Exploring Additional Artifacts

In today’s interconnected world, where digital technologies permeate every aspect of our lives, email communication and cloud storage services have become indispensable tools for individuals and organizations alike. The reliance on these platforms for communication, data storage, and collaboration has elevated their importance in forensic investigation as rich sources of digital evidence.

Email forensics focuses on the examination and analysis of email communications to uncover valuable insights. It involves techniques for retrieving, preserving, and analyzing email metadata, message content, attachments, and associated artifacts. In legal proceedings, email forensics can help establish timelines, identify key individuals involved, authenticate messages, and provide crucial evidence for cases ranging from cybercrime to intellectual property disputes.

Event logs serve the important purpose of recording actions taken by the operating system...

Technical requirements

There are certain technical requirements for additional Windows artifacts analysis to ensure that the process is executed efficiently and effectively. The following are the technical requirements of this chapter:

• Kernel OST viewer: https://www.nucleustechnologies.com/ost-viewer.html
• Kernel PST viewer: https://www.nucleustechnologies.com/pst-viewer.html
• Eric Zimmerman’s tools: https://ericzimmerman.github.io/#!index.md

Email forensic analysis

In a modern digital environment, email threats present a substantial risk, and among them, phishing emails stand out as highly pervasive and successful tactics employed by malicious actors. It is of utmost importance for individuals and organizations to grasp the nature of email threats and gain knowledge about the diverse forms of phishing emails in order to strengthen their cybersecurity measures.

Email threats encompass a wide range of malicious activities conducted through email communication. These threats aim to exploit vulnerabilities, manipulate users, and compromise systems. Common email threats include the following:

• Phishing emails: Phishing emails are fraudulent messages that mimic legitimate entities, such as banks, social media platforms, or trusted organizations. They aim to deceive recipients into revealing sensitive information, such as login credentials, financial data, or personal details. Phishing emails often use social engineering...

Event log analysis

Windows event logs serve as a valuable source of digital evidence for forensic analysts investigating security incidents, system anomalies, or suspicious activities on Windows operating systems. These logs record a variety of events and activities that occur within the operating system, providing a detailed trail of information that can aid in understanding the timeline of events, identifying potential threats, and reconstructing the sequence of actions taken by users or attackers.

Windows event logs serve as a crucial resource for forensic analysts for the following reasons:

• Event collection: Windows event logs encompass a broad spectrum of events, including system events, security events, and application events. These logs capture essential information regarding user logins, system startup and shutdown, file access, network connections, software installations, and other significant activities. Through the collection and examination of these logs, forensic...

Analyzing $MFT

Within the realm of computer forensics, the Master File Table (MFT) assumes a pivotal role within the Windows operating system. Functioning as a repository, the MFT houses vital details pertaining to every file and directory stored on a computer’s hard drive.

The $MFT is one of the most important files within NTFS. This artifact keeps a record of all files in the volume, as well as the file location and metadata, and an entry for dates relating to creation, modification, and access. The information stored within this artifact is called MFT entries.

Each file has its own entry in $MFT, starting from 0 being the $MFT entry.

The structure of the MFT in NTFS is complex and consists of multiple records, each of which represents a file or directory on the NTFS volume. Each MFT record is 1,024 bytes, making the MFT very simple to parse. An MFT record has the following general structure:

• File record header: This section contains information about the...

Case study – analyzing malware infections

It’s a regular Monday morning. Sarah, a financial analyst at your company, is going through her emails. Among the emails in her inbox, she notices one that appears to be sharing memes of cats, which she loves. However, she notifies the security team about sudden popups and abnormal activities on her system after she clicked on the link.

Analysis

Since this was handed over to the DFIR team, what we do is initiate a triage image and memory dump, as we covered in Chapter 2 and 3 of this book. Using Belksoft Live RAM Capture, we will collect volatile data and KAPE to collect relevant artifacts to identify the root cause of this behavior on her system. For the sake of demonstration, we are assuming that we have direct access to Sarah’s system using the GUI and we will invoke all the utilities and tools we have learned. In reality, in the majority of cases, we depend on EDR or tools such as Velociraptor to collect artifacts...

Additional forensic artifacts exercises

In this part, we will apply what we have learned so far. Try to work on the following exercises:

1. Load your PST file into Kernel PST viewer.
2. Using Security.evtx, explore and track user activity using event IDs 4624 and 4625.
3. Track an application crash using application.evtx.
4. Parse system.evtx using Evtxcmd.exe and save the output into a CSV file.
5. Parse SRUMDB.dat for your local machine using SRUM_DUMP and map network activity using Windows Registry by identifying the profile ID.

Summary

In this chapter, we explored two crucial areas of digital forensics: email forensics and Windows event log forensics.

Email forensics involves the analysis of email communications to uncover valuable evidence in legal, corporate, and law enforcement investigations. We learned about the significance of email headers, which provide crucial information such as sender and recipient details, timestamps, and routing information. By analyzing email headers, forensic analysts can determine the legitimacy of messages and identify potential threats, such as phishing attacks.

Windows event log forensics focuses on extracting and analyzing events recorded in Windows event logs to reconstruct activities and detect security incidents. We examined different types of Windows event logs, such as security, application, and system logs, and their importance in tracking user activities, system events, application errors, and security-related incidents.

Both email forensics and Windows...