_result = %e_h%+%e_m%+%e_s%+%e_ms%-%s_result%

SET /a r_h=%e_result% / 3600000
SET /a r_m=(%e_result% %% 3600000) / 60000
SET /a r_s=((%e_result% %% 3600000 ) %% 60000 ) / 1000
SET /a r_ms=((%e_result% %% 3600000 ) %% 60000 ) %% 1000
ECHO This Process Took: %r_h% Hours %r_m% Minutes %r_s% Seconds %r_ms% milliseconds!!! %e_result%
goto EOF

:process
:: Process the commands and output the start time
set i=1
ECHO Start time is:   [%_mstime%]
SET /a s_h=%_mstime:~0,2% * 3600000
SET /a s_m=%_mstime:~3,2% * 60000
SET /a s_s=%_mstime:~6,2% * 1000
SET /a s_ms=%_mstime:~9,3%
SET /a s_result = %s_h%+%s_m%+%s_s%+%s_ms%
::Commands to run ******************************

notepad

::Command list end *****************************

goto start
:EOF

ISO 9660 - Structure Part 2

The file structure is based on the control of the Primary Volume Descriptor that points to the Root Directory Structure and to the Path Table.  The Path Table Records point back to the Root Directory Structure to locate the actual file content in the proper directory.  It is worth spending time with the date/time entry and digest its structure.  It is very interesting how you can pick up a pattern if you know what you are looking for.

i.e. In this example the file name is "acrobat_installer.exe".  The MAC time for the file as shown in Windows is:

                         Monday, July 01, 2002 - 4:33:00 a.m.

Data shown below: 66 07 01 05 21 00 F0

Year=1900+0x66(102)=2002

Month=07

Day=01

Hour=05

Minute=0x21(33)

Seconds=00

TimeZone Offset = 0xF0(-16)

GMT offset is from -48(West) to +52(East) that makes for 25 hours a day for some reason. 

So, GMT offset -16 is in 15 minute intervals, thus the offset it -16/4= -4 ( EST ).  In my experiments, it seems like some of the burning tools only record the GMT time with offset 00 without applying the actual offset.  I'm still researching why the recoded 5 hours at -4 offset is displayed in Daylight Central Time at -5 as 4 a.m. instead of 5.  If you know it, let me know.

The logical size of the file can be found as the first 4 bytes at offset 10 of the directory record. 009F3020 = 10,432,544 bytes

To find the file contents, we only need to look at the 4 bytes at offset 2 ( little endian ).  In this case, 20010000->0x00000120->288.  Thus, we can jump to logical sector 288 to see the content of this file.

Directory Records

length
     in bytes  contents
     --------  ---------------------------------------------------------
        1      R, the number of bytes in the record (which must be even)
        1      0 [number of sectors in extended attribute record]
        8      number of the first sector of file data or directory
                 (zero for an empty file), as a both endian double word
        8      number of bytes of file data or length of directory,
                 excluding the extended attribute record,
                 as a both endian double word
        1      number of years since 1900
        1      month, where 1=January, 2=February, etc.
        1      day of month, in the range from 1 to 31
        1      hour, in the range from 0 to 23
        1      minute, in the range from 0 to 59
        1      second, in the range from 0 to 59
                 (for DOS this is always an even number)
        1      offset from Greenwich Mean Time, in 15-minute intervals,
                 as a twos complement signed number, positive for time
                 zones east of Greenwich, and negative for time zones
                 west of Greenwich (DOS ignores this field)
        1      flags, with bits as follows:
                 bit     value
                 ------  ------------------------------------------
                 0 (LS)  0 for a norma1 file, 1 for a hidden file
                 1       0 for a file, 1 for a directory
                 2       0 [1 for an associated file]
                 3       0 [1 for record format specified]
                 4       0 [1 for permissions specified]
                 5       0
                 6       0
                 7 (MS)  0 [1 if not the final record for the file]
        1      0 [file unit size for an interleaved file]
        1      0 [interleave gap size for an interleaved file]
        4      1, as a both endian word [volume sequence number]
        1      N, the identifier length
        N      identifier
        P      padding byte: if N is even, P = 1 and this field contains
                 a zero; if N is odd, P = 0 and this field is omitted
    R-33-N-P   unspecified field for system use; must contain an even
                 number of bytes

