【サイバーセキュリティ ハンズオン】デジタルフォレンジック技術入門（Windows解析編）

https://www.vmware.com/jp/products/workstation-player/workstation-player-evaluation.html

https://digital-forensics.sans.org/community/downloads

https://docs.vmware.com/jp/VMware-Tools/10.3.0/com.vmware.vsphere.vmwaretools.doc/GUID-08BB9465-D40A-4E16-9E15-8C016CC8166F.html

# tar -zxvf VMwareTools- <version>.tar.gz

# cd vmware-tools-distrib

# ./vmware-install.pl

https://qiita.com/7of9/items/7facd5aa07497b53a2ec

https://digitalforensic.jp/home-act-products-df-guideline-7th/

https://cfreds-archive.nist.gov/

https://cfreds-archive.nist.gov/Hacking_Case.html

https://cfreds-archive.nist.gov/Hacking_Case.html

for i in {1..8} ; do cat SCHARDT$i.htm >> SCHARDT.img ; done；

https://cfreds-archive.nist.gov/Hacking_Case.html

https://www.exterro.com/ftk-imager

http://sectanlab.sakura.ne.jp/report/Manual_FTKimager.pdf

md5sum SCHARDT.img

https://github.com/keydet89/RegRipper3.0

https://github.com/keydet89/RegRipper3.0/tree/master/plugins

rip.exe

rip.pl

rip -l >> pluginlist.txt

nano -l /usr/share/regripper/rip.pl

my $plugindir = File::Spec->catfile($scriptdir, "plugins");

http://network-forensics.blogspot.com/2010/01/nist-forensic-challenge_04.html

rip -r ＜softwareハイブのパス＞ -p winver

rip -r ＜softwareハイブのパス＞ -p winver

rip -r ＜systemハイブのパス＞ -p timezone

rip -r ＜softwareハイブのパス＞ -p winnt_cv

https://github.com/warewolf/regripper/blob/master/plugins/winnt_cv.pl

rip -r ＜systemハイブのパス＞ -p compname

rip -r ＜systemハイブのパス＞ -p compname

rip -r ＜systemハイブのパス＞ -p  shutdown

rip -r ＜SAMハイブのパス＞ -p samparse

rip.pl -r ＜SAMハイブのパス＞ -p samparse | grep Username

rip.pl -r ＜SAMハイブのパス＞ -p samparse | grep -i -e username -e login

rip.pl -r ＜SAMハイブのパス＞ -p samparse | grep -i -e username -e login

mount --help

mkdir files

mount -ro loop,offset=32256 SCHARDT.img  files/

cd files

ls

grep –ri schardt

rip.pl -r ＜softwareハイブのパス＞ -p networkcards

cat irunin.ini | more

https://www.wireshark.org/tools/oui-lookup.html

grep –ir SMTPusername

grep –ir newsserver

grep -ir newsserver

https://www.forteinc.com/agent/

find -name “*.dbx” > ~/news.txt

find --help

cat ne*

cat mirc.ini

ls

ls

file interception

wireshark

https://

http://www.kt.rim.or.jp/~kbk/regex/regex.html#WORDCHAR

grep -ErohI "\w+([._-]\w)*@\w+([._-]\w)*\.\w{2,4}" *  > mail.txt

grep -ir mrevilrulez@yahoo.com

apt-get install rifiuti

rifiuti --help

rifiuti INFO2

clamscan -ir

https://cfreds-archive.nist.gov/data_leakage_case/data-leakage-case.html

https://digitalcorpora.org/corpora/files

https://cfreds-archive.nist.gov/data_leakage_case/data-leakage-case.html

cat cfreds_2015_data_leakage_pc.7z* > cfreds_2015_data_leakage_pc.7z

p7zip --help

https://cfreds-archive.nist.gov/data_leakage_case/data-leakage-case.html

p7zip -d ＜7zipで圧縮されたイメージファイル>

p7zip -d cfreds_2015_data_leakage_pc.7z

md5sum cfreds_2015_data_leakage_pc.dd

sha1sum cfreds_2015_data_leakage_pc.dd

p7zip -d cfreds_2015_data_leakage_rm#2.7z

md5sum cfreds_2015_data_leakage_rm#2.dd

sha1sum cfreds_2015_data_leakage_rm#2.dd

p7zip -d cfreds_2015_data_leakage_rm#3_type2.7z

md5sum cfreds_2015_data_leakage_rm#3_type2.dd

sha1sum cfreds_2015_data_leakage_rm#3_type2.dd

mmls  cfreds_2015_data_leakage_pc.dd

mount -ro loop,offset=1048576 cfreds_2015_data_leakage_pc.dd mnt/part1/

# umount <マウントディレクトリ>

mount -ro loop,offset=105906176  cfreds_2015_data_leakage_pc.dd mnt/part2/

rip.pl -r SOFTWARE -p winnt_cv

https://accessdata-registry-viewer.software.informer.com/download/#downloading

rip.pl -r SYSTEM -p timezone

rip.pl -r SYSTEM -p compname

https://kaworu.jpn.org/security/samdump2

rip.pl -r SAM -p samparse > accounts

cat accounts

samdump2

samdump2 SYSTEM SAM -o ＜出力ファイル＞

cat ＜出力ファイル＞

rip.pl -r SYSTEM -p shutdown

rip.pl -r SOFTWARE -p networkcards

rip.pl -r SYSTEM -p nic2

rip.pl -r SOFTWARE -p installer

http://www.nirsoft.net/utils/win_prefetch_view.html

rip -r NTUSER.DAT -p userassist_tln > userassisttlnout

rip -r system -p appcompatcache_tln > appcompatcachetlnout

rip -r usrclass.dat -p muicache

Get-WinEvent -Path <evtxのパス> | Export-Csv -Path <csvのパス> -Encoding Default

https://4thsight.xyz/10364

https://www.microsoft.com/en-us/download/details.aspx?id=21561

= (A2-25569)*60*60*24

= 25569+(B2-(60*60*13))/(60*60*24)

