First Looks: Basic Investigations of Windows Vista

Lance Muellerlance.mueller@guidancesoftware.com

P A G E 2

Example Evidence File

Please start EnCase load the sample Windows Vista EnCase evidence file.

The Evidence file is located here:

C:\Evidence\Mueller

As we walk through the various changes and artifacts in Windows Vista, you are encouraged to examine these changes and explore the Vista evidence file.

Please feel free to ask questions or make comments, I have 45 slides to present in 90 minutes, so you do the math ;)

P A G E 3

Introduction

Windows Vista is the new Microsoft Operating System that was released to the public at the beginning of 2007

This section is designed to give an overview of the new feature and differences with previous versions of Windows from the forensic perspective.

There are many changes to the new Vista Operating System compared with Window XP or Windows 2000, many of them in the user interface.

This presentation will not cover trivial UI changes if it does not have a direct impact on how a forensic exam is conducted. This presentation does not describe every possible change that effects forensic examinations, but rather it covers the most commons areas an examiner will encounter and explains what effect a particular Vista feature may have on conducting a forensic examination.

P A G E 4

Agenda

File System Changes

NTFS Version & Structure

Volume Boot Record

Symbolic Links

Last Access Times

USNJRNL

P A G E 5

Agenda

Operating System Changes Vista Versions Directory Structure Changes Volume Shadow Service / Previous Version feature Registry Changes Virtualized Folders Recycle Bin Event Logs Windows Search Engine (Indexing) Public Folders Windows Photo Gallery Contact Manager Sleep Mode

P A G E 6

Agenda

Windows Mail

Windows Firewall

Thumbnail Cache

ReadyBoost

Accessing Physical Memory

Other Relevant changes

Bitlocker

P A G E 7

NTFS Version

NTFS Version OS Name OS Version Released Date

NTFS v 1.2 Windows NT3.51 3.51 July 1993

NTFS v 1.2 Windows NT4.0 4.0 August 1996

NTFS 3.0 Windows 2000 5.0 February 2000

NTFS 3.1 Windows XP 5.1 September 2001

NTFS 3.1 Windows 2003 5.2 April 2003

NTFS 3.1 Windows Vista 6.0 November 2006

P A G E 8

NTFS Version

P A G E 9

Volume Boot Record

Common location for VBR using a hard drive with 63SPT. (PS63)

New location of VBR in Vista (PS2048)

P A G E 10

Symbolic Links

Windows Vista now supports classic Unix-type Symbolic links. This is really an add-on feature to the already exiting reparse point feature of the NTFS file system. Reparse points were introduced in Windows 2000 and offered several unique features: Junctions – Allows a user to graft one folder in the file system tree onto another

folder Hard Link – Allows a user to create multiple links to the same data. For all

intent and purposes each link was the same as the original and impossible to tell which was the original.

Mount Points – Allows a user to graft a volume onto an existing folder. Symbolic Link (Vista only) – The new Vista Symbolic link feature is different

from a hard link as they can point to files & folders (Hard links can only point to files) as well as objects on other volumes or network shares.

A default installation of Windows Vista has several occurrences of symbolic links which we will examine in the Operating System changes section further in this presentation.

P A G E 11

Symbolic Links

P A G E 12

Last Access Dates

The last access dates in Windows Vista are no longer updated when a file is accessed. Microsoft explains that with all the new file system transactional journaling, it was somewhat of a performance hit, so they have disabled them by default.

In Windows Vista, this feature is enabled by default. This feature can be turned off via a registry key. This default setting obviously has a severe impact on how some types of cases are analyzed and examiners should take great care when using these date stamps as part of their analysis.

P A G E 13

$USNJRNL

The USN Journal is a NTFS logging mechanism that logs various transactions that occur on the file system. This feature is available in Windows 2000, Windows XP and Windows 2003, but it is disabled by default. In Windows Vista, this feature in enabled by default, thus causing a verbose log to be created of various file system changes. These changes are written to an internal NTFS metadata file named “$USNJRNL” and specifically into an alternate data stream of that file. Various artifacts such as filenames, date stamps an MFT record numbers can be located in this journal and it should be inspected and or searched in Unicode when looking for specific filenames.

