Blog: SANS Digital Forensics and Incident Response Blog

Blog: SANS Digital Forensics and Incident Response Blog

Digital Forensic SIFTing: SUPER Timeline Creation using log2timeline-sift

This is a series of blog articles that utilize the SIFT Workstation. The free SIFT workstation, can match any modern forensic tool suite, is also directly featured and taught in SANS' Advanced Computer Forensic Analysis and Incident Response course (FOR 508). SIFT demonstrates that advanced investigations and responding to intrusions can be accomplished using cutting-edge open-source tools that are freely available and frequently updated.

The SIFT Workstation is a VMware appliance, pre-configured with the necessary tools to perform detailed digital forensic examination in a variety of settings. It is compatible with Expert Witness Format (E01), Advanced Forensic Format (AFF), and raw (dd) evidence formats.

Super-Timeline Background


I first started teaching timeline analysis back in 2000 when I first started teaching for SANS. It was in my first SANS@Night presentation I gave in Dec 2000 at what was then called "Capitol SANS" and I demonstrated a tool I wrote called mac_daddy.pl based off of the TCT tool mactime. Since that point every certified GCFA has answered test questions on timeline analysis.

We have reached a new resurgence in timeline analysis thanks to Kristinn Gudjonsson and his tool log2timeline. Kristinn's work in the timeline analysis field will probably change the way many of you approach cases.

First of all, all of these tools will be found in the SIFT Workstation are ready to go out of the box, but you can keep them up to date at Kristinn's website www.log2timeline.net. Kristinn's tool was also recently added to the FOR508: Advanced Computer Forensic Analysis and Incident Response course last year and has already been taught to hundreds analysts who are now using it in the field daily.

Kristinn's log2timeline tool will parse all of the following data structures and more through AUTOMATICALLY recursing through the directories for you instead of having to manually accomplish this.

This is a list of the currently available formats log2timeline is able to parse. The tool is being constantly updated so to get the current list of available input modules it is possible to let the tool print out a list:

# log2timeline -f list

Artifacts Automatically Parsed in a SUPER Timeline:

How to automatically create a SUPER Timeline


log2timeline-sift recursively scans through an evidence image (physical or partition) and extracts artifact timestamp data gathered from the evidence that the tool log2timeline supports (see artifacts above). This tutorial will step a user who is interested in creating their first timeline from start to finish.

Step 0 — Use the SIFT Workstation Distro


Download Latest SIFT Workstation Virtual Machine Distro: http://computer-forensics.sans.org/community/downloads


It is recommended that you use VMware Player for PCs and VMware Fusion for MACs. Alternatively, you can install the SIFT workstation in any virtual machine or direct hardware using the downloadable ISO image as well.


Launch the SIFT workstation and login to the console by using the password "forensics".

Step 1 — Identify your evidence and gain access to it in the SIFT Workstation


The files used in this example.

Link your evidence files to the SIFT Workstation through the Windows File Share that is enabled by default in the /cases directory. Either you can plug in a USB drive, mount a remote drive share, or copy the evidence to your /cases/ directory.


It should be noted that the design of the SIFT workstation has a separate drive for the /cases directory to allow for a larger virtual drive or you can connect it to an actual hard drive as well that you mount at the /cases directory.


Open in Explorer \\siftworkstation\cases\EXAMPLE-DIR-YYYYMMDD-###



If your evidence is a E01 then use this previous article on the topic to mount it correctly inside the SIFT workstation. If your evidence is RAW go ahead and skip to STEP 2. Access to the raw image is required as log2timeline-sift cannot parse E01 files... yet.


http://computer-forensics.sans.org/blog/2011/11/28/digital-forensic-sifting-mounting-ewf-or-e01-evidence-image-files

  • $ sudo su —
  • # cd /cases/EXAMPLE-DIR-YYYMMDD-####/
  • # mount_ewf.py nps-2008-jean.E01 /mnt/ewf
  • # cd /mnt/ewf

Note the commands that are inputted by the forensicator are highlighted in the blue outlined box.


Step 2 — Create The Super Timeline


Manual creation of a timeline is challenging and still requires some work to get through. We have included in the SIFT Workstation an automated method of generating a timeline via the new log2timeline-sift tool that can simply be pointed at a disk image (raw disk). Again, If you are examining an E01 or AFF file, please mount it first using mount_ewf.py or affuse respectively.


