Chapter 3. Shortcuts

Transcription

1 Chapter 3 Shortcuts

2 Link Files Practical Exercise - Manually Decoding Link Files 1. Use WinHEX to open up the file named \Student Files\03_Link Files\c-3.txt.lnk. 2. First, let s look at the file header part of the file, file offsets Next, let s look at the Global Unique Identifier (GUID) part of the file, file offset 4 through Note that this value is likely the same value for all Windows systems. Shown below is how this number is registered in the Windows Registry.

3 4. Let s look at the File Flags (bit reference) for the target file at the time the shortcut was created. Highlight the DWORD at file offset 20 (bytes 20-23). This is not forensic value data but we will look at it because it is there. Note that a DWORD includes 4 bytes, or 32 bits, and WinHex s Data Interpreter only shows one byte of binary value (the byte the cursor is on) but that is okay because this particular bit reference only uses 7 of the 32 bits, so, reading right to left we are looking at the 7 underlined bit values Now let s look at the reference guide to decode the Bitmap meanings for this bit reference. What this decodes to is:

4 5. Next let s look at the File Attributes [for the target file at the time the shortcut was created] bit reference. Highlight the DWORD at file offset 24 (bytes 24-27). This is not forensic value data but we will look at it because it is there. This bit reference used 13 of the 32 bits. As mentioned above WinHex s Data Interpreter only shows binary for the byte the cursor is on but again, in this case, that is okay because the only thing not being displayed for the other three bytes are zeros. So our bit reference values are the underlined values; Now let s use the reference for the meanings of the bits. Only one bit is active, bit # 5.

5 6. Next, let s discuss and examine the embedded file dates and times. Note that these are the dates that were assigned to target file at the time the link file was created. QWORD at File Offset 28 (offsets 28 35) is the Creation Date & Time QWORD at File Offset 36 (offsets 36 43) is the Modification Date & Time QWORD at File Offset 44 (offsets 44-51) is the Last Access Date & Time 6.1. First let s decode the embedded CREATED DATE AND TIME; file offsets /27/ :17:16 UTC 6.2. Next let s decode the embedded MODIFIED DATE AND TIME; file offsets /27/ :21:53 UTC

6 6.3. Next let s decode the embedded LAST ACCESS DATE AND TIME; file offsets /27/ :17:16 UTC 7. Now, let s determine the TARGET FILE SIZE for c-3.txt ; file offset Note that this was the size of the file at the time the shortcut was created and the current file size may not match if the file was modified after the shortcut was created Next, let s determine the start of the null-terminated LOCAL FILE PATH for the file this shortcut points to c-3.txt.lnk. This is a multi-step process. Refer to the following graphic First, skip 16 bytes (not of forensic value) from the end of the file size (QWORD) Note the value of the next WORD, in this example file offsets (88 00) 8.3. What is the WORD value (88 00) in decimal? 136

7 8.4. Now, skip 136 bytes following the relative WORD point (88 00). Bookmark the 136 bytes that were jumped for ease of future navigation. Use a different bright color Next, identify 8 DWORDS following the 136-byte block To make it easier to navigate the data for the next steps let s bookmark the abovementioned WORD [88 00] in a bright color and then bookmark the 136 bytes following the WORD [88 00] in a different bright color. Bookmark is done by: highlighting the data right click Add Bookmark Use bright color You should end up with something that looks like the below.

8 8.7. Now let s determine the null-terminated full path and file name for the target file. Decode the value for the 8 th DWORD, which is 24 decimal. Now jump 24 bytes from the beginning of the 8 th DWORD and note the following null-terminated string. C:\Documents and Settings\Randy\My Documents\TempR\c-3.txt 8.8. This step shows an example only of a relative file path. This data is not on your computer. Note the 00h in the middle of the path name. A possible explanation of using 00h is allowing the operating system to separate the network shared folder and the subfolder path and filename.