P A G E 14

Operating System Versions

Feature availability of different Vista Versions:

BitLocker – Enterprise & Ultimate (Enterprise only when member of domain)

Windows Volume Shadow Service (VSS) – Business, Enterprise & Ultimate

Encrypting File System (EFS) - Business, Enterprise & Ultimate

Able to join domain - Business, Enterprise & Ultimate

Remote Desktop server - Business, Enterprise & Ultimate

Offline files and folder support - Business, Enterprise & Ultimate

IIS Web Server - Business, Enterprise & Ultimate

Vista Version 64bit Version XP Comparison Windows Vista Starter N XP Starter Windows Home Basic Y XP Home Windows Home Premium Y XP Home Windows Vista Business Y XP Professional Windows Vista Enterprise Y XP Professional Windows Vista Ultimate Y N/A

P A G E 15

Directory Structure Changes

Windows Vista has changed many of the common directories we are accustomed to looking at when doing a forensic analysis. The biggest change is where the user profiles are stored. In Windows 2000, XP & 2003, the Documents and Settings folder is where each users profile is stored along with all their personal documents. In Windows Vista, the new path of C:\Users is now used.

P A G E 16

Directory Structure Changes

In the previous figure you can see several Junctions are now used to redirect to a different location, such as Documents and Settings folder and the Default User folder.

C:\Documents & Settings ----------------> C:\Users (Junction)

C:\Users\All Users -------------------> C:\ProgramData (Symbolic Link)

C:\Users\Default Users --------------------> C:\Users\Default (Junction)

P A G E 17

Directory Structure Changes

Under each user folder, there are additional folders and Junction points.

P A G E 18

Directory Structure Changes

The following chart shows where each Junction shown in the previous figure points to:

<username>\Application Data-> \<username>\AppData\Roaming

<username>\Cookies->\<username>\AppData\Roaming\Microsoft\Windws\Cookies

<username>\Local Settings->\<username>\AppData\Local

<username>\My Documents->\<username>\Documents

<username>\NetHood->\<username>\AppData\Roaming\Microsof\Windows\Network Shortcuts

<username>\PrintHood->\<username>\AppData\Roaming\Microsof\Windows\Printer Shortcuts

<username>\Recent->\<username>\AppData\Roaming\Microsof\Windows\Recent

<username>\SendTo->\<username>\AppData\Roaming\Microsof\Windows\SendTo

<username>\Start Menu->\<username>\AppData\Roaming\Microsoft\Windows\Start Menu

<username>\Templates->\<username>\AppData\Roaming\Microsof\Windows\Templates

P A G E 19

Directory Structure Changes

Under the Documents folder there are three additional Junctions:

<username>\Documents\My Music-> \<username>\Music

<username>\Documents\My Picture-> \<username>\Pictures

<username>\Documents\My Videos-> \<username>\Videos

P A G E 20

In addition, the C:\Users\AppData\Local folder contains three additional Junctions. This folder structure is where the Internet history information is now stored.

P A G E 21

Public Folders In Windows XP, a folder named All Users was located under the Documents &

Settings folder which served as a structure that was accessible by all users. In Vista, this has been changed and is called ”Public”. Any files or folders located under the “public” folder are accessible by everyone. Note that the structure in a live machine is different that what is seen from a forensic view.

P A G E 22

Volume Shadow Service / Previous Version

The Volume Shadow Service was first introduced in Windows XP in a limited way and then further enhanced in Windows 2003 Server and its goal was to create copies of important files that could then be safely backed up without having file locking issues. It was off by default and only a limited number of files or directories could be shadowed in Windows 2003.

P A G E 23

Volume Shadow Service / Previous Version

The block level changes that are saved by the “previous version” feature are stored in the System Volume Information folder as part of a restore point. This data is not encrypted (absent bitlocker) and can be easily searched using the EnCase search feature. In the root of the “System Volume Information” folder, several files can be seen with GUIDs as the filename.

