Sniper Forensics 2.0 Tools, Links, and Commands

OK...so I figured that there would be a lot of questions about the tools I use and the command syntax that I covered in SF2. There is obviously a LOT I was not able to cover due to time constraints, so if anyone has any specific questions about which tools do what, how to use them, and how to interpret the output, please let me know and I will create a FAQ blog post.

Thank you for attending my talk! I hope you get out of it as much I put into it!

Happy Hunting!

Tools
====
F-Response (http://www.f-response.com/)
Memoryze (http://www.mandiant.com/products/free_software/memoryze/)
Audit Viewer ( http://www.mandiant.com/products/free_software/mandiant_audit_viewer/)
UnxUtils (http://sourceforge.net/projects/unxutils/)
Grep (http://gnuwin32.sourceforge.net/packages/grep.htm)
TextPad (http://www.textpad.com/download/)
Case Notes (http://www.qccis.com/forensic-tools)
The Sleuth Kit (http://www.sleuthkit.org/sleuthkit/download.php)
Log2Timeline (http://log2timeline.net/)
SIFT Workstation (https://computer-forensics2.sans.org/community/siftkit/)
AnalyzeMFT (http://www.integriography.com/)
RegRipper (http://regripper.net/?page_id=150)
RipXP (http://regripper.net/?page_id=150)
FTK Imater 3.0 (http://www.accessdata.com/downloads.html)



Syntax
=====
Use these commands to rip registry hives.
C:\tools\RegRipper\rip.exe –r c:\cases\customerX\registry\SAM –f SAM > c:\cases\ripped\systemY_sam_ripped.txt

C:\tools\RegRipper\rip.exe –r c:\cases\customerX\registry\system –f System> c:\cases\ripped\systemY_system_ripped.txt

C:\tools\RegRipper\rip.exe –r c:\cases\customerX\registry\ntuser.dat –f ntuser> c:\cases\ripped\systemY_ntuser.dat.userX_ripped.txt

Use these commands to create a bodyfile and timeline. If you want a more detailed explanation of how to generate timelines, read my blog posts about timeline creation.

C:\tools\TSK\fls –m ‘C:/’ –f ntfs –r \\.\F: > c:\cases\customerX\timelines\systemY_bodyfile

Perl C:\tools\TSK\mactime.pl –d –b C:\cases\customerX\timelines\systemY_bodyfile\systemY_timeline.csv

You can add logs to your bodyfile with Log2Timeline
C:\>Perl C:\Perl\bin\Log2timeline –t >> c:\cases\customerX\timelines\systemY_bodyfile
You can hives and NTUSER.dat files to your bodyfile with regtime
C:\>Perl C:\tools\bin\regtime.pl –m HKLM/system –r c:\cases\customerX\hives\system >> \c:\cases\customerX\timelines\systemY_bodyfile

Search for suspect keywords
C:\cases\customerX\ripped>strings *.txt | grep –i
C:\cases\customerX\timeline>strings *.csv | grep –i

Search for suspect timeframe
C:\cases\customerX\ripped>strings *.txt | grep –i
C:\cases\customerX\timeline>strings *.csv | grep –i

Know how to stack your searches! CRITICAL!!!

Grep –i | grep –i
Grep –i | grep –i | grep –i
Grep –o
Gawk “{print $#}”
Cut –d -f#

Search for suspected date, all files “born” on that date.

C:\cases\customerX\timeline>strings_hostname_timeline.csv | grep -i "may 26 2010" | grep "..b,r"