Brendan Dolan-Gavitt Georgia Institute of Technology - SANS

More documents

Recommendations

Info

Printkey Example $ volatility printkey -f image.dd -o 0xe1035b60 Key name: $$$PROTO.HIV (Stable) Last updated: Mon Jul 4 18:16:59 2005 Subkeys: ControlSet001 (Stable) ControlSet002 (Stable) LastKnownGoodRecovery (Stable) MountedDevices (Stable) Select (Stable) Setup (Stable) WPA (Stable) CurrentControlSet (Volatile) Values: $ volatility printkey -f image.dd -o 0xe1035b60 CurrentControlSet Key name: CurrentControlSet (Volatile) Last updated: Mon Jul 4 18:16:59 2005 Subkeys: Volatile data! Values: REG_LINK SymbolicLinkValue : \Registry\Machine\System\ControlSet001 (Volatile)
VolReg: Hashdump • Local account password hashes are stored in the registry (encrypted) • Hashdump module decrypts and prints these hashes • If LanMan hash is in use, rainbow tables can recover password in minutes • Use this power for good :)
Page 1 and 2: Registry Analysis and Memory Forens
Page 3 and 4: Overview
Page 5 and 6: • Registry Analysis • Memory Fo
Page 7 and 8: • Registry Analysis • Memory Fo
Page 9 and 10: Windows Registry (cont.) • Regist
Page 11 and 12: Registry Forensics Tools • RegLoo
Page 13 and 14: Memory Forensics Tools • Memoryze
Page 15 and 16: Combining Registry and Memory Analy
Page 17 and 18: Solution: VolReg • Suite of plugi
Page 19 and 20: VolReg: Hivelist • Given one of t
Page 21: VolReg: Printkey • Given a hive a
Page 25 and 26: Others (not shown) • Cachedump: d
Page 27 and 28: Solution: VolRip • Python→Perl
Page 29 and 30: VolRip Example: Tracking USB Keys $
Page 31 and 32: Caveats • Since analysis is done
Page 33: ? Thanks! • To you all, for liste

Brendan Dolan-Gavitt Georgia Institute of Technology - SANS

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?