Hello and welcome back to course two section four of
Windows registry forensics.
In this section, we're going to locate the registry files and values within an image
files, and we're going to learn how to properly interpret these values.
So we're going to locate the values within the registry key file and
we're going to properly interpret the values.
The tools we're going to need for this section are going to be autopsy,
decode, notepad and the Windows calculator or any other calculator.
So why don't we go ahead and launch autopsy, make sure you right click and
run as admin.
So go ahead and launch autopsy now.
Just a quick recap of what we've covered up to this point.
In section one, we took a look at the live registry.
In section two we prepared our environment to examine the non-live registry files,
utilizing the specialized tools to be downloaded.
And in section three we exported the registry files using two different tools
and in two different ways, one with the full path and one without.
I hopefully everybody has autopsy running.
We're going to Create a new case using autopsy.
Double click new case.
We could name the case Windows registry or whatever you'd like to name it.
Whatever you do name it,
make sure it's something you're going to be able to identify later.
You can browse to where you want to have the base directory and
where the case state is going to be stored.
Case number, you can call it whatever you'd like to call it.
I'm going to call mine section four And you can click finish.
Now it is creating the case in autopsy.
What type of file are we going to add to our case?
In this case we're going to add the disk image of the virtual machine file.
And again, we're going to be working with that Windows 10 Virtual Machine File.
Click next Will browse to where a file is.
We'll select our file And we'll click open.
Now the time zone, you don't really know the time zone yet
because we haven't done that but we are going to do that.
So you can just leave the time zone whatever it is.
I am going to go ahead and put mine at UTC,
you can put yours at whatever you would like.
These are all the ingest modules we have for autopsy.
If you run all of these modules it is going to take a long time for
this case to process but we can still view it while it's processing.
So I would say go ahead and run the ingest modules keyword searches is what
we're going to run right now because we're not keyword searching.
And unless you have set it up for online access, you're not going to be able to
use the virus total and we don't need the Android Analyzer.
And I'm going to click next and it's going to start working.
Right now it's adding all the files so this will just take a minute.
Once it finished adding the files, it's going to tell you that the data source has
been added to the local database and it's now being analyzed,
you can just click finish.
And what we really want to close all this up if yours is open.
What we're looking at is the data source,
the windows, the MDK file right here.
Now, just a quick note about your tools,
you noticed when we looked at FTK imager it
showed us that volume two was partitioned to.
And we only had Two volumes on there.
Here what we're seeing is this is adding volumes for unallocated space.
This is more of the layout as would be seen on disk as far as
the unallocated space goes.
But the volume we actually want to take is going to be volume three.
We're going to expand volume three.
We're going to navigate to the registry files like we've done before,
we're going to open up windows We're going to navigate the system 32.
We're going to open up system 32,
and we're going to highlight the config folder.
I'm just going to move this out of the way.
If you want to know how to be able to do that, what you can do is
In view Sometimes if
you're panes docked or undocked it'll let you dock or undock the panes.
So I'm just going to move that out of the way
And we're going to find The first file
we're going to look at Is going to be the system file.
So we're going to go ahead and click on the system file.
And in your viewer pane You're going to see the system
file as it would be displayed in the registry viewer.
And we saw a little bit of this when we saw our other two tools earlier today.
Now There's only one of control set here, but
if you take a look at the select key, you can see the current control set is one and
the default control set is one, and then our last known code as one.
Normally like we saw on when we examine the live registry,
there'd be more than one control set and
you would determine the current control set by using the select key.
But since we have one we just have one to use.
So we're going to go ahead and expand control Set one control.
We're going to scroll down
To Microsoft.
Excuse me, it's not in Microsoft.
Going to scroll all the way down the time zone, it's right here.
So we're going to find the time zone information and
we can see how the tool displays it to us.
We have our daylight bios which tells us what are opposite is to daylight.
We have the bios We have our daylight start and our standard start.
We have our time zone name, which is Eastern standard time.
And we have the active time bias.
We can notice that there is 60 seconds difference,
60 minutes difference between the active time bias and the bias.
And that is because Daylight savings time is enabled on this computer.
And you can tell that by looking at this,
because otherwise you wouldn't have two different figures here.
What we are very interested in is our active time bias.
So we're going to go ahead and we'll just use our Windows calculator really quick.
And we'll say 240 minutes ÷ 60 minutes gives us, so
we have a 4 hour,- 4 right now in Eastern standard time.
And how we know when Eastern standard time, how we read the start and
stop key, is 2 bytes, these 2 bytes of 00s are padding.
You have the next two bites of OB 00.
Now they're going to be read little indian which means in the reverse order.
So you'd read it 000b.
And B.
0B and x is 11.
So we've had the 11th month and now we have a 0, 1, 0, 0 again.
Red little Indian.
So we have 0, 0, 0, 1 which would indicate the first sunday.
In november at 2 a.m.
Because this is 0, 0 again this would be
red 2 bites 0, 0, 0, 2 at 2 am.
So 0B.
Would be 11 which would be November, 0, 1 is a 1,
which means the first Sunday in November at 2 in the morning is the standard start.
Daylight start.
