# Anti-Forensics

## TimeStamp manipulation

only some application will legitimately alter timestamps; e.g. cloud application don't want to update a file creation when you download a shared doc, so will manipulate it with it's old time.&#x20;

Malicious actions can be identified by the following steps:&#x20;

1. compare [#usdfile\_name](../microsoft-forensics/ntfs#usdfile_name "mention") and [#usdstandard\_information](../microsoft-forensics/ntfs#usdstandard_information "mention")timestamps. (can be done on the following tools: [#mftecmd](../microsoft-forensics/ntfs#mftecmd "mention") [#fls](../../forensics-tooling/fls-and-mactime#fls "mention"),[#istat](../microsoft-forensics/ntfs#istat "mention") and `FTK Imager`)
2. Check for all zeros in the decimal place. Windows stores time in nano seconds, so looking for zeros e.g. `14:00:00+00:00`  &#x20;
3. Compare [shimcache-appcompatcache](microsoft-forensics/shimcache-appcompatcache "mention") timestamp with [#usdstandard\_information](../microsoft-forensics/ntfs#usdstandard_information "mention")file modification times. Should see matching timestamps!
4. Check the embedded compile time against the timestamp; the file shouldn't be compiled after written to disk. both [#sigcheck.exe](../../forensics-tooling/scanning/signature-scanning#sigcheck.exe "mention") and `Exiftool` can check this
5. look in the $I30 (parent directory) index as they contain full set of $SI timestamps and MFT entry number with sequence number to conclusively track the file.&#x20;
6. The [#usdextend-usnjrnl](../microsoft-forensics/ntfs#usdextend-usnjrnl "mention") provides visibility into changes to files on file system, including creation time
7. [ntfs](microsoft-forensics/ntfs "mention") creates new files at the same time, likely that those files will have near sequential [#usdmft](../microsoft-forensics/ntfs#usdmft "mention") record numbers



## File Deletion&#x20;

### Carving Vs Metadata

#### Carving

tools are typically configured to scan for known file signatures at the start of clusters and 'carve' files data when the signature is located. The file signature is the magic number of the file, e.g. for windows executables it's MZ in ASCII or `0x 45 5a 90 00`. Solid State Drives (SSDs) are normally unreliable for carving and will result in partial recovery; mechanical drives are normally fairly fruitful.&#x20;

look for prefetch files (`.pf`), lnk file (`.lnk`) and [reverseengineering](../../reverseengineering "mention") metadata files (`$I`)

## Privacy cleaners

Privacy cleaners normally target key areas in the [registry](microsoft-forensics/registry "mention") including:&#x20;

* `WordWheelQuery` (keyword searches)&#x20;
* `UserAssist` (Gui Applications launched)&#x20;
* `ComDlg32` (use of the open/save dialog box)
* `RecentDocs` (recently opened files)

Whilst the keys are deleted, they are not immediately removed in the [registry](microsoft-forensics/registry "mention"); if a key is recoverable then you are more than likely able to recover the value. Copies of both [registry](microsoft-forensics/registry "mention") data and [#usdlogfile](../microsoft-forensics/ntfs#usdlogfile "mention") after deleted are normally available for a week or so; and are also stored in the [#volume-shadow-copy](#volume-shadow-copy "mention")

## File Wipers

As when the file is deleted, it would be seen as sparse space within the NTFS attributes; file wipers will fill the blank space with identifiable numbers

#### SDelete

Wipes files, directories and free space. Replaces `file.txt` with `AAAA.AAA` this will also be put into the [#usdextend-usdusnjrnl](../microsoft-forensics/ntfs#usdextend-usdusnjrnl "mention") as "DataOverwrite" not as a "FileDelete".&#x20;

#### BCWipe&#x20;

Effectively clears [#usdi30](../microsoft-forensics/ntfs#usdi30 "mention") and [#usdmft](../microsoft-forensics/ntfs#usdmft "mention"), removes file slack, slack spaces on the NTFS drive, _**Claims to**_ wipe temp data stored in [#usdlogfile](../microsoft-forensics/ntfs#usdlogfile "mention")

Testing proves [#usdlogfile](../microsoft-forensics/ntfs#usdlogfile "mention")removal is fairly low and also the [#usdextend-usdusnjrnl](../microsoft-forensics/ntfs#usdextend-usdusnjrnl "mention") isn't touched!&#x20;

Detection steps include:&#x20;

