WEBVTT

1
00:00:00.000 --> 00:00:02.925
Hello, and welcome back to

2
00:00:02.925 --> 00:00:06.165
Windows Registry
forensics Course 7,

3
00:00:06.165 --> 00:00:10.485
the userclass.dat hive,
Section 1, ShellBags.

4
00:00:10.485 --> 00:00:11.730
In this section we're going to

5
00:00:11.730 --> 00:00:14.565
cover the userclass.dat file,

6
00:00:14.565 --> 00:00:16.365
and we're going to
cover the ShellBags.

7
00:00:16.365 --> 00:00:19.245
Throughout this course
we'll be covering

8
00:00:19.245 --> 00:00:22.245
the entire userclass.dat file.

9
00:00:22.245 --> 00:00:23.985
The location of this file

10
00:00:23.985 --> 00:00:27.180
within your file
system would be C,

11
00:00:27.180 --> 00:00:31.035
users, username, AppData, local,

12
00:00:31.035 --> 00:00:33.330
Microsoft, and then Windows.

13
00:00:33.330 --> 00:00:35.220
This is where we would find the

14
00:00:35.220 --> 00:00:38.925
userclass.dat file located
within the system.

15
00:00:38.925 --> 00:00:40.905
We saw this when we looked at

16
00:00:40.905 --> 00:00:43.605
red edit way back in Course 1.

17
00:00:43.605 --> 00:00:46.315
We're going to cover the MuiCache

18
00:00:46.315 --> 00:00:48.725
and this is going to be
installed applications,

19
00:00:48.725 --> 00:00:51.080
and because the userclass.dat

20
00:00:51.080 --> 00:00:53.885
file is unique to
that particular user,

21
00:00:53.885 --> 00:00:56.330
those particular
items, programs that

22
00:00:56.330 --> 00:00:58.850
are installed will be
unique to that user also.

23
00:00:58.850 --> 00:01:00.365
We're going to look at ShellBags.

24
00:01:00.365 --> 00:01:04.040
ShellBags are folder
settings and then it also

25
00:01:04.040 --> 00:01:06.200
shows folder access and I will

26
00:01:06.200 --> 00:01:08.510
explain in depth why
this is important.

27
00:01:08.510 --> 00:01:10.235
We're also going to look at

28
00:01:10.235 --> 00:01:13.820
Microsoft Photo app recent files.

29
00:01:13.820 --> 00:01:15.950
These are files that
were accessed using

30
00:01:15.950 --> 00:01:18.380
the Microsoft Photo app and it's

31
00:01:18.380 --> 00:01:20.240
going to be very
interesting that we can tie

32
00:01:20.240 --> 00:01:22.980
these things all the way
back to individual users,

33
00:01:22.980 --> 00:01:24.440
we can tie these things back

34
00:01:24.440 --> 00:01:26.780
to removable media if they were

35
00:01:26.780 --> 00:01:28.790
on removable media or

36
00:01:28.790 --> 00:01:30.970
where on the file system
they were located.

37
00:01:30.970 --> 00:01:33.470
If we haven't already
done so I think we did

38
00:01:33.470 --> 00:01:36.095
do this but we need to download

39
00:01:36.095 --> 00:01:39.830
ShellBag Explorer by
Eric Zimmerman because

40
00:01:39.830 --> 00:01:41.540
we're going to be using that tool

41
00:01:41.540 --> 00:01:43.685
during this part of the class.

42
00:01:43.685 --> 00:01:46.280
Section 1 is going
to be ShellBags.

43
00:01:46.280 --> 00:01:48.140
Now, what ShellBags do is they

44
00:01:48.140 --> 00:01:51.280
track Windows folder settings.

45
00:01:51.280 --> 00:01:53.150
What they're there for is they

46
00:01:53.150 --> 00:01:55.250
track what we do at
our folder settings.

