Meta tags:

Headings (most frequently used words):

august, 2011, updates, and, links, monday, list, analysis, saturday, wednesday, tuesday, friday, windowsir, blog, jump, windows, incident, response, 29, 27, 24, 23, 22, 20, 17, sunday, 14, 08, 05, 02, pages, subscribe, to, archive, sticky, notes, pt, ii, reconnoitre, more, carbon, black,

Text of the page (most frequently used words):
the (779), and (341), that (278), this (152), for (148), you (108), jump (90), have (86), what (77), with (76), file (73), are (68), from (64), can (63), there (62), was (62), lists (62), also (60), system (58), files (57), one (53), windows (53), #analysis (52), list (51), may (49), but (49), information (49), tool (49), not (48), about (47), some (42), out (41), like (40), well (39), tools (36), time (36), use (36), more (35), notes (35), they (35), all (34), share (34), when (34), user (33), sticky (32), very (32), stream (32), would (32), data (31), august (30), see (30), available (30), example (30), which (30), forensics (29), post (29), how (29), look (28), has (28), great (28), format (28), case (27), just (27), into (27), found (27), had (26), any (25), been (25), posted (24), really (24), used (24), streams (24), march (23), july (23), will (23), need (23), something (23), your (23), within (23), january (22), june (22), 2011 (22), blog (22), get (22), analyst (22), then (22), registry (22), december (21), february (21), october (21), other (21), september (20), who (20), new (20), only (20), were (20), someone (20), based (20), should (20), incident (20), april (19), november (19), know (19), such (19), recently (19), image (19), even (19), part (18), perl (18), those (18), things (18), application (18), destlist (18), systems (18), updates (17), open (17), malware (17), don (17), take (17), etc (17), presentation (17), another (17), each (17), now (17), could (17), regarding (17), process (17), find (16), however (16), forensic (16), numbered (16), these (16), most (15), looking (15), interesting (15), point (15), their (15), entry (15), links (14), many (14), over (14), being (14), folks (14), code (14), does (14), created (14), note (14), timelines (13), email (13), page (13), thanks (13), think (13), his (13), value (13), ovie (13), using (12), facebook (12), sure (12), because (12), done (12), here (12), work (12), start (12), two (12), during (12), number (12), same (12), comments (11), labels (11), pinterest (11), blogthis (11), carvey (11), site (11), timeline (11), where (11), date (11), autodest (11), lnk (11), order (11), version (11), read (11), result (11), question (11), formats (11), thing (11), deleted (11), expected (11), sectors (11), snt (11), ago (10), source (10), able (10), going (10), through (10), document (10), parse (10), them (10), times (10), directory (10), often (10), parsing (10), lot (10), testing (10), written (10), structure (10), doesn (10), podcast (10), similar (10), examination (10), way (10), desktop (10), issue (10), year (9), meetup (9), come (9), cases (9), provide (9), after (9), let (9), together (9), regripper (9), questions (9), omfw (9), want (9), write (9), valuable (9), mentioned (9), event (9), isn (9), response (9), ole (9), having (9), respect (9), again (9), simply (9), chris (9), appears (9), slide (9), specific (9), contain (9), make (8), anything (8), via (8), free (8), view (8), along (8), community (8), speaking (8), back (8), first (8), our (8), say (8), deal (8), sort (8), good (8), seen (8), responder (8), appear (8), mru (8), hive (8), mark (8), contents (8), modules (8), binary (8), either (8), cyberspeak (8), both (8), creation (8), artifacts (8), author (8), analysts (8), allows (8), yet (8), unallocated (8), space (8), resource (8), test (8), means (8), bit (8), validation (8), results (8), bytes (8), modification (8), command (7), line (7), posts (7), aug (7), much (7), doing (7), than (7), context (7), script (7), while (7), conference (7), opportunity (7), uses (7), capability (7), added (7), network (7), before (7), last (7), keys (7), itself (7), remote (7), jimmy (7), research (7), writing (7), long (7), viewer (7), useful (7), run (7), resources (7), needs (7), images (7), parses (7), appids (7), live (7), sensor (7), functionality (7), reconnoitre (6), names (6), nova (6), sergio (6), follow (6), else (6), installed (6), actually (6), extracting (6), memory (6), volatility (6), already (6), organization (6), original (6), made (6), updated (6), carving (6), investigation (6), activity (6), every (6), ask (6), easy (6), once (6), far (6), text (6), compound (6), troy (6), right (6), name (6), access (6), storage (6), away (6), feedback (6), set (6), end (6), usb (6), contains (6), guys (6), might (6), different (6), associated (6), include (6), server (6), got (6), infrastructure (6), familiar (6), becomes (6), ccns (6), vscs (6), stickynotes (6), root (6), report (6), carbon (5), black (5), show (5), group (5), dfir (5), conferences (5), check (5), remember (5), anyone (5), wrote (5), did (5), give (5), accessed (5), contained (5), across (5), presentations (5), experience (5), others (5), copies (5), additional (5), put (5), analyzing (5), best (5), framework (5), consider (5), pdf (5), effort (5), digital (5), individual (5), goes (5), better (5), responders (5), understanding (5), important (5), taken (5), mft (5), determine (5), cdfs (5), assistance (5), yourself (5), entries (5), applications (5), mentions (5), automaticdestinations (5), working (5), platform (5), upon (5), create (5), further (5), thought (5), too (5), particular (5), getting (5), develop (5), mind (5), approach (5), answer (5), customer (5), running (5), review (5), connection (5), following (5), including (5), forensicswiki (5), maintained (5), tln (5), csv (5), complete (5), incorporate (5), manner (5), output (5), acquisition (5), whole (5), exe (5), quickly (5), called (5), still (5), completely (5), leos (5), primary (5), several (5), function (5), validating (5), paul (5), byte (5), fri (5), training (4), books (4), home (4), pages (4), performing (4), problems (4), went (4), documents (4), techniques (4), job (4), known (4), project (4), download (4), efforts (4), giving (4), richard (4), next (4), devices (4), location (4), member (4), without (4), place (4), logs (4), indicating (4), detected (4), topic (4), demo (4), why (4), mac (4), never (4), albeit (4), rather (4), although (4), events (4), types (4), prefetch (4), level (4), various (4), rolled (4), office (4), team (4), person (4), takes (4), certain (4), remotely (4), keep (4), opened (4), hope (4), issues (4), parser (4), larson (4), mfu (4), activities (4), taskbar (4), since (4), currently (4), people (4), stuff (4), key (4), simple (4), considered (4), understand (4), plan (4), contract (4), begin (4), started (4), down (4), least (4), perspective (4), observed (4), talks (4), book (4), section (4), couple (4), reading (4), log (4), indicated (4), second (4), agree (4), haven (4), maintain (4), embedded (4), address (4), prodiscover (4), didn (4), three (4), valid (4), trusted (4), kyrus (4), limited (4), connections (4), against (4), processes (4), particularly (4), little (4), acquired (4), size (4), collecting (4), collected (4), mean (4), leo (4), years (4), intrusion (4), dates (4), validate (4), built (4), accessing (4), relevant (4), retrieved (4), rdp (4), 2008 (3), friday (3), months (3), month (3), atom (3), everyone (3), wasn (3), orleans (3), week (3), returned (3), wed (3), starting (3), history (3), whatever (3), add (3), provided (3), weren (3), always (3), supporting (3), security (3), exes (3), considerable (3), suspicious (3), operating (3), held (3), prior (3), perhaps (3), executable (3), providing (3), dedicated (3), dfrws (3), sam (3), discussion (3), slides (3), moved (3), attended (3), feature (3), received (3), off (3), future (3), goals (3), eric (3), apparently (3), licensing (3), idea (3), necessarily (3), insight (3), brings (3), speak (3), full (3), pretty (3), straightforward (3), talk (3), pfic (3), detection (3), infection (3), action (3), instead (3), missing (3), named (3), confidence (3), her (3), attempt (3), industry (3), perform (3), support (3), send (3), kind (3), everything (3), web (3), weg (3), shared (3), sorts (3), media (3), appid (3), woan (3), beginning (3), identify (3), current (3), performed (3), mention (3), api (3), exploit (3), own (3), mitec (3), jumplister (3), monday (3), technique (3), tend (3), copy (3), refer (3), statement (3), present (3), below (3), plans (3), forums (3), amount (3), saw (3), potential (3), gfirst (3), correctly (3), actual (3), path (3), included (3), dfwost (3), ecsap (3), aspects (3), artifact (3), significant (3), actions (3), extension (3), according (3), per (3), identifier (3), mckinnon (3), began (3), choose (3), aware (3), shortcut (3), extract (3), nothing (3), problem (3), clearly (3), parsed (3), itunes (3), removed (3), short (3), interface (3), developed (3), parent (3), drive (3), allow (3), until (3), addition (3), bunch (3), changes (3), came (3), sometimes (3), asked (3), task (3), aspect (3), knows (3), defense (3), trojan (3), tsk (3), password (3), followed (3), knew (3), tests (3), commercial (3), between (3), themselves (3), myself (3), values (3), assume (3), possible (3), derived (3), said (3), hits (3), earlier (3), possibly (3), exclusion (3), provides (3), above (3), client (3), stamps (3), header (3), record (3), table (3), metafile (3), reports (3), morto (3), mod (3), 2006 (2), static (2), philosophy (2), law (2), enforcement (2), weeks (2), windowsir (2), subscribe (2), reminder (2), big (2), 7pm (2), fees (2), specifically (2), python (2), solutions (2), lines (2), database (2), determined (2), definitely (2), topics (2), moment (2), sounds (2), forget (2), detecting (2), elements (2), gather (2), workshop (2), attend (2), under (2), standalone (2), ways (2), aren (2), small (2), checking (2), google (2), tuesday (2), comment (2), putting (2), pulling (2), background (2), material (2), reversespace (2), botnets (2), mitch (2), harris (2), offers (2), interested (2), attending (2), faq (2), please (2), serving (2), profession (2), board (2), around (2), probably (2), okay (2), become (2), yoke (2), vote (2), sit (2), wait (2), likely (2), hear (2), mhl (2), moyix (2), gleeda (2), covered (2), ever (2), symantec (2), traffic (2), captures (2), component (2), arsenal (2), lab (2), scanning (2), forward (2), chad (2), creating (2), standard_information (2), indications (2), attempted (2), clean (2), deleting (2), secondary (2), finding (2), reference (2), relative (2), braindump (2), bejtlich (2), titled (2), makes (2), sense (2), lived (2), near (2), vendor (2), needed (2), engagement (2), encryption (2), sample (2), imagine (2), article (2), points (2), true (2), local (2), less (2), due (2), findings (2), thus (2), notepad (2), filetime (2), object (2), correlated (2), recent (2), folder (2), ssview (2), usefulness (2), continue (2), specification (2), senior (2), microsoft (2), frequently (2), depending (2), reflected (2), click (2), favor (2), addressing (2), listen (2), learn (2), released (2), whitepaper (2), sans (2), given (2), penetration (2), gain (2), online (2), paper (2), worth (2), looks (2), cuckoo (2), examples (2), solving (2), hostile (2), structured (2), room (2), hadn (2), beyond (2), left (2), gave (2), cool (2), honest (2), talked (2), hard (2), description (2), initial (2), fraud (2), step (2), contact (2), goal (2), won (2), exam (2), presented (2), subject (2), investigative (2), analytic (2), wide (2), range (2), odd (2), surrounding (2), addresses (2), ken (2), insights (2), eight (2), chapter (2), excuse (2), thoughts (2), wrapper (2), usbstor (2), plugin (2), edition (2), wrf (2), defcon19 (2), trustwave (2), sunday (2), impact (2), involving (2), technologies (2), usage (2), interest (2), consist (2), primarily (2), opening (2), menu (2), save (2), container (2), refers (2), comprehensive (2), appropriate (2), module (2), correlate (2), xml (2), string (2), identifiers (2), guid (2), input (2), easily (2), depends (2), occurred (2), volume (2), shadow (2), proprietary (2), functions (2), versions (2), matter (2), choice (2), contacted (2), turned (2), presents (2), required (2), disk (2), device (2), understood (2), indicates (2), attributes (2), listened (2), unpack (2), seek (2), addendum (2), wednesday (2), install (2), host (2), launched (2), correlation (2), fine (2), necessary (2), installing (2), seeing (2), dashboard (2), expect (2), clear (2), browser (2), wanted (2), modified (2), normal (2), attack (2), employee (2), occurs (2), exited (2), deployed (2), listening (2), collection (2), taking (2), acquisitions (2), deploying (2), type (2), require (2), fewer (2), targeted (2), eye (2), bad (2), call (2), though (2), firewall (2), instance (2), encountered (2), assist (2), saturday (2), indicator (2), scan (2), duty (2), field (2), trust (2), knowledge (2), regular (2), heard (2), broken (2), separate (2), interview (2), discuss (2), affect (2), default (2), delete (2), linked (2), blkls (2), autopsy (2), looked (2), seem (2), interact (2), seems (2), latest (2), mounting (2), osfmount (2), mount (2), cracking (2), thread (2), exactly (2), accuracy (2), ccn (2), ended (2), seeded (2), side (2), standard (2), validated (2), correct (2), extracted (2), properly (2), error (2), ones (2), ripxp (2), posting (2), trying (2), critical (2), searched (2), capabilities (2), sanderson (2), prove (2), whenever (2), investigations (2), skeptical (2), changed (2), obviously (2), talking (2), decided (2), single (2), discusses (2), fact (2), profile (2), suggest (2), determining (2), active (2), demonstrated (2), persist (2), behavior (2), attempts (2), headers (2), grabbing (2), enough (2), content (2), 512 (2), dispersed (2), consume (2), locating (2), rtf (2), demonstrate (2), play (2), cross (2), copied (2), adding (2), opinions (2), supported (2), described (2), sniper (2), conclusion (2), court (2), huge (2), stickynotes2 (2), 11e0 (2), awesome, inc, theme, powered, blogger, 2004, 163, 2005, 118, 2007, 108, 166, 2009, 2010, 109, 2012, 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020, 2021, 2022, 2023, 2024, 2025, 2026, archive, evil, forensicitguy, inside, nsa, equation, ttps, china, lense, inversecos, xworm, cyberdefnerd, netbios, pivoting, threat, clustering, apt, ure, introducing, huntable, cti, studio, dfirtnt, wordpress, com, private, sector, forbidden, brett, shavers, study, comparing, foss, older, newer, las, vegas, hernando, chrome, processing, instructions, explain, shows, mechanism, layers, abstraction, ultimately, pushed, button, abstract, sqlite, landscape, titles, affords, flavor, mingle, sources, exploitation, attacks, cisco, solution, word, didier, stevens, corey, harrell, exciting, couldn, notice, win32, projects, absolutely, amazing, analyze, physical, anywhere, shining, contributing, wiki, downloads, blackhat, firefox, manager, past, pena, exploits, lulzsec, anonymous, forth, chairs, circle, carried, stepping, harman, hosting, meeting, mobile, stay, tuned, meet, stands, consortium, specialists, leadership, guide, focus, describe, wondering, afoot, involvement, taxation, representation, 9999, regards, decision, requirements, arbitrarily, curious, involved, directed, ahead, fortune, pulls, leaders, fast, paced, prezi, ignore, publication, graciously, she, love, rob, quarantined, vbn, bugbear, modicum, coding, skill, decoder, capturing, captured, must, wireshark, turns, low, hanging, fruit, intro, geared, toward, engage, practitioners, spectrum, dinner, night, btw, lecture, examiner, exams, steps, avoid, foil, random, attribute, stomped, few, instances, alerted, executed, temp, signature, mounts, scans, tertiary, allowed, related, grouped, evaluate, oddly, autostart, leads, mrt, tilbury, networkminer, sift, appliance, objectives, offering, certification, organizations, individuals, essentially, act, trade, huber, commentary, tweet, ran, joined, iss, ibm, feb, boss, miles, herndon, unused, classroom, facility, members, atlanta, kansas, city, norfolk, expanded, chicago, corpus, christi, tulsa, airports, fly, emergency, fedex, insert, favorite, shipment, rounded, offices, flying, constantly, touch, wider, needing, wake, inbox, grow, restrict, area, willing, relocate, today, age, communications, relatively, bring, cost, gas, air, fare, skype, cam, automatic, destination, player, nor, shortcuts, openoffice, 1b4dd67f29cb1962, viewing, ending, validity, light, deprecation, handle, documentation, independent, pinned, items, methods, tracking, deprecated, launch, recommend, interviews, 1985, invited, friend, lachniet, computer, lays, proposal, states, experiment, x0ner, malicious, freely, sandbox, runs, virtualbox, yara, ray, wacci, det, cindy, murphy, win4n6, front, impression, entering, interpreted, spreadsheet, disklabs, evidence, keyboard, signed, continuing, promises, kept, coming, breaks, offer, attendees, speakers, feel, yes, constitute, bonus, presenter, negative, positive, empty, welcome, outlines, exercise, clarify, firmly, planted, conduct, supposed, top, msword, usually, exhibits, keyword, searches, frame, banking, begun, stone, rigid, scripts, lock, survives, focused, achieve, ourselves, rabbit, hole, breath, nowhere, sight, consumed, fully, prepared, delivered, day, hands, course, compressed, class, justice, push, slot, thinking, involves, poster, identifies, anomaly, explained, caused, developing, identifying, researchers, sale, pos, trustedsignal, encapsulates, views, experienced, mechanical, speaker, chapters, covers, saying, trick, confuse, victim, describes, moonsol, dfs, andrew, golden, decks, investigated, exfil, pack, misspelling, spelled, checklist, import, excel, easier, modify, lastwrite, subkeys, plugged, illustrated, authors, publisher, printer, impressions, hklm, currentcontrolset, services, lanmanserver, shares, setup, materials, dumpit, spiderlabs, freakshow, significantly, performs, produced, double, clicks, whereas, editor, ultraedit, menus, dude, automatically, brown, custom, customdestinations, customdest, pins, stacked, segments, series, hex, characters, references, fixing, digging, consists, combining, figure, picture, 