Path Table Record

 
     length
     in bytes  contents
     --------  ---------------------------------------------------------
        1      N, the name length (or 1 for the root directory)
        1      0 [number of sectors in extended attribute record]
        4      number of the first sector in the directory, as a
                 double word
        2      number of record for parent directory (or 1 for the root
                 directory), as a word; the first record is number 1,
                 the second record is number 2, etc.
        N      name (or 0 for the root directory)
      0 or 1   padding byte: if N is odd, this field contains a zero; if
                 N is even, this field is omitted

Ref: http://alumnus.caltech.edu/~pje/iso9660.html
 

ISO9660 - Primary Volume Descriptor

CDs and DVDs might not be as popular these days as they used to be, but their structure is very interesting from a forensic point-of-view when someone is learning about data structures.  It is interesting how a value can be saved in little-endian and in big-endian formats to provide access regardless of the platform.  The date and time stamps are also not in "standard format" that we seen in most forensic investigations on storage devices.  The application identifier might also be of use in investigations.

 

BytePosition	Field Name	Content
1	Volume Descriptor Type	1
2 - 6	Standard Identifier	CD001
7	Volume Descriptor Version	1
8	Unused Field	(00)17  byte
9 - 40	System Identifier	a-characters allowed18
41 - 72	Volume Identifier	d-characters allowed19
73 - 80	Unused Field	(00) bytes
81 - 88	Volume Space Size	Number of logical blocks in the Volume
89 - 120	Unused Field	(00) bytes
121 - 124	Volume Set Size	The assigned Volume Set size of the Volume
125 - 128	Volume Sequence Number	The ordinal number of the volume in the Volume Set
129 - 132	Logical Block Size	The size in bytes of a Logical Block
133 - 140	Path Table Size	Length in bytes of the path table
141 - 144	Location of Type L Path Table	Logical Block Number of first Block allocated to the Type L
		Path Table, Type L meaning multiple byte numerical values are
		recorded with least significant byte first.  This value is also
		recorded with least significant byte first.
145 - 148	Location of Optional Type L Path Table	0 if Optional Path Table was not recorded, otherwise, Logical
		Block Number of first Block allocated to the Optional Type L
		Path Table.
149 - 152	Location of Type M Path Table	Logical Block Number of first Block allocated to the Type M
		Path Table, Type M meaning multiple byte numerical values are
		recorded with most significant byte first.  This value is also
		recorded with most significant byte first.
153 - 156	Location of Optional Type M Path Table	0 if Optional Path Table was not recorded, otherwise, Logical
		Block Number of first Block allocated to the Type M Path Table.
157 - 190	Directory record for Root Directory	This is the actual directory record for the top of the directory
		structure.  See the section on directory records for the format of this data.
191 - 318	Volume Set Identifier	Name of the multiple volume set of which this volume is a
		member.  d-characters allowed.
319 - 446	Publisher Identifier	Identifies who provided the actual data contained in the files.  a-characters allowed.
447 - 574	Data Preparer Identifier	Identifies who performed the actual creation of the current
		volume. a-characters allowed.
575 - 702	Application Identifier	Identifies the specification of how the data in the files are
		recorded.  For example, this field might contain SGML if the
		files were recorded according to the Standard Generalized Markup
		Language
703 - 739	Copyright File Identifier	Identifies the file in the root directory that contains the
		copyright notice for this volume.  If there is no copyright file,
		this field should contain all spaces (20) Level 1 interchange
		restrictions apply.20
740 - 776	Abstract File Identifier	Identifies the file in the root directory that contains the abstract
		statement for this volume.  If there is no copyright file, this
		field should contain all spaces (20) Level 1 interchange
		restrictions apply.
777 - 813	Bibliographic File Identifier	Identifies the file in the root directory that contains
		bibliographic records.  ISO-9660 does not specify the format of
		these records.  If there is no copyright file, this field should
		contain all spaces (20) Level 1 interchange restrictions apply.
814 - 830	Volume Creation Date and Time	Date and time at which the volume was created.
		Represented by seven bytes:
		1: Number of years since 1900
		2: Month of the year from 1 to 12
		3: Day of the Month from 1 to 31
		4: Hour of the day from 0 to 23
		5: Minute of the hour from 0 to 59
		6: second of the minute from 0 to 59
		7: Offset from Greenwich Mean Time in
		number of 15 minute intervals from -48(West) to +52(East)
831 - 847	Volume Modification Date and Time	Date and time at which the volume was last modified.
		Represented the same as the Volume Creation Date and Time
848 - 864	Volume Expiration Date and Time	Date and Time at which the information in the volume may be
		considered obsolete.  Represented the same as the Volume
		Creation Date and Time
865 - 881	Volume Effective Date and Time	Date and Time at which the information in the volume may be
		used.  Represented the same as the Volume Creation Date and Time
882	File Structure Version	1
883	Reserved for future standardization	(00)
884 - 1395	Application Use	This field is reserved for application use.  Its content is not
		specified by ISO-9660.
1396 - 2048	Reserved for future standardization	All bytes must be set to (00).