47
00:01:55.250 --> 00:01:57.440
Like if we brought up
the Windows Explorer

48
00:01:57.440 --> 00:01:59.150
and we wanted to view

49
00:01:59.150 --> 00:02:01.670
our folders as icons or we

50
00:02:01.670 --> 00:02:04.460
wanted to view our folders
as the details view,

51
00:02:04.460 --> 00:02:05.645
or the list view,

52
00:02:05.645 --> 00:02:08.134
or even if we resize the Window,

53
00:02:08.134 --> 00:02:10.430
these settings get
stored somewhere and

54
00:02:10.430 --> 00:02:12.865
where they're being stored
is in the ShellBags.

55
00:02:12.865 --> 00:02:15.665
ShellBags also tracks zip files.

56
00:02:15.665 --> 00:02:18.920
They also track
access to folders.

57
00:02:18.920 --> 00:02:21.350
This proves that a user,

58
00:02:21.350 --> 00:02:23.505
a specific user accessed

59
00:02:23.505 --> 00:02:27.170
a specific directory,
a specific folder,

60
00:02:27.170 --> 00:02:28.940
even if this folder is

61
00:02:28.940 --> 00:02:31.640
deleted or the zip
file is deleted,

62
00:02:31.640 --> 00:02:33.560
it's still going to show up in

63
00:02:33.560 --> 00:02:37.080
ShellBags because it does
not get removed from there.

64
00:02:37.080 --> 00:02:40.430
It will even show us folders
that were accessed on

65
00:02:40.430 --> 00:02:42.620
removable media which can be very

66
00:02:42.620 --> 00:02:45.030
important when we're
looking at certain cases.

67
00:02:45.030 --> 00:02:47.180
The name of the subkey
we're going to look at,

68
00:02:47.180 --> 00:02:50.330
we're going to look at the
file structure of ShellBags,

69
00:02:50.330 --> 00:02:52.900
we're going to look
at the Bag MRU key

70
00:02:52.900 --> 00:02:54.050
and what we're going to look at

71
00:02:54.050 --> 00:02:55.550
for there is we're
going to look at

72
00:02:55.550 --> 00:02:57.870
the MRU list that
has an MRU list.

73
00:02:57.870 --> 00:02:59.390
It also has something called

74
00:02:59.390 --> 00:03:01.520
a NodeSlot and
that's going to make

75
00:03:01.520 --> 00:03:03.560
a lot more sense when
we actually look at

76
00:03:03.560 --> 00:03:05.920
it and it may have subkeys.

77
00:03:05.920 --> 00:03:07.670
They don't all have
subkeys but they

78
00:03:07.670 --> 00:03:09.470
may have child objects,

79
00:03:09.470 --> 00:03:12.110
child folders and we're going
to take a look at that.

80
00:03:12.110 --> 00:03:14.090
We're also going to look
at the Bags key and

81
00:03:14.090 --> 00:03:16.280
the Bags key tracks back to

82
00:03:16.280 --> 00:03:19.310
the Bag MRU key and
we're going to see how

83
00:03:19.310 --> 00:03:21.230
these two keys interact

84
00:03:21.230 --> 00:03:23.450
to form the file structure
we're looking at.

85
00:03:23.450 --> 00:03:24.860
Again, we have the file path

86
00:03:24.860 --> 00:03:26.510
up there where we're
going to find it,

87
00:03:26.510 --> 00:03:28.880
local settings software,
Microsoft Windows,

88
00:03:28.880 --> 00:03:30.110
Shell, and then Bags.

89
00:03:30.110 --> 00:03:31.700
The value name we're
going to look at

90
00:03:31.700 --> 00:03:33.905
there is shell that will tell us

91
00:03:33.905 --> 00:03:36.760
not only the settings
but it's going to

92
00:03:36.760 --> 00:03:40.305
define the GUID that
represents the folder.

93
00:03:40.305 --> 00:03:41.660
We'll see that when we look at it

94
00:03:41.660 --> 00:03:43.625
and everything in
here is going to have

95
00:03:43.625 --> 00:03:47.060
a last right timestamp
under these Bags subkeys.

