SANS Digital Forensics and Incident Response Blog: Category - Computer Forensics

Digital Forensics Case Leads: Good reads and coming events

It's been a very busy week this week, so this week's Case Leads post is all about brevity. There were a bunch of great articles put out this week and I'm sure I've missed a few. At the end of this week's post there's an email address for the Case Leads series. If you have written or read something you think should be included in the weekly round up, please let us know.

Last week I posted a few sites that regularly publish lists of domains that are known to be serving malware. I'm working on a project that's scraping some of these sites and building lists of IPs for use in a network security monitoring program. What I didn't know at the time was that has a text file that they regularly update with new domain names. This makes my task much easier.

For fun this week, I took the text file and extracted the hostnames from all the uncommented lines in


Timestamped Registry & NTFS Artifacts from Unallocated Space

Frequently, while following up a Windows investigation, I will add certain filenames or other string values to my case wordlist and subsequently find these strings embedded in binary data of one type or another in unallocated space. Close examination of the surrounding data structures has shown that these are often old MFT entries, INDX structures, or registry keys or values. The thing that makes these things very interesting from a forensic perspective is that all of them but registry values incorporate Windows timestamps. (All timestamps referenced in this article are 64bit Windows filetime values.) Even registry values often follow closely after their parent keys in the registry, which do have associated timestamps. Once I'd noticed these key facts, it occurred to me that it would be useful to use the timestamp values to work backward to other associated data, and hence the genesis of this


Digital Forensic Case Leads: Malware hunting

Incident responders and digital forensics investigators are on the front-lines in the battle against malware. We need good intelligence for tracking its origins and command and control structures. This intelligence can help us limit malware's access to our networks and help us find it. When we do find it, we need good tools for eradicating it. For this week's Case Leads, I've been looking into some resources and tools that can aid in these efforts.

  • First up, a new, to me, malware removal tool called Malwarebytes. As I said, it's new to me, and I've only done a little playing around in the lab, but I've been told by others that it works great. I'm blocking out some time to delve into the tool more extensively and will have more to say about it then.
  • Two sites that provide lists of sites known to be distributing malware,


Arbitrary Code Execution on Examiner Systems via File Format Vulnerabilities

I attended ThotCon 0x1 on Friday, April 23rd, and watched a talk where the presenters disclosed and demonstrated an exploit embedded in a disk image that triggered arbitrary code execution when the same malicious file was examined using either EnCase or FTK. I'd like to talk a bit about this and it's implications, as well as a few things that we, as a community, might want to do in response.

The specific vulnerability in question appeared to actually exist in the Outside-In component, and was not triggered until the malicious file was actually viewed inside EnCase or FTK. The presenters stated that the vulnerability had been initially reported to Guidance and Access Data more than 3 versions of EnCase ago. Thinking back now, I was assuming they meant they had notified before 6.14, but it's possible that they were counting point releases.

When triggered, the exploit seemed


Digital Forensics Case Leads: Google's "password system" code stolen?

Additional details of the attack against Google were reported in the New York Times this week. The claim is that some portion of Google's authentication system code, Gaia, may have been stolen as part of the "Aurora" breach. The bulk of this week's Case Leads was inspired by my own pursuits of late. I've been revisiting some forgotten skills in an attempt to brush up and have been researching information on some new (to me) technologies of interest.


  • My tool of choice this week is IDA Pro, the disassembler that should be in any malware analyst's kit. I was exposed to IDA Pro a few years ago in Lenny Zeltser's Reverse-Engineering Malware course. Unfortunately for me, I'm a bit rusty on its usage, but am getting back into it.