Hi.
And welcome to building a super timeline of the activities in the previous video.
We looked at how to analyze and extract metadata for different types of files.
In this video we're going to introduce timestamps timelines and super timelines then we're going to
cover the log to timeline Placide framework for generating super timelines and show a practical example
on a Windows system in digital forensics like in all forensic sciences.
One of the fundamental questions in examiner answers is when one or more events have occurred.
For this reason the extraction and analysis of Time of time artifacts or time stamps relative to files
or to events generated by the OS applications and or users play a crucial role.
A time stamp is a record that stores the date in time when an event has occurred and could be related
to the file system to a user's activity such as log in time or a system activity like the time when
a service has started and or stopped timestamps can be recorded in differe formats.
For example Windows mainly uses the file time format where timestamps are stored in 64 bit values according
to the Coordinated Universal Time but also uses other formats as well.
Unix in Linux use the post-sex or IPAC 32 bit time format that records the number of seconds since midnight
of January 1st 1970.
Relative to the UTC time zone time stamps are converted in dates and times based on the system local
time zone.
On Windows the local time zone is stored under the registry key given here in the slide.
While in Unix and Linux in C local time which is a link to a time zone directory under user share zone
info file type stamps on Windows are generally referred to as Esmay Seabee times where n is the last
file content modification time a is last file access time.
See last file meditate change time and B file creation time.
These timestamps are stored in the dollar sign standard information attribute within the master file
table entry.
Unix derived systems generally use the first three attributes MacT times and stores them and end notes
analogs to MFT entries in the first video.
The section overview of the sleuth and file system analysis.
We covered the Mac time tool to generate a timeline of the file system activity.
A timeline is a sequence of events in chronological order creating a timeline of the file system is
certainly useful because it shows us when files had been created accessed or modified but we can't only
rely on it.
For example some OSes allow to disable the update of the files last access time.
On Windows it can be achieved with a registry key reported here on Linux with no a time option of the
mount command.
For these reasons it's more useful to reconstruct the overall context in which the events have occurred.
This is possible collecting timestamps from different sources like file system registry about logs Network
Connections browser history etc. which is building so-called super timeline of the activities.
For example a super timeline could tell us that a malicious file has been saved then executed by a user
after he logged on the system and browse to a certain web page.
In this video we cover a Python based framework to create super timeline's which is Plaxo based on log
to timeline which is a CLID originally written in Perl by Kristen Gudmundsson which has been rewritten
and included in class so which the latest version at the moment is onepoint 5.1.
To timeline Parsees time stamp data from multiple sources to create a super timeline of the activities.
It's made up of parser plugins for differe timestamps log to timeline is still the main tool and it
extracts the time stamps and saves them in a plastic storage file.
Other tools like info and piece sort have been added to filter and sort the data in the plastic storage
file lock to time like can now parse image files directly.
Plus it was not installed by default on Kelly Linux to install it.
We simply run the usual command.
Apt get install
the input says that the placers is already installed and the newest version is 1.5 point 1.
In this video we're going to create a super timeline from the Windows image we already used to show
TS K in the first video.
The section we move in the directory where the image resides and executes log to timeline.
Py.
The first parameter is the output class file that we call suspect Plaxo
while the second parameter is the directory where we've mounted the windows in the file
log to timeline.
Also provides the feature of filtering events with the f option specifying the filter file if the offset
inside the image is not specified with the o option.
The available partitions are displayed we choose the partition.
Hit enter and wait for the execution to terminate log to timeline.
Also provides filtering of the events with the f option specifying a filter file.
In this case we can use a pre-installed filter file for Windows that we can find under user share placers
directory.
The filter file is named filter Windows not text.
Now we can execute the command.
Now that we have the Placide storage file we can obtain detailed information we can obtain detailed
information about it with the info tool
this command returns info like the detected OS the parsers used and the counter of time stamp artifacts
for each parser.
The class of file is not readable.
So we have to convert it with the post-processing tool piece swerd
to see a list of compatible output formats we can use the log to time like tool with the Imphal option.
We could see that the supported output formats are listed here.
For example CXXVI separated value an excel sheet format we could convert the file into the CSP or the
X LS X format with the sort tool
we specify the output format with the o option
and the w option to specify the output file.
Then the last argument is the plaster file.
We could analyze the X LS X file using a program like Liberty office Kelk.
Each row was related to an event and contains attributes like the date and time the source description
user file name and so on.
As you can see events are chronologically ordered.
Since the CXXVI file can be very large to analyze manually.
And we could only be interested in certain data.
We could also export output to a sequel like database file to see the list of supported database formats
we could execute the log to timeline tool with the simple option.
We could see that the supported formats are my sequel and sequel lite we could execute the piece or
tool again.
Specified the sequel light output format with 0 option.
Then the W option with the name of the output file.
And finally Plass so file
we can open the generated sequel database with sequel IDB browser.
It shows the structure of the database with various tables.
We can execute sequel queries to display data that interests us based on different attributes like time
slice source file name user etc..
The range of sequel queries we can make is really infinite peace.
It also allows to apply a filter to the output data.
It also provides the slice state option that displays all events that happened x minutes before and
after the defined date X is controlled by the parameter slice size but defaults to 5 minutes.
For example to display all the events that happened 60 minutes before and after the specified time we
could execute the previous command with the slice option followed by the date in time
and the slice size option
with slice time specified in minutes well done in this section.
We've covered the extraction and analysis phase of the digital forensic process and took advantage of
the appropriate command line tools installed on Kelly Linux.
We covered the sleuthed kit a set of Selye tools to analyze file systems and Reg Ripper a tool specifically
written to analyze the Windows registry.
We looked at various tools to extract and analyze browser email and I am artifacts and tools to analyze
and extract meta data for common types of files like executive Bull's images and documents.
Finally we saw how to build a super timeline with log to timeline Plaxo in the next section we're going
to cover file carving process and recovery of deleted data.