96
00:03:47.060 --> 00:03:48.890
Even the child bags,

97
00:03:48.890 --> 00:03:50.975
the child folders will have

98
00:03:50.975 --> 00:03:53.630
last right timestamps
and that would be

99
00:03:53.630 --> 00:03:56.360
the last time that the
user interacted with

100
00:03:56.360 --> 00:03:58.070
that folder which can also

101
00:03:58.070 --> 00:03:59.945
be very important to
your investigation.

102
00:03:59.945 --> 00:04:01.640
We're going to do a walk-through.

103
00:04:01.640 --> 00:04:02.960
We're going to take a look at

104
00:04:02.960 --> 00:04:04.975
the ShellBag file structure,

105
00:04:04.975 --> 00:04:07.430
we're going to take a
look at the MRU lists,

106
00:04:07.430 --> 00:04:08.780
and we're going to use

107
00:04:08.780 --> 00:04:11.525
Eric Zimmerman's
ShellBag Explorer.

108
00:04:11.525 --> 00:04:13.250
The items we're going to
need is we're going to

109
00:04:13.250 --> 00:04:15.020
need our Registry Explorer,

110
00:04:15.020 --> 00:04:17.225
we're going to need
ShellBags Explorer,

111
00:04:17.225 --> 00:04:18.785
and we're going to need Ivan's

112
00:04:18.785 --> 00:04:23.335
userclass.dat file,
usrclass.dat file.

113
00:04:23.335 --> 00:04:25.190
The first tool we're
going to use is

114
00:04:25.190 --> 00:04:27.290
we're going to use
Registry Explorer.

115
00:04:27.290 --> 00:04:30.350
Go ahead and open up
Registry Explorer and

116
00:04:30.350 --> 00:04:34.255
load in Ivan's
userclass.dat hive.

117
00:04:34.255 --> 00:04:35.630
If you haven't already done it,

118
00:04:35.630 --> 00:04:37.640
it's file, load hive,

119
00:04:37.640 --> 00:04:39.470
navigate out to where that file

120
00:04:39.470 --> 00:04:41.650
is on the system
and click ''Open''.

121
00:04:41.650 --> 00:04:44.720
Now, we're going to go ahead
and use our bookmarks here.

122
00:04:44.720 --> 00:04:46.655
We're going to go to
Bookmarks, common,

123
00:04:46.655 --> 00:04:51.040
and we're going to go to Bag MRU

124
00:04:51.050 --> 00:04:53.835
and this is the
ShellBag root key.

125
00:04:53.835 --> 00:04:56.750
Now, we can see down here where
it is in the file system.

126
00:04:56.750 --> 00:04:59.195
It's under local
settings, software,

127
00:04:59.195 --> 00:05:03.625
Microsoft, Windows,
Shell, and then Bag MRU.

128
00:05:03.625 --> 00:05:05.450
The first thing we
do we're looking

129
00:05:05.450 --> 00:05:07.880
at the root key here, Bag MRU,

130
00:05:07.880 --> 00:05:09.350
we can see that we do have

131
00:05:09.350 --> 00:05:12.154
an MRU list and we've
looked at MRU list before,

132
00:05:12.154 --> 00:05:14.540
there are four byte
values starting

133
00:05:14.540 --> 00:05:17.040
at the bottom and you would
read it from the bottom up.

134
00:05:17.040 --> 00:05:19.490
I'm going to demonstrate
how we look at

135
00:05:19.490 --> 00:05:22.355
this and what the file
structure is here.

136
00:05:22.355 --> 00:05:24.410
If we were to take
a look at Bag zero,

137
00:05:24.410 --> 00:05:26.045
if we look at Bag zero,

138
00:05:26.045 --> 00:05:28.370
we can see we have our MRU list.

139
00:05:28.370 --> 00:05:31.980
We can see the Bag zero has
13 keys underneath here,

140
00:05:31.980 --> 00:05:34.110
you see something
called a NodeSlot

141
00:05:34.110 --> 00:05:36.690
and this says NodeSlot 4.

142
00:05:36.690 --> 00:05:39.585
What this NodeSlot
is referring back to

143
00:05:39.585 --> 00:05:43.245
is the Bag's subkey

144
00:05:43.245 --> 00:05:44.690
and we're going to look
at that in a minute.