P A G E 24

Registry

Several new registry files have been added to Windows Vista. The following list represents all the registry hives on a default Vista system: C:\Boot\BCD C:\Windows\System32\config\RegBack\SECURITY C:\Windows\System32\config\RegBack\SOFTWARE C:\Windows\System32\config\RegBack\DEFAULT C:\Windows\System32\config\RegBack\SAM C:\Windows\System32\config\RegBack\COMPONENTS C:\Windows\System32\config\RegBack\SYSTEM C:\Windows\System32\config\BCD-Template C:\Windows\System32\config\COMPONENTS C:\Windows\System32\config\DEFAULT C:\Windows\System32\config\SAM C:\Windows\System32\config\SECURITY C:\Windows\System32\config\SOFTWARE C:\Windows\System32\config\SYSTEM C:\Windows\winsxs\x86_microsoft-windows-b..-bcdtemplate-

client_31bf3856ad364e35_6.0.6000.16386_none_25edb26a062d63a9\BCD-Template

P A G E 25

Registry

The user’s NTUSER.DAT file is still located in the root of the user’s root folder (C:\Users\<username>).

Notice that Windows Vista now uses the “REGBACK” folder instead of the “REPAIR” folder that Windows 2000/XP/2003 use for backup copies of the registry.

P A G E 26

Registry virtualization

Windows Vista now contains a feature called “registry virtualization” as part of a security enhancement. This feature ensures that users who are not administrators cannot write t certain parts of the registry, especially during software installation. If a program tries to write to a specific registry key that is protected, the installation program will be seamlessly redirected to a “virtual” registry key contained within the user’s personal registry hive (NTUSER.DAT).

Any write attempt by a non administrator to the: HKEY_LOCAL_MACHINE\Software registry key(s) causes the system to redirect the write into a virtual store in the user’s profile:

HKEY_USERS\<User SID>_Classes\VirtualStore\Machine\Software

P A G E 27

Virtual Folders

Virtualized folders works in the same manner as registry virtualization and prevents non administrators from writing or creating certain files/folders in system protected areas. When a normal user (non-administrator) tries to create or write to files in system areas (\windows, \Program Files, etc), the write operation is redirected to a different location even though it appears as though the file was created in the system folder. The written data is actually stored in a folder under the user’s profile:

C:\Users\<username>\AppData\Local\VirtualStore\

The data written here is seamlessly overlaid into the folder where it was originally thought to be written to.

P A G E 28

RECYCLE BIN

The contents of the recycle bin has changed in Windows Vista and the name of the folder itself has changed to”$Recycle.bin”.

The INFO2 file that is present in Windows 2000/XP/2003 has been removed.

In Windows Vista, two files are created when a file is deleted into the recycle bin. Both file have the same random looking name, but the names are proceeded with a “$R” or “$I”. The file with the “$R” at the beginning of the name is actually the data of the deleted file. The file with the “$I” at the beginning of the name contains the path of where the file originally resided, as well as the date and time it was deleted.

P A G E 29

RECYCLE BIN

P A G E 30

RECYCLE BIN

In addition, it is important to note that the user’s recycle bin is created the first time the user logs into their account, not the first time a file/folder is deleted as in Windows 2000/XP/2003.

P A G E 31

Event Logs

The Windows event logs have changed dramatically in Windows Vista. A new XML fie format is being used for the event logs and a new extension of “EVTX” is now used. The files are now located in:

“C:\Windows\System32\winevt\Logs\”

There are now approximately 30 different event logs that Windows Vista reports events to. Currently these logs can only be read by the native Windows Vista Event Viewer (eventvwr), although an EnCase EnScript is under development.

P A G E 32

Windows Search Engine (Indexing)

Windows Vista includes a new search engine and indexing feature. Indexing has been available since Windows 2000, but it was off by default. In Windows Vista, it is enabled by default.

The new search feature is accessible from the Start Menu or any Windows Explorer window.

P A G E 33

Windows Search Engine (Indexing)

Users can now save their searches and review the results in real-time as the search results are updated as new files are added to the system. Saved searches are placed under the user’s profile: C:\Users\<username>\Searches

The indexing service is used to quickly locate files by indexing the file’s metadata and contents (some filetypes). Microsoft Mail is included in the types of data that is indexed and available for searches.