17 Numbers surrounded by parentheses () are hexadecimal numbers.
18  a-characters are A-Z, 0-9, _, space, !, ", %, &, ', (, ), *, +, ,, -, ., /, :, ;, <, =, >, ?
  see ISO-9660:1988, Annex A, Table 15
19 d-characters are A-Z, 0-9, _
  see ISO-9660:1988, Annex A, Table 14

20 For a description of the level 1 interchange restrictions, see page <?>

Ref: "Introduction to ISO 9660", Disc Manufacturing, Inc., by Clayton Summers

 

Oracle VM VirtualBox

Abstract

Virtual machines are gaining corporate and home user acceptance in every day computing environments.  Virtual machines are created easily or downloaded from the Internet as preconfigured Operating Systems ( called appliances ).  The preconfigured Operating Systems in most cases are Linux based Operating Systems since Linux can be distributed for free, but proprietary Operating Systems can’t without complying with licensing agreements.  In general, the host Operating System ( configured to run the virtual machine software ) needs only hard drive space to hold the guest Operating System (running inside the virtual machine ) virtual hard drive ( in most cases, a single file, but in some cases it can be divided into 2GB portions ).  Besides the hard drive space, virtual machines need their own memory space that can’t be shared with the host, so host machines need to have extended amount of physical memory in order to host other ( virtual ) machines.  Virtual machines share the host hardware resources in a fashion that virtual machines see their hardware as physical hardware.  Thus, virtual machines can operate just like any physical computer.  The way virtual machines are configured to interact with the physical machine’s hardware is stored in configuration files.  Users create virtual machines using a wizard like environment where users are asked to dedicate a portion of the physical device or simulate a physical device via a hardware proxy that communicates between the physical device and the virtual environment.  Depending on these settings, computers can change their identity in network communication where a single physical device can look like multiple devices communicating on the network.  In addition, virtual machines can support other than the host Operating System, like Microsoft host can run a Linux guest.  The guest Operating System support is vendor dependent, thus users need to select the virtual machine software that will support the guest Operating System they intend to run as guest.  Users can also create reference points ( snapshots ) where the state of the virtual machine is saved and the state of the virtual machine can be restored.  That is significant since all user data can be eliminated is a user decides to “roll-back” the Operating System state to a previous state that will contain no user activity.  This document will examine multiple virtual machines’ installed files, configuration files, and user interaction of creating new virtual machines. 

Summary

Major folder installed or files added

c:\Program Files\Oracle\VirtualBox

c:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox

c:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox

c:\Users\<UID>\.VirtualBox

c:\Windows\System32\DriverStore\FileRepository\

c:\Windows\System32\DRVSTORE

c:\Windows\Installer\

Link files

c:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox\License (English).lnk

c:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox\Oracle VM VirtualBox.lnk

c:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox\User manual (CHM, English).lnk

c:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox\User manual (PDF, English).lnk

c:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox\License (English).lnk

c:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox\Oracle VM VirtualBox.lnk

c:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox\User manual (CHM, English).lnk

c:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox\User manual (PDF, English).lnk

c:\Users\Public\Desktop\Oracle VM VirtualBox.lnk

c:\Users\{UID}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Oracle VM VirtualBox.lnk

Global Configuration and logs

c:\Users\{UID}\.VirtualBox\VBoxSVC.log

c:\Users\{UID}\.VirtualBox\VirtualBox.xml

c:\Users\{UID}\.VirtualBox\VirtualBox.xml-prev

Registry

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBox…

HKEY_CLASSES_ROOT\progId_VirtualBox.Shell. …

HKEY_CLASSES_ROOT\VirtualBox. …

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DIFx

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\SUN_VBOXNETFLTMP

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_VBOXDRV

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{cac88484-7515-4c03-82e6-71a87abac361}\##?#ROOT#SUN_VBOXNETFLTMP

HKEY_CURRENT_USER\Software\Oracle\VirtualBox\Install

HKEY_CLASSES_ROOT\.hdd "(Default)"

HKEY_CLASSES_ROOT\.hdd "Content Type"

HKEY_CLASSES_ROOT\.ova "Content Type"

HKEY_CLASSES_ROOT\.ovf "Content Type"