145
00:05:44.690 --> 00:05:46.625
But let's look at our child keys.

146
00:05:46.625 --> 00:05:49.640
We have zero has
the subkey of zero,

147
00:05:49.640 --> 00:05:51.965
this has a NodeSlot of one,

148
00:05:51.965 --> 00:05:54.910
and it has two
subkeys, zero and one

149
00:05:54.910 --> 00:05:57.600
We have again our MRU list.

150
00:05:57.600 --> 00:06:00.160
The bag at the bottom
would be the first one,

151
00:06:00.160 --> 00:06:06.050
which would be 1 and then 0.

152
00:06:06.050 --> 00:06:08.025
Now, when we look at bag 0,

153
00:06:08.025 --> 00:06:12.370
we're going to see that
it has a NodeSlot of 84,

154
00:06:12.380 --> 00:06:16.170
and this is referring
back to the bag sub key.

155
00:06:16.170 --> 00:06:17.975
We're going to take
a look in a second.

156
00:06:17.975 --> 00:06:19.685
We also see that each one of

157
00:06:19.685 --> 00:06:23.400
these sub-keys has a last
write date and time.

158
00:06:23.400 --> 00:06:25.175
If we look at folder 1,

159
00:06:25.175 --> 00:06:28.275
we see that it has
a NodeSlot of 85.

160
00:06:28.275 --> 00:06:30.960
We've got 85, 84,

161
00:06:30.960 --> 00:06:32.850
and 1, and 4.

162
00:06:32.850 --> 00:06:36.690
These NodeSlots are where
we would need to go look.

163
00:06:36.690 --> 00:06:38.505
We're going to look
at NodeSlot 4,

164
00:06:38.505 --> 00:06:42.770
NodeSlot 1, and then 84 and 85.

165
00:06:42.770 --> 00:06:46.980
Go ahead and close up BagMRU
so we have some space.

166
00:06:46.980 --> 00:06:49.560
Right underneath it
you see we have bags,

167
00:06:49.560 --> 00:06:51.960
and you see we have
sub-keys in bags.

168
00:06:51.960 --> 00:06:54.575
We were going to
look at number 1.

169
00:06:54.575 --> 00:06:55.890
We take a look at 1.

170
00:06:55.890 --> 00:06:58.200
You see you have a
Cam Dialogue here,

171
00:06:58.200 --> 00:07:00.045
but that's not the key
we're interested in.

172
00:07:00.045 --> 00:07:01.380
We're interested in shell,

173
00:07:01.380 --> 00:07:04.535
because shell is going to
give us the folder type,

174
00:07:04.535 --> 00:07:08.040
and the folder type we're
looking at is pictures.

175
00:07:08.040 --> 00:07:09.495
We see GUIDs here,

176
00:07:09.495 --> 00:07:13.775
and these represent the folder
type but it is pictures.

177
00:07:13.775 --> 00:07:15.480
You can look these GUIDs up.

178
00:07:15.480 --> 00:07:17.310
There are online resources that

179
00:07:17.310 --> 00:07:19.275
you can go ahead and
look up the GUIDS,

180
00:07:19.275 --> 00:07:22.190
but this GUID comes
back to pictures.

181
00:07:22.190 --> 00:07:25.690
We see we have last
right, date and time.

182
00:07:25.860 --> 00:07:30.215
The other NodeSlot we're
going to look at was four.

183
00:07:30.215 --> 00:07:33.190
Let's locate NodeSlot 4.

184
00:07:33.190 --> 00:07:36.240
We can see we have NodeSlot
4 and we have a shell,

185
00:07:36.240 --> 00:07:38.115
but we don't have any
information there,

186
00:07:38.115 --> 00:07:39.785
but we do have this GUID.

187
00:07:39.785 --> 00:07:43.295
I could tell you this GUID
just means regular folder.

188
00:07:43.295 --> 00:07:44.670
Again, you can research

189
00:07:44.670 --> 00:07:46.140
that and look it
up if you'd like,

190
00:07:46.140 --> 00:07:48.175
but that is just A
standard folder.