These indexes are located in the following location: “C:\ProgramData\Microsoft\Search\Data\Appliations\Windows\Projects\

systemIndex\Indexer\CiFiles”

Vista maintains several index files in this directory and these can be searched for keywords using the keyword search feature in EnCase.

P A G E 34

Windows Photo Gallery The Windows Photo Galley is an

application that is designed to make it easy to collect, categorize and edit your digital photos and videos. The Windows Photo Gallery can connect directly to digital devices such as cameras or removable media and then import the photos into the gallery. The photos that are imported into the gallery are stored into the user’s “Pictures” directory under their profile.

P A G E 35

Contact Manager

The new Windows Vista contact manager is an address book replacement and designed to contain commonly used contacts via email or phone. These contacts are XML files that are stored in a directory under the user’s profile, named “Contacts”.

P A G E 36

Sleep Mode

Sleep mode is a new feature in Windows Vista that allows quick booting and shutdown by keeping information in contents of memory using very low power consumption. The “Hibernate” and “Stand-by” modes used in Windows XP/2003 are no longer available and now only the Sleep mode is available. Sleep mode does not use the traditional Hiberfil.sys file and does not create any on-disk memory artifact.

P A G E 37

Windows Mail

Windows Mail is the Outlook Express replacement and it has been completely overhauled.

P A G E 38

Windows Mail

Mail is no longer stored in a DBX volume and it is instead stored in simple plain text EML files. The mail is stored under the user’s profile in the following location:

C:\Users\<username>\AppData\Local\Microsoft\WindowsMail\Local Folders\

P A G E 39

Windows Mail

One thing to note is that Windows Mail now has the ability to use encryption and digital signatures. Free secure email certificates are available for download and can be used to encrypt email messages. Email messages that are sent with the encryption flag set are encrypted before being placed in the outbox, so an examiner may find an email message in the Outbox where the body is encrypted and unreadable. The message headers though would be in plaintext.

P A G E 40

Windows Firewall

The windows firewall has been enhanced to no filter incoming and outgoing network connections. From a forensic perspective one of the most important elements of the firewall is the logging mechanism. The log is disabled by default, but if enabled, the logs are written to:

“C:\windows\system32\LogFiles\Firewall\pfirewall.log”

P A G E 41

Windows Firewall

Firewall exceptions are stored in the SYSTEM registry. If a user or program creates an exception to allow a certain port to be open or allow certain outbound connections, these rules are stored here:

C:\Windows\System32\config\SYSTEM\NTRegistry\CMI-CreateHive{C619BFE8-791A-4B77-922B-F114AB570920}\ControlSet001\Services\SharedAccess\ Parameters\FirewallPolicy\FirewallRules\

P A G E 42

Thumbnail cache

The thumbnail cache that is used in Windows XP/2003, named THUMBS.DB has been replaced with a centralized thumbs database named either “thumbcache_32.db”, “thumbcache_96.db” “thumbcache_256.db” or “thumbcache_1024.db”. These centralized caches now hold all thumbnails on the system, depending on their size. These caches are located in the directory of:

“C:\Users\student\AppData\Local\Microsoft\Windows\Explorer”

P A G E 43

ReadyBoost

ReadyBoost is a Microsoft feature which allows a user to add virtual memory by using a removable flash drive. This memory is then cached and used as an extension to installed physical memory. Flash memory is much faster than paging data to the pagefile on a hard disk and therefore his feature is a cheap alternative to adding memory to a system.

Data that is written to the removable flash disk is encrypted using AES-128 encryption before being written to the flash disk. Therefore an examiner who recovers a flash disk used for ReadyBoost will not be able to decipher the data.

P A G E 44

Accessing Physical Memory

Accessing physical memory using DD is a common way of collecting volatile data (contents of RAM) before a system is shutdown and/or imaged. This procedure works in Windows 2000 & Windows XP, but does not in Windows 2003 & Windows Vista. This is because the \\.\PhysicalMemory Pipe is not accessible even from an administrator account. Therefore it is currently not possible to collect physical memory using the standard version of win32 DD.EXE.

P A G E 45

Bitlocker

Bitlocker is an enterprise class encryption utility that allows full drive encryption. The Bitlocker feature is only available in the Enterprise & Ultimate editions (Enterprise only when member of domain).

P A G E 46