Creating a Super Timeline requires you to know whether or not your evidence image is a Physical or a Partition Image. A Physical image will include the entire disk image and can be parsed by the tool mmls to list the partitions. A Partition image will be the actual filesystem (e.g. NTFS) and can be parsed by the tool fsstat to list information about the partition.


Using log2timeline-sift is actually quite simple to use with very few options.



Once you have figured out if you have a physical disk image or a partition image, then choose the correct implementation of the command to run with the correct timezone.


Critical Failure Point Note: There is much confusion over what exactly the (-z) timezone option is used for. This is the timezone of the SYSTEM. The timezone is used to baseline convert time based data that is stored in "local" time to UTC time. Without telling log2timeline-sift the correct timezone of the system your timeline data will likely be off. Your output of the data will be in the same timezone as you inputted for log2timeline-sift. I do know Kristinn, log2timeline's developer, is working on a possible -Z (big Z) option that can specific the output timezone desired, but it is not currently implemented.


If your timezone includes areas that have daylight savings time, it is important to use the correct location. For example, on the East Coast, the correct implementation of daylight savings for the timezone value would be EST5EDT. For Mountain time it would be MST7MDT and so forth. If you do not use this data, any local time data that is set using daylight savings time will also be off.


In summary: It is crucial that the -z option matches the way the system is configured to produce accurate results.


TIMEZONE LISTINGS: http://www.cs.berkeley.edu/CT/ag4.0/appendid.htm



When you first run the log2timeline-sift command against your image. If it is not mounted, it will first ask you if you want to mount it and follow up with asking which specific partition needs to be mounted to have log2timeline-sift parse.



log2timeline-sift will now automatically parse through all of the structures to pull out a full timeline of the image. Note that processing errors are normal and expected as the tool will attempt to look for structures that may or may not exist.


Once log2timeline-sift has completed, you will find the final timeline as a text (.txt) file in the /cases/timeline-output-folder. To do a quick sort and to prepare the timeline for examination in EXCEL 2007 or higher use l2t_process.


Step 3 - Open the Timeline in EXCEL


Open your timeline up in Excel 2007 or higher and begin to examine around the time of your event. You will now see all of the data sorted and in order. I generally use excel so I can hide columns and rows easily and mark data that is particularly interesting.



Now open the file using EXCEL 2007 or higher to examine/parse.


CONGRATS!


You just created your first SUPER Timeline... now you get to analyze thousands of entries! (Wha???)


In another upcming article, I will discuss how to parse and reduce the timeline efficiently so you can analyze the data easier. SUPER-TIMELINES obtain much data from your operating system, but learning how to parse it into something useable is extremely valuable. In my SANS360 talk, I will take this technique even further. Of course, we go through all these techniques in our full training courses at SANS specifically FOR508: Advanced Computer Forensic Analysis and Incident Response.


There is another article planned on creating MICRO-TIMELINES using log2timeline when you do not want to parse the entire filesystem image.

Keep Fighting Crime!


Rob Lee has over 15 years of experience in digital forensics, vulnerability discovery, intrusion detection and incident response. Rob is the lead course author and faculty fellow for the computer forensic courses at the SANS Institute and lead author for FOR408 Windows Forensics and FOR508 Advanced Computer Forensics Analysis and Incident Response.

 

 

11 Comments

Posted March 25, 2010 at 10:26 AM | Permalink | Reply

Case Leads: On the horizon — SIFT 2, Volume Shadows

[...] going to kick things off with a post by our very own Rob Lee on using Kristinn Gudjonsson’s log2timeline to create “super-timelines.” If you [...]

Posted July 20, 2010 at 12:56 PM | Permalink | Reply

Stop, Children, What’s That Sound?

[...] go over how to create a Super Timeline since Rob has already covered that as a high level in on the SANS Digital Forensics Blog. What Ive been working on recently is how to best make use of the resulting timeline. I have [...]

