Reconstructing Execution History Using Windows Disk Artifacts

// Introduction to Disk Artifacts

Disk artifacts are critical in forensic investigations, particularly when reconstructing execution history in Windows environments. By analyzing artifacts such as file timestamps, registry keys, and prefetch data, practitioners can derive insights into user activities and application usage.

// Key Disk Artifacts

Here are some of the significant disk artifacts to focus on:

• File Timestamps: Creation, modification, and access timestamps provide a linear timeline of actions.
• Windows Registry: The registry contains keys and values related to installed applications and user activities.
• Prefetch Files: Used to speed up application launches, prefetch files can reveal when applications were executed.
• UserAssist Registry Keys: These keys track user interactions with applications and can be instrumental in determining which programs were used and when.

// File Timestamps

To gather file timestamps, use the following command in PowerShell:

Get-ChildItem -Path C:\Path\To\Directory -Recurse | Select-Object Name, CreationTime, LastAccessTime, LastWriteTime

This command traverses the specified directory and provides a list of files with their creation, last access, and last write times. Each timestamp can be interpreted as follows:

• Creation Time: When the file was initially created.
• Last Access Time: The last time the file was opened or executed.
• Last Write Time: The last time the file was modified.

By comparing these timestamps, an investigator can piece together when files were created, accessed, or modified during an incident.

Example Scenario

Consider a scenario where a suspicious executable file was found. By analyzing its timestamps, you identify that it was created shortly after a significant event on the system (e.g., a user logged in). If the Last Access Time is also recent, it could indicate that the file was executed.

// Registry Analysis

The Windows Registry can provide a wealth of information regarding executed applications. Important registry keys include:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist: Tracks applications used by the current user.
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall: Contains information about installed applications.

Extracting UserAssist Data

To extract UserAssist data, use the following PowerShell command:

Get-ItemProperty HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\* | Select-Object -Property PSChildName, Count, LastUpdated

This command retrieves the application usage statistics along with the last updated timestamp. The Count indicates how many times the application was executed.

Interpreting UserAssist Data

When analyzing the output:

• PSChildName: The specific application used, stored in a base64-encoded format.
• Count: The frequency of access, which might indicate the application’s relevance during the timeframe of interest.
• LastUpdated: When the application's usage was last recorded, providing context to the timeline.

// Prefetch Files

Prefetch files are located in C:\Windows\Prefetch and are named in the format AppName.exe-xxxxxxxx.pf, where xxxxxxxx is a hexadecimal hash of the application path. These files are useful for identifying applications that were run on the system.

Analyzing Prefetch Files

Use the following command to list the prefetch files:

Get-ChildItem C:\Windows\Prefetch\*.pf | Select-Object Name, LastWriteTime

What to Look For

• LastWriteTime: This should coincide with user activity. If an application was executed, its prefetch file would have a recent last write time.
• File Name: Indicates which application was executed, assisting in correlating events.

// Common Pitfalls

• Failing to account for timezone differences when interpreting timestamps can lead to incorrect conclusions.
• Overlooking temporary files which may contain execution remnants.
• Not cross-referencing multiple artifacts; correlations between timestamps, registry entries, and prefetch data strengthen the timeline.

// Defensive Implications

Understanding these artifacts not only aids in investigations but can also inform defensive strategies. Regular audits of these artifacts can help identify unauthorized actions or anomalies in user behavior. Additionally, monitoring changes in UserAssist keys can alert security teams to potential misuse of applications.

// Workflow Checklist

1. Gather file timestamps from relevant directories. 2. Extract data from UserAssist registry keys. 3. Analyze prefetch files for application execution history. 4. Cross-reference findings with other data sources (e.g., log files, user accounts). 5. Document the evidence chain and gather insights for further analysis.

By systematically analyzing these disk artifacts, you can effectively reconstruct execution history, providing clarity during incident investigations.

--- // FIELDOPS REPORT AUTHORIZED BY: Theodore O. //