191
00:07:48.175 --> 00:07:50.429
We also have our dates and times.

192
00:07:50.429 --> 00:07:52.685
Now, the next Nodeslots
we would need to look

193
00:07:52.685 --> 00:07:55.500
at would be 84 and 85.

194
00:07:55.500 --> 00:07:56.915
This is pictures.

195
00:07:56.915 --> 00:08:01.355
What you're seeing in here
are the folder settings.

196
00:08:01.355 --> 00:08:04.290
You're seeing the icon size,

197
00:08:04.290 --> 00:08:08.225
the view mode, the
flags, how it's grouped.

198
00:08:08.225 --> 00:08:11.180
These are the folder
settings that you

199
00:08:11.180 --> 00:08:14.390
as a user would set to view
your folders and files.

200
00:08:14.390 --> 00:08:16.890
If we look at 85, 85

201
00:08:16.890 --> 00:08:19.235
is also pictures which
is what I would expect.

202
00:08:19.235 --> 00:08:21.650
Again, you have your settings in

203
00:08:21.650 --> 00:08:24.795
here that are the
folder settings.

204
00:08:24.795 --> 00:08:28.065
You would need to put all
this information together

205
00:08:28.065 --> 00:08:31.440
to come up with a file path
for that very first bag.

206
00:08:31.440 --> 00:08:34.170
Manually going through this and

207
00:08:34.170 --> 00:08:38.570
resolving shell bags would
be a time-consuming task.

208
00:08:38.570 --> 00:08:40.755
That's where we're going
to use an automated tool.

209
00:08:40.755 --> 00:08:43.730
We're going to use
ShellBag Explorer.

210
00:08:43.730 --> 00:08:46.890
Go ahead and launch
Shellbag Explore.

211
00:08:46.890 --> 00:08:48.855
What you would do is go File,

212
00:08:48.855 --> 00:08:54.615
load offline hive, navigate
out to UsrClass.dat.

213
00:08:54.615 --> 00:08:57.400
Wherever you saved,
Ivan UsrClass.dat,

214
00:08:57.400 --> 00:08:59.315
and go ahead and click "Open".

215
00:08:59.315 --> 00:09:00.790
Once you do that,

216
00:09:00.790 --> 00:09:02.150
what you're going to see,

217
00:09:02.150 --> 00:09:05.775
is it's going to tell you
how many items it found,

218
00:09:05.775 --> 00:09:07.785
how many items it processed.

219
00:09:07.785 --> 00:09:10.400
It's going to give
you drive letters.

220
00:09:10.400 --> 00:09:11.620
How many drive letters,

221
00:09:11.620 --> 00:09:14.035
zip files, network locations.

222
00:09:14.035 --> 00:09:16.635
It's going to give you
an overall information

223
00:09:16.635 --> 00:09:18.290
about what it just did,

224
00:09:18.290 --> 00:09:20.920
and it does it really fast.

225
00:09:20.920 --> 00:09:22.410
You can look that over and

226
00:09:22.410 --> 00:09:24.740
once you're done, click "Okay".

227
00:09:25.190 --> 00:09:29.280
Now, let's take a look at
what we just looked at.

228
00:09:29.280 --> 00:09:32.695
We just looked at something
that was in pictures.

229
00:09:32.695 --> 00:09:34.290
We're going to go ahead and go

230
00:09:34.290 --> 00:09:37.760
to "My computer," "Pictures",

231
00:09:37.760 --> 00:09:40.470
and we see we have
two sub folders,

232
00:09:40.470 --> 00:09:42.675
and we click on "Pictures".

233
00:09:42.675 --> 00:09:46.335
We see we have a bagMRU, slot 0.

234
00:09:46.335 --> 00:09:48.875
We have Slot 1, we have

235
00:09:48.875 --> 00:09:53.465
our NodeSlot 85
that we looked at,

236
00:09:53.465 --> 00:10:00.175
is saved Pictures, and NodeSlot
84 is our camera roll.

237
00:10:00.175 --> 00:10:03.965
But it's much easier to go
ahead and look at it this way

238
00:10:03.965 --> 00:10:08.770
than it is to look at it the
way we did before manually.