Posted July 29, 2010 at 11:30 PM | Permalink | Reply

PaulK

I ran into a couple syntax issues:

1. I needed to change the syntax for part 2 moving the -r -o and -m flags to the end:

sudo fls /home/sansforensics/Desktop/VMware-Shared-Drive/Armato/Amato_SU2010-01063.img >> /home/sansforensics/Desktop/cases/SU2010-01063/bodyfile -r -o 63 -m C:

when I tried the original I kept getting this error:

sansforensics@SIFT-Workstation:/mnt/windows_mount$ sudo fls -o 63 r m C: /home/sansforensics/Desktop/VMware-Shared-Drive/Armato/Amato_SU2010-01063.img >> /home/sansforensics/Desktop/cases/SU2010-01063/bodyfile
Error stat(ing) image file (split_open - r - No such file or directory)

2. I haven't been able to get part 3 to work yet, I am having a syntax problem with regtime.pl.

There is a single space between -r and /mnt/.....

sansforensics@SIFT-Workstation:/usr/local/src/windows-perl$ ./regtime.pl m HKLM-SECURITY r /mnt/windows_mount/WINDOWS/system32/config/SECURITY >> /home/sansforensics/cases/SU2010-01063/bodyfile
Unknown option: mnt/windows_mount/windows/system32/config/security
sansforensics@SIFT-Workstation:/usr/local/src/windows-perl$

Any ideas what I did wrong? It seems to be only taking the / for the -r flag.

Thanks!

-PaulK

Posted August 15, 2011 at 12:45 PM | Permalink | Reply

springej

PaulK - did you ever get a resolution to the errors you were gettting?

Posted February 23, 2012 at 2:23 PM | Permalink | Reply

Kevin Brisson

I have been using the SIFT supertimeline analysis for a few months now and have had great results with XP. My biggest issue with Windows 7 is I have yet to have a successful timeline created that includes the Event Logs.

Is this a known issue with the tool?

Thank you,

Kevin

Posted February 23, 2012 at 3:52 PM | Permalink | Reply

robtlee

Yes, as far as I know it is being worked on.

Posted March 14, 2012 at 4:48 PM | Permalink | Reply

Jerome

Is there a way to perform forensics on a machine when a hacker disables syslog on a linux machine? Then enables syslog when they leave? Would I be able to see what they did while syslog was disabled?

Posted July 13, 2012 at 3:41 PM | Permalink | Reply

James

If you have a disk image with multiple partitions, do you need to run log2timeline-sift on both partitions and then combine the results?

Posted August 02, 2012 at 1:02 AM | Permalink | Reply

Josh

I am having trouble mounting multiple expert witness format files. What's the command for that?
My E01 files are on windows 7 operating system.
Basically, how i take it is, I need to mount the file share first where my E01 files are present. Once that mount is completed, then will be running the mount_ewf.py.
Someone please tell me a little step by step for that (I am not good enough with Linux) =)
Any help will be highly appreciated.
Thanks in advance!
Josh

Posted August 21, 2012 at 9:02 AM | Permalink | Reply

Andrew Kempster

@Josh - When you say multiple EWF files, do you mean multiple files relating to more than one exhibit, or just one exhibit with files E01, E02, E03, etc?

If you're using the SIFT workstation within VMware, make sure you've added the share for your evidence location through VMWare (it's in the settings of the virtual machine - add a Shared Folder and point it to the drive or folder that contains your evidence files). On the desktop of the SIFT workstation is a folder called VMware-Shared-Drive, and any shared folders are in there.

To mount the EWF files, at the terminal type:

'sudo su'

to become root user. Then, type:

'mount_ewf.py Desktop/VMware-Shared-Drive/[SHARE NAME]/[EWF FILENAME.E*] /mnt/ewf/'

Note that if your exhibit is broken up over several E0 files, put 'E*' as the extension, as this will then pick up the rest of the files.

Now browse to the folder containing the mounted E01 files by typing:

'cd /mnt/ewf/'

Typing 'ls' will display two files: one is a text file that contains case evidence entered when the exhibit was first acquired, the second file is the evidence mounted into a single raw flat file.

I haven't tried this one more than one exhibit at a time though.

Hope this helps.

Posted October 13, 2013 at 10:45 PM | Permalink | Reply

John

Is it possible to add a squid acces.log to the log2timeline-sift log file ?

or can this be done with log2timeline ?

Post a Comment






* Indicates a required field.