Diving into windows registry for forensic data

As a forensic examiner, looking at a cloned system for possible timestamps of a drive-by-download attack, windows registry has some small foot holes to gather evidence (real or not). Atleast, will surely give an idea about how, when the attack has happened. Trusting the system time was intact and all the sole purpose for this exercise was to learn, having a look at registry keys armed with some freeware tools provide some data. Correlation plays a key role in identifying how and when the devices were connected to the system.

Freeware tools used to achieve the above are:
USB Device Viewer - A tool which provides a complete history of all removable devices connected to a Windows based host.
http://www.nirsoft.net/utils/usbdeview.zip

Direct Registry Browser from
http://www.sysdevsoftware.com/soft/dreg.php which can be used to browse the registry in case of offline image based forensic analysis.

Registry Browser from SoftSpot Software.
http://www.softspotsoftware.com/pages/downloads/RegBrowser.zip which can be used to view the timestamps on the registry key. There is a Nirsoft tool to view the same, but I prefer using this software.

And lastly, the infamous ProcMon from Microsoft Sysinternals Lab.
The latest version can be downloaded from http://live.sysinternals.com/Procmon.exe
It can used to get knowledge about the registry keys being accessed during the use of the above tools.
Tip: Set a filter on the process names to reduce the output while using the above tools.

The rest is left as an exercise to the readers (??!!!) as how find out the usb devices connection time and et all!

Happy forensics!

Installing IE8 without the usual update process, scanning and et all!

I recently had a requirement where I had to test an application in Internet Explorer 8, but the rig had only Windows XP SP2 with IE6. When tried installing IE8 using the official installation, it was prompting to install a bunch of updates, malware scanning and was taking forever. Thought for a moment and tried the following steps which worked:

• Downloaded the IE8 installation from Microsoft.com
• Used the Universal Extracter and extracted the IE8 installer executable to a directory
• Copied the complete extracted directory to a thumbdrive and moved it to the testing rig
• Executed the iesetup.exe inside the update directory

Double clicked on the iesetup.exe and voila! Internet Explorer Installation screen greeted with the usual update option. Neglected the warning, options and clicked on install Internet Explorer 8.

After a few minutes, the system requested a reboot and IE8 was up and running.

 

While I was happy to have the system updated with IE8, it is definitely not recommended unless one knows what he/she are doing. Please read the above procedural steps with standard disclaimer and warning!
It might cause system instability / security issues will still be open and is not recommended at all. This post for documentation purposes only and to have an artifact that it can done!

If you require help in locating universal extractor, try  http://legroom.net/software/uniextract and it is free. Please scan the files if you download from any other sources.

IE8's official links are:
Windows XP (32 Bit): http://download.microsoft.com/download/C/C/0/CC0BD555-33DD-411E-936B-73AC6F95AE11/IE8-WindowsXP-x86-ENU.exe
Windows XP (64 Bit) : http://download.microsoft.com/download/7/5/4/754D6601-662D-4E39-9788-6F90D8E5C097/IE8-WindowsServer2003-x64-ENU.exe
Windows Vista (32 Bit): http://download.microsoft.com/download/F/8/8/F88F09A2-A315-44C0-848E-48476A9E1577/IE8-WindowsVista-x86-ENU.exe
Windows Vista (64 Bit) : http://download.microsoft.com/download/D/C/F/DCF5DACB-313F-40C6-889C-AD1F8546099D/IE8-WindowsVista-x64-ENU.exe
Windows Server 2003 (32 Bit) : http://download.microsoft.com/download/7/5/0/7507EBD5-0193-4B7F-9F14-9014C7EB5C67/IE8-WindowsServer2003-x86-ENU.exe
Windows Server 2003 (64 Bit) : http://download.microsoft.com/download/7/5/4/754D6601-662D-4E39-9788-6F90D8E5C097/IE8-WindowsServer2003-x64-ENU.exe
Windows Server 2008 (32 Bit) : http://download.microsoft.com/download/F/8/8/F88F09A2-A315-44C0-848E-48476A9E1577/IE8-WindowsVista-x86-ENU.exe
Windows Server 2008 (64 Bit) : http://download.microsoft.com/download/D/C/F/DCF5DACB-313F-40C6-889C-AD1F8546099D/IE8-WindowsVista-x64-ENU.exe

Happy days!