Check if file has been downloaded from Internet

To check this we are using Alternate Data Stream properties of a file.

If file has been downloaded from internet or untrusted zone, windows is adding zone.identifer:$DATA ADS to file.

You can check ADS in files by using dir command or sysinternal streams.exe tool.

dir /r c:\

streams.exe -s c:\users\etanirer

Output Example;


Streams v1.56 - Enumerate alternate NTFS data streams
Copyright (C) 1999-2007 Mark Russinovich
Sysinternals - www.sysinternals.com
c:\users\etanirer\desktop\C2ADPhotosSetupEN.exe:
   :Zone.Identifier:$DATA       26
c:\users\etanirer\desktop\DeployingWindows7EssentialGuidance.pdf:
   :Zone.Identifier:$DATA       26
c:\users\etanirer\desktop\Siteauth.reg:
   :Zone.Identifier:$DATA       26
c:\users\etanirer\desktop\IPhone45111\Yeni klas÷r\iPhone3,1_5.1.1_9B206_Restore.zip:
   :Zone.Identifier:$DATA       26





Read more...

Volatile source of Forensic Evidences on windows based Systems.

When collecting evidence you should proceed from the volatile to the
   less volatile.  Here is an example order of volatility for a typical
   system.

      -  registers, cache

      -  routing table, arp cache, process table, kernel statistics,
         memory

      -  temporary file systems

      -  disk

      -  remote logging and monitoring data that is relevant to the
         system in question

      -  physical configuration, network topology

      -  archival media


http://www.faqs.org/rfcs/rfc3227.html
Read more...

Resetting Password on Macintosh that is using OS X

If you will do a forensic investigate a Macintosh that is running OS X and you need to access a program on a booted forensic copy of the subject’s drive,and if you do not known the password. Follow the steps  below;

 If you have any version of the Macintosh OS X boot CD or DVD, place that in the examination system and hold

down the C key to boot from the CD/DVD drive.Then the system asks if you want to install/reinstall OS X, choose the Password Reset Utility from the drop-down menus at the top of the screen. You will be shown a list of users and you can pick one or all of them and change the password of the accounts to something you know.

 

Resource: The Official CHFI Study Guide (Exam 312-49) for Computer Hacking Forensic Investigators  Copyright © 2007 by Elsevier, Inc.

Read more...

Photo or Image Forensic "type of camera used to take the image"

You can free software named Xnview to view which device was used to take photo, which software(photoshop etc.) or which scanner used to convert it to digital format ?

XnView provides a listing of directories in the left pane, and shows what images are in a particular directory in the upper-right pane.When you select an image, it appears in the lower Preview pane. In addition to this, clicking on the Properties tab will display information on a particular image, including its file format, timestamps, size,compression used, and other attributes. By clicking on the EXIF tab, you can display extra information, which could include the type of camera used to take the image, the exposure, the date the picture was taken, and other facts.
Read more...