9 9. Now let s determine the TARGET VOLUME SERIAL NUMBER, the serial number of the drive on which drive the file c-3.txt was stored. Decode the value of the 2 nd DWORD following the 136 byte block, which is 28 decimal. 10. Now jump 28 bytes from the end of the 2 nd DWORD. What are the following the 4 bytes? C How would these values be displayed while running windows, which uses the Little Endian numbering system reading right to left? C4 If executing a DIR command in a Command Prompt window would result in the following. Note that this data is not relative to your classroom computer because it did not come from that computer.

10 12. Now, let s determine the VOLUME LABEL for the drive on which the link file c-3.txt.lnk was created. Decode the value of the 4 th DWORD following the 136 byte block, which is 28 decimal. 13. Now jump 28 bytes from the end of the 4 th DWORD. What is the following nullterminated string? DRIVE_C How would these values be displayed while running windows? DRIVE_C (Note that if there was no volume label then expect to find only the byte 00h at this location.). Note that this data is not relative to your classroom computer because it did not come from that computer.

11 14. Now let s determine if the NETBIOS for the target machine on which the target file resided is embedded. This is a multi-step process (see image below) Decode the value of the 1 st DWORD following the 136 byte block, which is 112 decimal Jump 112 bytes beginning with the first byte of the DWORD (70h) Next, read the following WORD value [1D 00], convert to decimal (29), multiply by 2, and then jump that value (29x2=58) following the WORD value that was decoded Next, read the following WORD value [32 00], convert to decimal (50), multiply by 2, and then jump that value (50x2=100) following the WORD value. Note that the following DWORD value is an IF-OR situation Situation #1: If the following DWORD is [ ] (as it is in our case) then jump 32 bytes (including the DWORD) and note the following null-terminated NETBIOS name string rb Situation #2: If the following DWORD is [ ] (not as in our case) then jump 16 bytes (including the DWORD). (Our example uses situation 1.)

12 15. Now let s determine if the MAC (Media Access Code), the unique ID for the network card, for the target machine on which the target file resided is embedded. 16. If the DWORD 10h 00h 00h 00h was found in the above-mentioned Situation #1, which it was, then jump the value of the DWORD (16 decimal) (including the DWORD), beginning with the 10h, and note the following DWORD If the DWORD is 60h 00h 00h 00h was found in the above-mentioned Situation #2, which it was in our case, then then jump 60h (96d) from the beginning of the DWORD. The last six bytes of this block is the six-byte MAC address E4 00. In this case, the byte order is as shown in raw data. (It is not read right to left in raw data.) So, when running IPCONFIG /ALL command from a Command Prompt will show these bytes as the MAC with dashes added.

13 Link Files Practical Exercise Decoding Link Files Using DataLifter Start DataLifter s Recycle Bin module. 1. Confirm option 3 is selected 2. Navigate to the folder \Student Files\03_Link Files where the link files are located. 3. Check the Select All Files box. 4. Click on Finish

14 5. NotePad will pop open with the results in a file named lnk data.txt. The following fields of information are captured. File Name: Name of the link file. File Flags: Decimal value of file flags QWORD. (Need to convert to binary to determine bitmap values.) File Attributes: Decimal value of file attributes QWORD. (Need to convert to binary to determine bitmap values.) Target Created Date: The created date associated with the target file at the time the shortcut was created. Target Modification Date: The last modified/written date associated with the target file at the time the shortcut was created. Target Last Accessed Date: The last access date associated with the target file at the time the shortcut was created. Target File Size: The size of the target file. Target Volume Label: The volume label of the drive where the target file resided. Target Volume Serial No: The volume serial number of the drive where the target file resided. NETBIOS: The NETBIOS name, if any, for the machine where the target file was located. Target MAC Address: The MAC Media Access Control) address, if any, for the machine where the target file was located. Relative Path: The network path, if applicable, the to the target file. Local Path: The local path, if applicable, to the target file.

15 6. Use NotePad s Save As menu option to save the results into your DESKTOP. Keep DataLifter s default filename of lnk data.txt You can now import lnk data.txt into an Excel spreadsheet using the procedure discussed in the INFO2 files lesson block. Note you have three dates and times to deal with.