1bc392b8e104a00e, corresponding, basename, exists, combine, element, historic, heavy, ideally, linux, equally, opted, flexible, method, proscript, scanner, paraphrase, beyonce, gui, personal, focusing, restricts, possibility, style, sheet, pursue, fairly, public, correspondence, recovered, apps, reasons, carved, resolve, troubleshoot, squeamish, sharing, confidentiality, agreements, limiting, applies, facet, internally, reach, technology, tied, represent, persistent, remains, podcasts, persisted, summary, substr, system32, mstsc, ids, ssviewer, afforded, purposes, load, monitors, executables, monitored, sent, monitor, generating, license, quick, guest, vmplayer, shortly, target, populating, recon, phase, native, mapping, hand, gone, structuring, accessible, intuitive, narrow, timely, answers, methodology, ipconfig, icon, cmd, loaded, enhancements, monitoring, reminiscent, phishing, navigate, located, hack, child, special, execution, stages, spotty, environment, general, studies, stories, cio, thousands, dollars, licenses, deploy, sending, lightweight, ops, observation, cast, net, conditions, scoping, analyzed, quicker, pay, travel, lodging, reduce, overall, conjunction, game, dynamics, targets, advantages, enjoyed, intruders, large, infrastructures, believe, spend, rainy, stop, crying, straight, tell, sincerely, guy, radar, populate, parallel, hrs, days, hey, minute, logging, showed, unprepared, incidents, relationship, helped, phone, vpn, staff, airline, tickets, burger, king, brian, krebs, calling, deming, isc, sysadmin, responsibilities, appeared, solid, compromise, ioc, sweep, entire, enterprise, compromised, infected, batch, recoverable, early, listener, collateral, met, whom, assignment, remain, qualified, promoted, seasoned, investigator, later, move, rolodex, detailed, articles, areas, credible, disagree, characterization, categorization, spoke, informed, counsel, alludes, responsible, placed, examiners, claim, classes, recorded, represented, fat, ntfs, seconds, setting, file_name, grayson, 0beta, mmls, fls, power, manageable, similarly, osforensics, beta, 99f, capture, capable, variety, generally, ability, passwords, illustrate, whether, account, craig, wright, detail, pros, cons, agreement, showing, basis, reviewer, expectation, pci, credit, card, numbers, guids, passed, track, increased, missed, visa, overlapping, congruent, sets, seeking, rewrite, sacrificing, speed, compared, brew, purposely, accurately, basing, says, rip, structures, extraction, presume, assumption, design, deemed, failure, making, assessment, retrieve, condition, established, accounted, constructed, plugins, arbitrary, measure, ensure, return, chokes, spits, coughed, asking, round, replicate, sensitive, specify, employed, ftk, imager, mode, subdirectories, _restore, renaming, designed, situation, intimately, professional, troubleshooting, forum, workbench, cubicle, expert, reaching, ends, searching, suspect, somewhat, allocated, sections, hives, selected, grew, buzzword, meaningful, nessus, relation, isvalidcreditcard, passmark, daddy, tunneling, drew, fahey, convergence, solve, osdfc, unwanted, workstations, hosts, vista, wealth, forensically, pick, exception, basic, techpathways, info, onto, sp3, connected, external, logical, sat, watched, extremely, visit, products, utilities, receive, benefit, appreciated, monetarily, otherwise, jpg, shadows, objid, final, bottom, defrag, allocation, investigators, directly, vsc, alongside, glance, variants, overview, center, jesse, half, convinced, addressed, none, developer, stated, manual, cumbersome, repetitive, prone, errors, settled, display, nice, publicly, recognize, building, windowsteamblog, strongly, suggests, hashes, hash, vary, appusermodelids, explicitly, pinning, frequent, rundll32, mmc, excluded, automaticdestination, discussed, preventing, inclusion, reg_none, ignored, conclusions, attribution, drawn, attempting, exonerate, booted, sorting, invaluable

Text of the page (random words):
writing a parser for sticky notes one of the interesting aspects of the ole format is the amount of metadata particularly time stamps that are simply a feature of the format when a user creates sticky notes they appear on the desktop like well sticky notes users can change fonts and colors for their notes but for the most part the available functionality is pretty limited now all of the sticky notes end up in a single file found within the user s profile path is userprofile appdata roaming microsoft sticky notes named stickynotes snt so what is the potential forensic value of sticky notes well it kind of depends on your case what you re looking for what you re trying to show etc for example it s possible that a user may have sticky notes that contain information regarding people they know contacts appointments or meetings that they may have etc as far as visible content we may not really get an idea of what s there until we start to see them used by the user based on the