Hello and welcome back to digital forensic concepts.
In this course we're talking about keywords and draft searches.
In this module, module three, we're going to discuss how we use our searches,
some examples of when we would want to use a graph search.
Our regular expression would be for
an IP address, a phone number to find you or else.
We're also going to take a look at the graph options and
the great recursive search research directories, recursive lee.
This is an example of a correct expression
to find an IP address and we take a look at it.
We can see we have our square brackets with our zero through 9 and
because it's correct.
We need the escape character before the curly bracket because that would be
considered an operator or a special character.
And then we have one or 3, one comma three.
And then again we have our ski are curly brackets.
And we have our escape and we have a dot and then we have zero through 9.
Again we have an escape and we have one or
3 have our dot 0 to 9 curly brackets
dot 1,3 square brackets.
Zero through nine, and then again matching one or three times.
So what this is saying is we're going to look for
the digits zero through nine, matching one or three times.
We're looking for dot and then we're looking for
the digits again zero through nine, matching one or three times and a dot.
Zero through nine, matching one or three times dot and then zero through 9.
Imagine one or 3 times the file were searching and
this would be called I can think I have config dot txt now for
the group phone number.
Again we're using reps, so we have to use the escape character
before the bracket to have it operated a special character.
And in our square brackets we have again zero through 9.
We have a three matching three times 0-9,
matching three times followed by a space a dash or dot.
And then we have our special character question mark escaped one or
more times 0- nine.
We have our three whatever brackets escaped to operate as special characters.
The curly brackets, space, dash or dot and then there are enclosed square brackets.
And then we have our escape question mark again 0 to 9.
Matching four times when our curly brackets escaped to operate as a function.
And the file we're looking at right here is phone numbers underscore dot txt and
we have our URL.
And this is Igra extended group so we have great minus E.
We have our www, we have or.
The logical or which is not escaped because in regret we don't escape
the special character unless you want the graph to interpret it as a literal pipe.
That we have our HTTP HTTPS with or in between the pipe.
Biological or then we have an escape in front of the thought
because we want to find a literal dot com in the file we're
looking at here is Ivan underscore n t dot txt.
So we can see we have to escape the special characters to have them work as
operators with breath.
But in egress the special characters workers, operators.
Unless there is preceded by the escape character.
Then we're going to work with our additional operators and
remember the -i for case, insensitive minus n to show the line numbers.
The -C which we're going to see lines before and after.
And in this case we have the number four so
I'm going to see four lines before and after our hit and then we have the URL.
Where your expression,
we just talked about in the same Ivan underscore dot txt file searching it now.
A recursive search would be grip minus R for recursive.
We're searching for the term logins in our logs and
now we have another recursive search with grip minus R.
For recursive search, and in this one we're searching for
IP addresses and a file called IP underscore txt I'm sorry.
This is a directory minus R indicate.
We're looking at a directory called iP underscore txt.
So we're going to be crucial research that entire directory
which can contain multiple files.
And we'll see that in our demonstration and their demonstration,
we're going to use the Windows 10 Lennox terminal app.
And we're going to look for IP addresses, phone numbers, you or
else we're going to do group searches and searches.
We're going to search your coercively the sample files we're going to use or
a file called if configured up text iP tests text, phone numbers underscore txt.
And the directories are going to look in our rehearsal search are going to be logs,
which is actually the folder containing the windows of that locks and
a folder named IP underscore txt.
So let's get started with our demonstration and this walkthrough.
We're going to test some of our grip expressions.
The first grip expression we're going to use is to find an IP
address in the file called if config dot txt.
And we can see this is the expression that we talked about in our PowerPoint
presentation.
And we see we're using grip and we can see searching for
the numbers zero through 9, occurring 1- three times.
And we're doing that again 0 to 9, 1, 2, 3 times.
0 to 91 or three times.
And then again 0 to 9 occurring between occurring from once or three times.
So this isn't arranges either one time or three times.
And let's see what we get for results,
as you can see, it's returning the results of IP addresses.
The next great expression we're going to use is going to be for
a US phone number and we're still using grip.
So you have to escape the special characters and we're looking for
a US phone number.
So we're looking for the digits zero through nine, occurring three times.
Zero through nine, occurring three times.
And in this expression, I want to point out this is followed by an escaped bracket
and then a singular bracket because an area code could be in a bracket.
And in this breast set of brackets right here,
we have a space which is just a space, a dash or dot.
And none of these characters need to be escaped because this is grip if it were
eager grip, we would have to escape these characters.
In order for them to find literal dashes, literal spaces or literal dots.
So let's test our expression, and as we can see,
this does return phone numbers in different formats.
We can see we have one here that does have the parentheses around the area code.
A space and then a dash separated phone number.
We have a phone number separated by all dashes, one separated by spaces,
one separated by dots and one with no separation at all.
It's just all crunched together and the escaped question mark.
Character means zero more times the next expression
we're going to test, it's going to be a URL.
Are searching for a URL and we're going to use extended grip this time.
And as we can see we have grip minus E for extended grip,
we do not have to escape our bracket.
We're using the logical or with no escape character, no escape character before it.
So looking for www Http or http or https.
And we do have to escape the dot because we're looking for a literal dot com.
And we're searching in the file Ivan underscore nt dot txt
which is a red ripper report of the Ivan anti user account.
And we can see we do get several hits for the https and
the dot coms throughout the file.
And we can see we have an email address down here with a dot com which
is Ivan zero democracy at gmail.com.
We can also see some Microsoft com and
we don't see too much more in the center user.
But now let's add in some operators with this regular expression to get a little
more context to what we're looking at.
Okay, let's go back to our expression when we ran the expression
this time we ran it with the -i, which is case insensitive the minus n.
Because I want to see the line numbers where it's finding these hits and
I want to see some context.
I want to see four lines before and after.
So I used the minus C space for two c, four lines before and
four lines after each hit.
And we use the same regular expression we did before.
So now let's take a look at it with a little more context.
And we can see here this is katana search terms using the katana search bar.
This is coming from a file path of Explorer, which would be File Explorer.
And we can see our search page, let's go Microsoft dot com,
our start page is the same here.
We can see Internet Explorer Main Windows search continue down.
We could see recent docs key, you can see,
we have typed URLs and we can see our email address hit in
the Un Red Milky is where that email address hit an unread mail.
And you can see a little bit more about the mail application,
It was Mozilla Thunderbird.
And we can see the user profile of Ivan here apt out of roaming.
So we get a little more context of what we're looking at in a little more
information when we use the operators to see the lines before and after.
And we also have the line numbers, they are in this red grip,
report the line numbers that the hits are founded.
Now let's try a recursive search in the Windows of vet logs and
we're going to use great for this one.
And we're searching great minus R for recursive search.
And we're searching for the word log in and researching in the Windows event logs,
a folder called logs.
And that folder is located within the file system at C.
Windows system, 32 win event logs and see what we find out here, okay.
It's returning to things for to us these are binary files so it's not breaking out
the hits, but we do see two Windows event log specified that have matches in them.
So we would have to go ahead and look at these files individually.
Now we're going to try looking in a folder called IP underscore txt.
And we're going to search for IP addresses.
There are two files in this folder, let's go ahead and run our search.
We're going to paste anyway, and when we run the search, we have our great minus R.
IP regular expression and then the folder was searching,
and it's a directory researching, recursive lee in IP underscore txt., and
you can see here on the left-hand side.
These two files in here if config an iptest.txt and it will tell
you which violet found the hidden and it shows us our IP address hits.