I’ve just pushed up some changes to the amazing KnowledgeC plist extraction and parsing utility that I’ve been working on with Alexis Brignoni and wanted to describe them here.
Author: Phill Moore
I am a digital forensics analyst.
I have a couple of blogs - This Week In 4n6 and Think DFIR
I go by randomaccess (or variations of) on a number of DFIR social channels.
Sunday Funday – File Access on MacOS Mojave
Had a bit of time so decided to enter this weeks Sunday Funday. I didn’t win, but figured I would share it for reference. Congrats to Amy for winning!
I didn’t do a very comprehensive test, I just accessed a picture and video with native apps and then did a keyword search, so hits were uncovered that may not all indicate file access, and nothing was done to determine ‘when’ files were accessed.
KAPE Tricks
For those that didn’t see, last week Eric Zimmerman, the creator of a number of fine forensics tools, released a new tool called KAPE, which is the Kroll Artifact Parser and Extractor. This tool provides examiners the ability to quickly collect files and folders into a storage location (folder/vhd/vhdx), and then parse them with various utilities.
Microsoft Office Reading Locations (Part 1)
Over the weekend I was looking at the “Reading Locations” subkey in the NTUSER.dat and found something interesting. I haven’t got a complete understanding yet, so I’ve labelled this as Part 1, but I have to figure some more stuff out for there to be a part 2.
What Did I Listen To On Spotify For iOS?
I had a recent examination where I was asked what music was someone listening to at a point in time on an iOS device. Here’s what I found! (TLDR at the bottom)
Quick Post: Notes on the Win10 Recycle Bin
Just a quick post on the Windows Recycle Bin whilst it’s fresh in my mind (also because I posted some findings on Twitter, and will definitely lose them if I want to refer back another time). I figure since I did the testing I should get it down somewhere. Already spent the time to do it so may as well get it down on paper so I don’t have to redo it again another time 🙂
Sunday Funday – Cutting across NTFS Volumes
Another Sunday Funday!
This time, we’re cutting and pasting across volumes. I decided to take a slightly different route than last week and just created two VHDs to cut and paste between. (I have no idea why I didn’t think of that last week, do all of the copying and pasting in one go and then be done with it. If there’s a hard way to do something, I will find it 🙂 ).
Sunday Funday – Copying across NTFS volumes
Since I’m home and the baby is asleep I thought I’d spend some time on this weeks Sunday Funday challenge. I probably should sleep too, but that’s a problem for future me 🙂
Clippy History
No, this isn’t a post about Clippy, sorry everyone, especially Lee 🙂 Clippy’s gone forever.Read More »
WinTeNTLM Issues
It’s not uncommon to be asked whether a user had a login password or to need it to login to a virtualised copy of a suspects computer. In the case of the later, you can usually just clear the password and proceed, but sometimes knowing the password may be important.
I played with a few tools that I had on hand to get a local user’s NTLM hash during Dave and Matt’s DFIR CTF at DEF CON and documented my findings (and finally got around to finishing this up)
ThinkDFIR 