Same way 0, 3, 0, 0.
You'd read that 0, 0, 0, 3 which would be
the third month which would be March 0, 0,
0, 2, 0, 0 would be read 0, 0, 0,
2, the second sunday in March and again at 0,
0, 0, 2, which would be 2 a.m.
So that is how we read daylight start and daylight stop.
And this is how we see our active time bias and
what our normal time bias would be, what are daylight bias would be?
Time zones are very important because if you don't get the time zone right,
a lot of the times in your artifacts can be off and that can cause you a lot,
a lot of problems as we're going to see in one second when we take a look at
the install date and time and knowing how your tool is going to display this
information to you is very important too, we know that this computer.
That we see has an active time by us at 240 so we're at -4 from UTC.
We know the starting to stop.
So most of your tools will allow you to go ahead and
set the time zone within the tool, we picked UTC so
we can make the adjustment manually if you'd like, a lot of times,
if you have different pieces of evidence in different time zones,
sometimes UTC is the best way to go throughout the case.
It just makes it a lot easier when you're creating a timeline.
So let's get this out of the way.
It's movable.
We'll move it over and now we're going to take a look at the software hive.
We can move our window back into view, you can make it as big as you want,
which is really nice feature.
I like that.
Here we're going to expand Microsoft.
We're going to now look at the install, date and time and
what type of operating system is installed.
Because that will also make a big difference when we're examining
the registry.
So I'm going to expand Microsoft.
Windows and T not Windows, Windows and T.
And highlight current version.
And we can see here what are operating system is,
it's Windows 10 pro, we can see the release idea 1703.
There can be subtle differences between releases.
We see that the registered owner is Windows user and
there's no registered organization value.
These are user created values.
If they're not entered by the user they will just say value not set.
But what we want to take a look at is the install date.
The install date.
It's showing it to us in x and it's showing us a numeric value.
What I want you to do is just highlight that.
Hit control C on your computer.
Bring up note pad.
Because I'm not going to type that all out who controlled the and
it will copy the whole thing.
What we want to take is just the numbers between the parentheses.
So we just want to copy this number.
We're going to copy it.
You can go ahead and minimize that if you want.
Now we're going to use our tool decode and
we're going to pace that value into decode when I leave it set at UTC for now.
Now what type of value is this?
This is a unique numeric value.
There are different values in the registry like we talked about in section 1, but
this value is new.
Unix numeric value and we're going to decode it and
we get a date of Saturday March 18th 2017 at 04 01 20 UTC.
And it's going to get don't close dcode.
Just move it out of the way for a second.
I'm going to go to the results tab here.
And we look at the date and time here.
We can see that it matches.
The format is a little different.
It's giving you 2017 and then the month.
So it's a year, month day.
Set a day, month, year.
You can change the state format and autopsy.
I do believe you can change the date format and decode.
I think you're stuck with that.
So we can tell that this results pane is showing
us information in universal time ETC.
Now when you're dealing with a real examination you must figure out,
The active time bias which we did, which would be minus 4.
So we could go ahead and pick minus 4, hit Decode again.
And It also tracked the four hours for us.
And the other thing you must get be able to determine is whether or
not it was in day later standard time at the time
it was seized because that's going to make a difference.
The state those March 18th 2017 fall within daylights time or
standard start time because that's going to mean make
a difference whether it's minus 4 or minus 5.
Because if it were daylight time it would be minus 5,
standard time would be minus 4.
So these are the things that you need to be able to determine in order to get
the correct dates and times when you're examining the Windows registry or
any other Windows artifact or any other artifacts for that matter.
You have to be able to get the correct dates and times.
And that's one way we could take a look at that.
And the other thing you want to make sure you know is how your tool
is interpreting these values.
We know now that this is giving it to us in UTC time and I can tell you
from trying it out on this particular application of autopsy that no matter what
time zone you set it to it's going to give you the registry values in UTC.
So that's something important you want to know.
Another thing I want to show you really quickly.
If we take a look at the hex view of this file and
we are going to go into the structure of registry files later on.
But you can see, let it starts with this reg.
Yeah, REG and that's a good indication
that you're looking at a registry file.
If we look at the file metadata tab, I do like this feature an autopsy.
It will give you master file table information on the file itself.
It's a little bit beyond the scope of this course, but it does contain that.
So that is a nice feature.
But one of the first things you need to do when you're examining is you have to find
out your time zone.
So we know what we're looking at for times in the files,
especially if we're going to generate reports, you generate reports and
you're not in the right time zone, you'll be doing it twice.
And we also need to know what operating system is installed because there will be
differences between the Windows 7 registry in the Windows 8 registry in
the Windows 10 registry.
This course, I'm going to mainly focus on Windows 10.
I will demonstrate some stuff with Windows 7 and
we will talk about Windows 8 a little bit, but
the main focus is going to be on Windows 10 as the newest
Operating System from Microsoft right now.
In the next section, we're going to start examining the NTuser..hive and
going into a lot of the artifacts we can find within that hive and
we're going to interpret them and I'll show you how to accurately interpret them.
Show you where the data is stored and how it gets populated into the registry.