HKEY_CLASSES_ROOT\.vbox "(Default)"

HKEY_CLASSES_ROOT\.vbox "Content Type"

HKEY_CLASSES_ROOT\.vbox-extpack "(Default)"

HKEY_CLASSES_ROOT\.vbox-extpack "Content Type"

HKEY_CLASSES_ROOT\.vdi "(Default)"

HKEY_CLASSES_ROOT\.vdi "Content Type"

HKEY_CLASSES_ROOT\.vhd "(Default)"

HKEY_CLASSES_ROOT\.vhd "Content Type"

HKEY_CLASSES_ROOT\.vmdk "Content Type"

HKEY_CLASSES_ROOT\Installer\Products\

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VBoxUSBMon

UserAssist

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count "P:\Hfref\Choyvp\Qrfxgbc\Benpyr IZ IveghnyObk.yax"

                                                                             // ROT-13 decoded - C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk"

C:\windows\prefetch

VBOXTESTOGL.EXE-93C3FDFA.pf

VIRTUALBOX.EXE-473C564D.pf

VBOXSVC.EXE-C578C37C.pf

Virtual Machine Specific Files

c:\Users\{UID}\VirtualBox VMs\{VMname}\{VMname}.vbox*

c:\Users\{UID}\VirtualBox VMs\{VMname}\{VMname}.vbox-prev

c:\Users\{UID}\VirtualBox VMs\{VMname}\{VMname}.vdi

c:\Users\{UID}\VirtualBox VMs\{VMname}\Logs\VBox.log

c:\Users\{UID}\VirtualBox VMs\{VMname}\Snapshots\{HardDisk uuid}.vdi    //*uuid from XML

c:\Users\{UID}\VirtualBox VMs\{VMname}\Snapshots\{Date}T{Time}-#########Z.sav

Signatures

VM specific

.vdi - <<< Oracle VM VirtualBox Disk Image >>>

.sav - VirtualBox SavedState V2.0                                 // where  is 7f as the first character

.xml - <VirtualBox xmlns="http://www.innotek.de/VirtualBox-settings" version="1.12-windows"><Machine …

The image below shows that each virtual machine’s XML settings will store the MAC Address of the virtual machine and if the virtual machine is set to bridge the network connection, the bridged network interface card will also be listed.  Thus, the communication will be passed through the physical NIC, but the DHCP server or other network devices will see the virtual machine as another physical machine.  The virtual machine will receive a DHCP assigned IP address, so the DHCP server will have log entries for the virtual machine.

 

 App Specific

.log - VirtualBox (XP)COM Server 4.1.18 r78361 win.x86

.xml - <VirtualBox xmlns="http://www.innotek.de/VirtualBox-settings" version="1.12-windows"><Global> …

Global Settings Relevant (c:\Users\{UID}\.VirtualBox\VirtualBox.xml)

<ExtraDataItem name="GUI/RecentListCD" value="C:\helix.iso;"/>           //iso file assigned to CD/DVD

<ExtraDataItem name="GUI/ProxySettings" value="proxyEnabled,10.10.10.100,5000,authEnabled,testuser,testpassword"/>           //proxy settings

<MachineEntry uuid="{84396bae-3fdf-4830-b3ac-8c0a2861b6b6}" src="C:/Users/{UID}/VirtualBox VMs/VBox-test1-machine/VBox-test1-machine.vbox"/>                                       //list of virtual machines

<ExtraDataItem name="GUI/LastVMSelected" value="84396bae-3fdf-4830-b3ac-8c0a2861b6b6"/>

//from the list of virtual machine uuid, we can see what virtual machine was launched last

 <DHCPServer networkName="HostInterfaceNetworking-VirtualBox Host-Only Ethernet Adapter" IPAddress="200.168.56.100" networkMask="255.255.255.0" lowerIP="200.168.56.101" upperIP="200.168.56.254" enabled="1"/>                                                                                     //DHCP settings

<SystemProperties defaultMachineFolder=" C:\Users\{UID}\VirtualBox VMs" defaultHardDiskFormat="VDI" VRDEAuthLibrary="VBoxAuth" webServiceAuthLibrary="VBoxAuth" LogHistoryCount="3"/>       //system defaults
 

DHCP Lease Obtain Time Decode

Key Name:          HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{D0A6FF00-EC55-4A29-8114-0037BAB929C0}

Class Name:             <NO CLASS>

Last Write Time:       7/13/2012 - 2:34 PM

Value 11

  Name:                    LeaseObtainedTime

  Type:                     REG_DWORD

  Data:            0x500066f3