format used there is additional information available remember that all sticky notes appear in one file so the file system macb times apply to the file as a whole however each individual sticky note is held in an ole storage stream which has creation and modification dates associated with it opening the sticky notes file in mitec s structured storage viewer you can see that the file has several streams version metafile as well as the storage streams i e folders with 17 character names that each contain streams named 0 1 and 3 in each case the 0 stream contains the complete rtf document for the sticky note which can be extracted and opened in wordpad and the 3 stream contains the text of the sticky note in unicode format now because the storage streams for each sticky note have creation and modification dates we can use this information in timeline analysis to demonstrate user activity during specific time frames extracting the b creation and m modification times we can add this information to a timeline in order to demonstrate shell based access to the system by a specific user again the usefulness of this information is predicated on the actual use of sticky notes but automating the collection of this information allows us to quickly add context to a timeline with minimal effort that s where programming perl comes into play i don t see sticky notes and jump lists being picked up as part of windows 7 analysis processes any time soon as analysts really don t seem to be seeing either of these as valuable forensic resources yet however having an automated cross platform parsing capability now allows me to do further research and analysis as well as incorporate it into a more comprehensive analysis framework for example i wondered what happens if the user has no sticky notes on their desktop well that doesn t mean that an analyst shouldn t look for the stickynotes snt file here s what i did i created a bunch of sticky notes with various messages on my desktop and copied the snt file off of my system then i deleted all of the sticky notes and again copied the snt file this second file only contained the metafile and version streams but the metafile stream still contained the names of all of the previously created sticky notes see the above graphic however as of yet this stream doesn t appear to contain any recognizable time stamps the good news is that the modification time of the root entry reflected when the last sticky note was deleted like i mentioned earlier in this post understanding the underlying format of a storage container allows an analyst to exploit available information wherever they may find it posted by h carvey at 7 12 am 7 comments email this blogthis share to x share to facebook share to pinterest labels sticky notes windows 7 wednesday august 24 2011 jump list analysis pt ii i recently posted regarding jump list analysis and also updated the forensicswiki page that jesse k created mark mckinnon has added a great list of appids to the forensicswiki as well so why am i talking about jump lists again over two and a half years ago i said the following in this blog from a forensic perspective this jump list thing is just going to be a gold mine for an analyst the more i look into jump lists the more convinced i am of that statement however there s still a great deal that needs to be addressed regarding jump lists for example none of the tools available at this point parse the destlist streams in the automaticdestinations files i wrote a perl script that does this also the available tools that do parse jump lists including prodiscover do so in a format decided upon by the developer not by analysts i ve heard from several folks who have stated that the process that they have to go through to find relevant information in the jump list files is very manual and very cumbersome and we all know how repetitive processes like this can be prone to errors even though i ve developed code that quickly parses either a single jump list file or a whole directory full of them i haven t yet settled on an output format beyond tln and csv and how to display or present relevant information derived from the jump list files that brings to this to mind there s the issue of what is relevant to the analyst what i want to see as part of my analysis isn t necessarily the same thing someone else would want to see appids another issue is the application identifiers for the jump list files thanks to mark mckinnon a nice list of appids is publicly available but i m sure that anyone looking at it will recognize that it s far from complete this is going to be a community effort to keep building the list this