239
00:10:08.770 --> 00:10:11.380
But what I want to make
you aware of here is

240
00:10:11.380 --> 00:10:14.780
this showing you folders.

241
00:10:14.780 --> 00:10:17.530
It will not show files
within the folders,

242
00:10:17.530 --> 00:10:20.195
but it will show folders
and sub-folders.

243
00:10:20.195 --> 00:10:22.395
If we want to take
a look at desktop,

244
00:10:22.395 --> 00:10:24.095
these are the folders that are on

245
00:10:24.095 --> 00:10:26.090
the Ivan computer desktop,

246
00:10:26.090 --> 00:10:27.725
and they are on there.

247
00:10:27.725 --> 00:10:32.350
What's really great is it also
shows us removable media.

248
00:10:32.350 --> 00:10:35.760
Remember, we had that E
drive that we were able

249
00:10:35.760 --> 00:10:40.895
to locate and resolve
back to the Ivan user.

250
00:10:40.895 --> 00:10:42.939
Now, we can see
some of the Folders

251
00:10:42.939 --> 00:10:45.215
that were on that
removable media.

252
00:10:45.215 --> 00:10:47.315
We have FTK_IMAGER a lay,

253
00:10:47.315 --> 00:10:49.515
Hive is exported Registry,

254
00:10:49.515 --> 00:10:51.340
and some other folders here.

255
00:10:51.340 --> 00:10:53.010
What we also see,

256
00:10:53.010 --> 00:10:55.910
is not only that but we
have a created date,

257
00:10:55.910 --> 00:10:59.015
modified date, access date,

258
00:10:59.015 --> 00:11:03.130
first interacted with and
last interacted with.

259
00:11:03.130 --> 00:11:06.070
We even have the file
system of that drive.

260
00:11:06.070 --> 00:11:09.380
Yes, it was x File that
we were looking at.

261
00:11:09.380 --> 00:11:12.335
That was the one that had
the good partition table.

262
00:11:12.335 --> 00:11:15.850
That is a four terabyte
external hard drive.

263
00:11:15.850 --> 00:11:18.715
It is GPT because it's
over two terabytes,

264
00:11:18.715 --> 00:11:22.645
but it is formatted
X FAT, not FAT 32.

265
00:11:22.645 --> 00:11:26.715
We can take a look at F.
F is a FAT file system.

266
00:11:26.715 --> 00:11:29.475
There's a directory called
second try on there,

267
00:11:29.475 --> 00:11:31.885
and we can see the
file types for it.

268
00:11:31.885 --> 00:11:34.160
We can look at a G-Drive,

269
00:11:34.160 --> 00:11:35.960
and you can see the
folders that were on

270
00:11:35.960 --> 00:11:37.610
this removable G-drive that was

271
00:11:37.610 --> 00:11:41.855
attached to Ivan's computer
file system was also x FAT.

272
00:11:41.855 --> 00:11:45.665
You can see downloads and
we can expand downloads.

273
00:11:45.665 --> 00:11:48.725
We can see that there's a
folder there called New folder.

274
00:11:48.725 --> 00:11:51.620
We could expand new folder
and we can see that there's

275
00:11:51.620 --> 00:11:55.640
a folder called packers on
there, and password tools.

276
00:11:55.640 --> 00:11:58.550
We can expand that and we can see

277
00:11:58.550 --> 00:12:00.710
the zip file in

278
00:12:00.710 --> 00:12:05.015
another directory that's
inside this packers folder.

279
00:12:05.015 --> 00:12:10.670
We can see when this
directory was last accessed.

280
00:12:10.670 --> 00:12:13.190
We can see the type of
file system this is,

281
00:12:13.190 --> 00:12:14.960
it's the NTFS file system.

282
00:12:14.960 --> 00:12:17.870
Down here you're going
to have your bag,

283
00:12:17.870 --> 00:12:20.885
MRU, and you're node positions,

284
00:12:20.885 --> 00:12:23.345
you're going to have
an absolute file path.

285
00:12:23.345 --> 00:12:24.860
It's going to tell
you where it is.