https://www.foxtonforensics.com/browser-history-viewer/

https://www.naporitansushi.com/normcap/

MyLastSearch.exe  /loadfrom “IE History Folder名”“IE Cache Folder名”     

“Mozilla History Folder名”“Mozilla Cache Folder名” “Opera Cache

　Folder名”“Chrome Cache Folder名”

wordwheelquery

https://support.microsoft.com/ja-jp/help/870929/how-to-determine-outlook-version-information

https://www.nucleustechnologies.com/ost-viewer.html

rip.pl -r SYSTEM -p usbstor

rip.pl -r SYSTEM -p usbdevices

https://www.kazamiya.net/usn_analytics

usn_analytics.exe

usn_analytics -o output in $J.copy0

rip -r NTUSER.DAT -p runmru

rip -r NTUSER.DAT -p mndmru

rip -r UsrClass.dat -p shellbags > shellbagout

https://ericzimmerman.github.io/

https://4discovery.com/our-tools/link-parser/

rip.pl -r SOFTWARE -p installer

https://www.vector.co.jp/soft/win95/util/se079072.html

https://www.ecma-international.org/publications/files/ECMA-ST/Ecma-167.pdf

https://superuser.com/questions/559031/how-to-find-out-when-a-disc-dvd-has-been-written-burned

dd if=<UDFイメージファイル> bs=1 skip=65912 count=12 | hexdump -C

https://www.kazamiya.net/fte

https://news.mynavi.jp/article/windows-147/

https://thumbcacheviewer.github.io/

https://fileviewerplus.com/download

https://itojisan.xyz/trouble/13694/

http://www.nirsoft.net/utils/ese_database_view.html

esedbexport -help

esedbexport < Windows.edbのパス> 　＞　ログ出力ファイル（例．out）

ls

https://www.nirsoft.net/utils/ese_database_view.html

mmls cfreds_2015_data_leakage_pc.dd

vshadowinfo -h

vshadowinfo -o 105906176 cfreds_2015_data_leakage_pc.dd

vshadowmount -h

mkdir /mnt/vssvolume

vshadowmount -o 105906176 cfreds_2015_data_leakage_pc.dd /mnt/vssvolume/

ls -l /mnt/vssvolume

mkdir /mnt/vss1logical

mount -o ro /mnt/vssvolume/vss1  /mnt/vss1logical/

cd /mnt/vss1logical

ls -l

cd /mnt/vss1logical/Users/informant/AppData/Local/Google/Drive/user_default

ls -l

http://bitforensics.blogspot.com/2012/12/google-drive-artifacts-explained.html

stat snapshot.db

file snapshot.db

stat sync_config.db

file sync_config.db

stat sync_log.log

file sync_log.log

https://www.itseclab.jp/security_info/digital_forensic/digital_forensic_implementation/memory_forensic_construction/

https://sqlitebrowser.org/

http://www.sqlite.org/fileformat2.html

http://port139.hatenablog.com/entries/2008/02/17

https://learn.microsoft.com/ja-jp/windows/win32/vss/excluding-files-from-shadow-copies

https://social.msdn.microsoft.com/Forums/windows/ja-JP/1717f21d-4007-4e1b-9b97-aa81b9dc1902/windows7-2391?forum=windowsgeneraldevelopmentissuesja

https://www.a-d.co.jp/support/g/data_erase/7.html

https://tech.nikkeibp.co.jp/it/article/COLUMN/20090414/328341/?P=1

http://www.ccleaner.com/

https://getdataforensics.com/product/forensic-explorer-fex/download/

file:///C:/Users/saton/Downloads/Forensic%20Explorer%20v5%20User%20Guide.en.pdf

https://github.com/log2timeline/plaso/releases

https://www.forensics-matters.com/2020/10/17/forensics-timeline-using-plaso-for-windows/

https://github.com/log2timeline/plaso/releases?page=2

log2timeline -h

log2timeline --parsers filestat <出力する中間ファイル名> <入力するイメージファイル名>

psort -h

psort –z  <タイムゾーン> -o  <出力形式>  -w <出力するファイル名> <入力する中間ファイル名> “抽出条件：例．期間指定”

https://atmarkit.itmedia.co.jp/ait/articles/1610/12/news001_2.html

https://maruton-memorandum.blogspot.com/2013/08/windowsftk-imagervmvmdk.html

https://qiita.com/sumeshi/items/8e2791a326d8dd505f74

https://superuser.com/questions/590968/quickest-way-to-merge-all-snapshots-in-virtualbox

https://ubiqlog.com/archives/11282

https://qiita.com/sasayabaku/items/aca8f94faadae5bd32c5

https://office54.net/iot/office365/outlook-mail-strage

https://www.nucleustechnologies.com/pst-viewer.html