page at the windowsteamblog site discusses how appids are created and strongly suggests that they re very similar to the manner in which prefetch file hashes are created for example the hash that is part of a prefetch file name is created using the path and command line for the application it appears from this page that a similar approach is used for appids indicating that the appids can vary based on the file location and the command line used this page at ms talks about appusermodelids this page doesn t explicitly discuss jump lists but does reference exclusion lists for taskbar pinning and recent frequent lists the page also discusses registry keys to use for exclusion lists as well as provides a list of applications including rundll32 exe and mmc exe that are excluded from the mfu list what this indicates is that the automaticdestination jump lists are in fact mru mfu lists with respect to the exclusion lists discussed at the ms site the page mentions a registry entry as one means of preventing inclusion in the start menu mfu list but not what kind of entry i e key or value reading on there is mention that the type of the entry can be reg_none and that the data is ignored indicating that the entry is a value these pages do provide some insight as to how jump list analysis needs to incorporate more than just looking at the files themselves we have to include the registry as well for example let s say that there are indications of an application on a windows 7 system but no jump list files do we just assume that the application was never used by the user in question if there are no jump list files in their profile i would suggest that based on the pages linked to above conclusions regarding usage and attribution could not be drawn without including registry analysis now i m a bit skeptical about all of this as when parsing jump lists created by the remote desktop client the numbered streams include a command line entry within the lnk stream i e v 192 168 1 2 however all of the streams are contained in the same file rather than separate files what this means is that there s more we need to know about jump lists analysis so how would you use jump lists and the information they contain during an examination well whenever there is some question of the user s activities on the system would be my number one thought i would think that attempting to determine if a user had used an application or had not remember forensic analysis can be used to exonerate someone as well would be the primary use of jump list analysis there are secondary uses for example such as determining when the user was active on the system or when the system itself was active i e booted and running i would also include parsing jump lists and sorting the lnk streams based on the destlist stream time stamps in a timeline again this might be of particular value when there was some question regarding the user s activities also limited testing has demonstrated jump lists persist on a system even after the application with which they are associated have been deleted and removed from the system i found this to be the case with itunes 10 and others have observed similar behavior this behavior can prove to be invaluable during investigations providing a significant amount of valuable information that persists long after a user has made attempts to hide their activity something else to consider is this what if the user connects a usb drive to the system or inserts a dvd into the system and the attached media includes files with a unique viewer application that viewer would not have to be installed on the system but the user s use of the application to view the files images movies etc would likely create a jump list file that would persist long after the user removed the media this is definitely something that needs to be looked into and tested and it also demonstrates how valuable jump lists could possibly be during an examination carving one of the things that many of us do during an examination is file carving for the most part this is done through one of the commercial tools or using a tool foremost scalpel that looks for file headers and footers or just the headers and it grabs x bytes following the header i ve taken a more targeted approach to carving for example on windows xp and 2003 systems using blkls to extract the unallocated space from an image i then searched for the event record magic number and instead of grabbing x bytes from there i followed the event record format specification and retrieved over 330 deleted albeit valid event log event records from unallocated space i was able to do this because i know that there