286
00:12:24.860 --> 00:12:26.270
It's on the desktop.

287
00:12:26.270 --> 00:12:30.410
My computer downloads,
New folder, etc.

288
00:12:30.410 --> 00:12:33.230
You can see create
it on last access.

289
00:12:33.230 --> 00:12:34.715
We can even see

290
00:12:34.715 --> 00:12:37.130
the master file
table entry number

291
00:12:37.130 --> 00:12:38.645
and the sequence number,

292
00:12:38.645 --> 00:12:40.265
and it has elapsed right time.

293
00:12:40.265 --> 00:12:42.380
The last right time is
the key right time.

294
00:12:42.380 --> 00:12:44.345
This is referring
back to the key,

295
00:12:44.345 --> 00:12:47.960
and when I say the
key, I mean downloads.

296
00:12:47.960 --> 00:12:50.375
You can drill down
and you can see,

297
00:12:50.375 --> 00:12:54.410
Ivan's exploited registry
has subfolders, Amcache.

298
00:12:54.410 --> 00:12:55.760
If we look at Amcache,

299
00:12:55.760 --> 00:12:57.065
it is a directory.

300
00:12:57.065 --> 00:13:00.080
It was modified to
state and time.

301
00:13:00.080 --> 00:13:02.960
Again, we can see
our bag MRU slots,

302
00:13:02.960 --> 00:13:06.050
our positions, our
node slot would be 49.

303
00:13:06.050 --> 00:13:07.190
If we went back into

304
00:13:07.190 --> 00:13:09.440
the file system and
looked at node slot 49,

305
00:13:09.440 --> 00:13:10.865
we would be able to see this.

306
00:13:10.865 --> 00:13:13.115
We have created the last access,

307
00:13:13.115 --> 00:13:15.995
the name, the absolute path.

308
00:13:15.995 --> 00:13:18.965
This absolute path is
showing the E-drive,

309
00:13:18.965 --> 00:13:20.870
which is where it comes from.

310
00:13:20.870 --> 00:13:24.110
The other thing I want
you to take notice here,

311
00:13:24.110 --> 00:13:28.325
this is another F-drive
and another G-drive.

312
00:13:28.325 --> 00:13:29.900
This F-drive is not

313
00:13:29.900 --> 00:13:34.085
the same F-drive that
I plug in to Ivan.

314
00:13:34.085 --> 00:13:38.510
Ivan is a VM that's been used
by more than one person.

315
00:13:38.510 --> 00:13:44.390
It shows files that were
previously mounted as drive-F,

316
00:13:44.390 --> 00:13:47.555
prior to me mounting
this folder as drive-F,

317
00:13:47.555 --> 00:13:50.375
and it had other folders on it.

318
00:13:50.375 --> 00:13:53.825
A folder called password
crackers, Ophcrack,

319
00:13:53.825 --> 00:13:58.280
Ophcrack has a subfolder
which is an X64,

320
00:13:58.280 --> 00:13:59.780
we see a zip file.

321
00:13:59.780 --> 00:14:02.060
It was probably
downloaded as a zip.

322
00:14:02.060 --> 00:14:06.170
We can see the absolute
path of that file.

323
00:14:06.170 --> 00:14:08.825
We can here see

324
00:14:08.825 --> 00:14:11.945
dates and times of when
it was last accessed.

325
00:14:11.945 --> 00:14:13.505
FAT file system.

326
00:14:13.505 --> 00:14:16.040
You can see other
folders that were

327
00:14:16.040 --> 00:14:21.365
accessed on the system and
you can see their file paths.

328
00:14:21.365 --> 00:14:23.240
This is on the desktop.

329
00:14:23.240 --> 00:14:25.520
I don't think there is
Dropbox information,

330
00:14:25.520 --> 00:14:32.120
but we can see that Dropbox
was accessed back in 2019,

331
00:14:32.120 --> 00:14:36.240
and last interacted with in 2020.

332
00:14:36.310 --> 00:14:39.140
There's only two
directories in there.