1. renames the file within the  [#usdextend-usdusnjrnl](../microsoft-forensics/ntfs#usdextend-usdusnjrnl "mention") from 'test123' to 'hgfadsf' (or equivalent random chars
2. Final action on target file was '`FileDelete`', followed by a few '`DataOverwrite`' and then a '`StreamChange`' signifying the [#alternative-data-streams-a-ds](../microsoft-forensics/ntfs#alternative-data-streams-a-ds "mention") was altered
3. Then created a hidden file '`~BCWipe.tmp`' (good IOC) with the same [#usdmft](../microsoft-forensics/ntfs#usdmft "mention")entry number as the deleted file&#x20;
4. Then created lots of files named '`SECRET.txt!!!!!!!!!!!!!!!`'  (this is to fill up the [#usdi30](../microsoft-forensics/ntfs#usdi30 "mention") directory listings)
5. A new Directory names '`BCW-DIR-NODES`' is created&#x20;
6. All the '`SECRET.txt!!!!!!!!!!!!!!!`' files are moved to the '`BCW-DIR-NODES`' folder, after moving and being renamed to '`dir1`', '`dir2`' etc, they are deleted, along with the tmp folder (created in step 3) and the directory (created in step 5)

In total, it creates around 1700 entries in the [#usdextend-usdusnjrnl](../microsoft-forensics/ntfs#usdextend-usdusnjrnl "mention")

#### Eraser

open-source tool been around since 2003 - Not able to clear deleted entries in the [#usdi30](../microsoft-forensics/ntfs#usdi30 "mention") slack directory indexes. also does not full erase the [#usdmft](../microsoft-forensics/ntfs#usdmft "mention")record for the target file but the file was renamed! Eraser cannot delete the [#zone.identifier-a-ds](../microsoft-forensics/ntfs#zone.identifier-a-ds "mention") which still had the URL of the download

Eraser does rename files 7 times before deletion and changes the timestamps (date modify to Jan 1 1601 this is windows zeroing out)  in both [#usdfile\_name](../microsoft-forensics/ntfs#usdfile_name "mention") and [#usdstandard\_information](../microsoft-forensics/ntfs#usdstandard_information "mention")however, by changing the time, caused the [#usdmft](../microsoft-forensics/ntfs#usdmft "mention") entry change (C) time to get updated for [#usdstandard\_information](../microsoft-forensics/ntfs#usdstandard_information "mention"), so the (C) time was consistently valid.&#x20;

#### Cipher.exe&#x20;

built in windows tool, convienient and under the radar!&#x20;

you find a new dir names "`EFSTMPWP`" created in the root of a volume (on the first time the tool is run) temp files are created and filles with data to overwrite free space normally named '`fil<xxxx>.tmp`' where xxxx are random alphanumeric values.&#x20;

## Volume Shadow Copy&#x20;

VSS/VSC can be used to recover the files that were deleted on the machine (assuming they weren't deleted). VSS has a copy-on-write (COW) system that only stored data differences

The files that aren't backed up are stored in:

```powershell
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BackuoRestore\FilesNotToSnapshot
```

Win8 introduces '`ScopeSnapshots`' that is enabled will 'monitor files in the boot volume that are relevant for system restore **only'**&#x20;

[Arsenal image mounter](https://arsenalrecon.com/products/arsenal-image-mounter) - is a great tool to read VSC's

`Libvshadow`, `vshadowinfo` and `vshadowmount` for Linux. ource can be a raw image but can't be E01

```bash
vshadowinfo [-o offset] <source> 
ewfmount <image>
vshadowmount [-o offset] <source> <mount>
cd <mount>
for i in vss*; do mount -o ro,show_sys_files,streams_interface=windows $i /mnt/shadow_mount/$i; done
```

#### [Vss\_carver.py](https://github.com/mnrkbys/vss_carver)

```bash
vss_carver.py -t <disk_image_type> -o <volume_offset_in_bytes> -i <disk_image> -c <catalog_file> -s <store_file>
vshadowmount -o <volume_offset_in_bytes> -c <catalog_file> -s <store_file> <disk_image> <mount_point>
```

Example carve:&#x20;

use the SIFT508 version as it's a patched `vshadowmount`

```bash
# use vss_carver against the image
vss_carver -t RAW -i /mnt/ewf_mount1/ewf1 -o 0 -c ~/vsscarve-vasefile/catalog -s ~/vsscarve-basefile/store
# Review recovered VSC
vss_catalog_manipulator list ~/vsscarve-basefile/catalog
# Present recovered VSCs as raw disk images
vshadowmount -o 0 -c ~/vsscarve-vasefile/catalog -s ~/vsscarve-basefile/store /mnt/ewf_file/ewf1 /mnt/vsscarve_basefile/
# mount all logical filesystems of snapshot
cd /mnt/vsscarve-basefile/
for i in vss*; do mount -o ro,show_sys_files,streams_interface=windows $i /mnt/shadowcarve_basefile/$i; done
```