s more to the record format than finding a header and grabbing x bytes following that i ve started to take a similar look at carving jump lists from unallocated space and getting anything that can be parsed is going to be a challenge remember that the compound file format is referred to as a file system within a file and that s exactly what it is the header of the file specifies the location of the directory table within the file and for the most part each of the streams is comprised of 64 byte sectors however at a certain point the file contains enough numbered stream entries that the destlist stream gets over 4kb 4096 bytes in size and it s content is moved to 512 byte sectors also as numbered streams are added to the jump list the destlist stream becomes intermingled amongst the rest of the sectors in the file one of the things i had to do in writing my code was build lookup arrays lists and as the file becomes larger the destlist stream becomes more dispersed throughout the file now consider the numbered streams a numbered stream that is 203 bytes in length per the directory table will consume four 64 byte sectors with 53 bytes left over a numbered stream that is 456 bytes long will consume eight 64 byte sectors and in neither case is there any requirement for these sectors to be contiguous this means that they could be dispersed within the jump list file reassembling those streams is enough of an issue without having to deal with hoping that you retrieved the correct sectors from unallocated space within the image based on this something does come to mind that would make an interesting honors or university project carving within the jump list file itself locating deleted keys and values as well as pulling out unallocated space within registry hive files has proved to be a very useful analysis technique so maybe something of value could also be retrieved by locating and extracting unallocated space within jump list files this would simply be a matter of reading the directory table and determining all of the 64 and 512 byte sectors used and then extracting those that are currently not being used resources alex barnett s paper on jump list forensics mark woan s jumplister troy larson s forensic examination of windows 7 jump lists presentation mike ahrendt s blog post on jump lists 3 apr 2011 posted by h carvey at 6 48 am 2 comments email this blogthis share to x share to facebook share to pinterest labels jump lists windows 7 tuesday august 23 2011 reconnoitre i ve had the opportunity recently thanks to paul sanderson of sanderson forensics to take a look at his reconnoitre tool for accessing files within volume shadow copies vscs i m not sure how many folks have a need to do this but vscs have been part of windows systems since vista and can provide a wealth of forensically valuable data i ve posted in this blog regarding accessing vscs and i think that the more we address this topic and how accessing the vscs can prove to be very valuable the more analysts will pick it up as a technique that they incorporate into their analysis whenever possible i should also point out that the current versions of prodiscover with the exception of the basic edition also allow you to access vscs within an image even if your analysis system is windows xp check out the techpathways resource center for more info installing reconnoitre was straightforward i installed it onto a windows xp sp3 system and it was up and running right away i then connected an external usb drive on which i have a logical image of a windows 7 system and added the image file to the case i created and then sat back and watched the tool process the information that s right i was accessing vscs within a windows 7 image from a windows xp system paul shared the following with respect to reconnoitre 1 for those investigators who are used to working directly on an image it will be a more familiar experience obviously this could be seen as both good and bad 2 it allows you to view files in a vsc alongside the current live file and see at a glance how many variants there are a sort of overview 3 it allows you to easily view the mft entry and see where the changes are i think the last is possibly the most useful i have an example image where i have changed a jpg once and there are 3 entries in shadows one is obviously the original image a second is also the original image but only the mft entry has been changed the addition of an objid stream the final example i have not yet got to the bottom of but i think it may be possibly due to the file being moved defrag the allocation for the file is different as are some other bytes in the m...