333
00:14:39.140 --> 00:14:41.810
We can see items on
the control panel

334
00:14:41.810 --> 00:14:43.955
when they were interacted with.

335
00:14:43.955 --> 00:14:48.410
User accounts, last interacted
with fairly recently.

336
00:14:48.410 --> 00:14:49.850
You can see your path.

337
00:14:49.850 --> 00:14:51.710
It can drill down further.

338
00:14:51.710 --> 00:14:54.560
Deleted account,
confirm deletion.

339
00:14:54.560 --> 00:14:57.690
We have deleted user
account on Ivan,

340
00:14:58.300 --> 00:15:01.190
and you could spend a lot
of time going through

341
00:15:01.190 --> 00:15:03.275
here and looking at everything.

342
00:15:03.275 --> 00:15:05.450
There is a tone of
information in here,

343
00:15:05.450 --> 00:15:08.525
and a lot of it may be
important to your case,

344
00:15:08.525 --> 00:15:10.355
the Shared Documents folder.

345
00:15:10.355 --> 00:15:13.100
We see a Dropbox in
the Google Drive.

346
00:15:13.100 --> 00:15:15.020
We have an absolute file path,

347
00:15:15.020 --> 00:15:16.895
we have a first interacted with.

348
00:15:16.895 --> 00:15:20.630
We have a created an
elastic access date.

349
00:15:20.630 --> 00:15:23.510
We have the master file
table entry number

350
00:15:23.510 --> 00:15:25.430
and its sequence number.

351
00:15:25.430 --> 00:15:29.480
There is quite a bit of
information in ShellBags,

352
00:15:29.480 --> 00:15:32.090
and this tool displays
it quite nicely.

353
00:15:32.090 --> 00:15:33.665
It is a free tool.

354
00:15:33.665 --> 00:15:35.720
But I want you to
understand the structure

355
00:15:35.720 --> 00:15:38.360
of ShellBags that we do have to

356
00:15:38.360 --> 00:15:42.650
look at the bag MRU key and
then the bag key that there

357
00:15:42.650 --> 00:15:45.245
are slots and the nodes

358
00:15:45.245 --> 00:15:48.005
that we looked at,
the node slots.

359
00:15:48.005 --> 00:15:54.485
This proves that the user
interacted with the directory.

360
00:15:54.485 --> 00:15:58.335
If it shows up here,
they accessed it.

361
00:15:58.335 --> 00:16:03.280
We can say for sure that
these folders were accessed,

362
00:16:03.280 --> 00:16:04.720
which is very important because

363
00:16:04.720 --> 00:16:06.905
if you come across somebody,

364
00:16:06.905 --> 00:16:08.480
a suspect who says, "Hey,

365
00:16:08.480 --> 00:16:11.330
I was never on my
computer or I never

366
00:16:11.330 --> 00:16:12.830
interacted with that folder or

367
00:16:12.830 --> 00:16:14.360
I didn't know that
folder was there."

368
00:16:14.360 --> 00:16:16.250
If you're doing a case

369
00:16:16.250 --> 00:16:19.690
that maybe they have
pitchers they shouldn't have

370
00:16:19.690 --> 00:16:23.110
or documents they shouldn't
have in a specific directory

371
00:16:23.110 --> 00:16:24.580
that's no longer on

372
00:16:24.580 --> 00:16:27.905
the computer when you
get it to examine it,

373
00:16:27.905 --> 00:16:30.740
but you find references
to it in shell bags,

374
00:16:30.740 --> 00:16:34.985
it shows that the user
interacted with that directory,

375
00:16:34.985 --> 00:16:38.780
this can be crucial
information to your case.

376
00:16:38.780 --> 00:16:41.089
In our next section,

377
00:16:41.089 --> 00:16:43.820
we're going to continue with

378
00:16:43.820 --> 00:16:48.225
the UsrClass.dat
or userclass.dat,

379
00:16:48.225 --> 00:16:50.360
is usually referred to hive,

380
00:16:50.360 --> 00:16:54.035
and we're going to take
a look at NYU-cache,

381
00:16:54.035 --> 00:16:59.340
and we're going to take a look
at the Windows photo app.