TOR FORENSICS ON WINDOWS OS

Management salaries of a big private company were published on a Blog Through a traditional analysis of the internal network, the company found a suspect:

He accessed the Excel file containing the salaries by connecting from his desktop to his manager’s computer through Terminal Server He saved the file on a pen drive Company denounced the employee and Police seized his personal laptop at home .We started from there to find other interesting artifacts… 

TOR is system to browse the Internet Anonymously.

The tools to surf the Internet through TOR are: 

Tor Browser Bundle 

Windows/Mac/Linux 

Can be executed by unzipping it on the hard drive or on an external device (e.g. USB Pen Drive) 

Live CD/USB Tails 

Orbot (Android App) 

Tools available at https://torproject.org

Tor Browser Folder:

The most interesting folders are:

  \Data\Tor

\Data\Browser

Folder Data\Tor 

 State: it contains the last execution date

Torrc: it contains the path from where the Tor Browser was launched with the drive letter

FOLDER \DATA\BROWSER

It is the traditional Firefox folder containing the user profile, but without usage traces 

The Most Interesting Files are Compatibility.ini and Extension.ini and contain the browser execution path

OS ARTIFACTS ANALYSIS

Evidence of TOR usage can be found (mainly) in: 

Prefetch file TORBROWSER INSTALL-<VERSION>-<PATH-HASH>.pf 

Prefetch file TOR.EXE-<PATH-HASH>.pf 

Prefetch file START TOR BROWSER.EXE-<PATH-HASH>.pf 

NTUSER.DAT registry hive à User Assist key 

PREFETCH FILES

We can recover:

Install date 

First execution date 

Last execution date 

Number of executions

USER ASSIST

OTHER ARTIFACTS ON THE HARD DRIVE (PAPER)

In Runa Sandvik paper other files are noted: 

USRCLASS.DAT registry file 

Windows Search Database 

BOOKCKCL.ETL

We can recover information about Prefetch file created by the OS. It is useful because you can identify that the Tor Browser was used also if the Prefetch files were deleted. 

Strings are saved in UNICODE 

Hear you Can find the visited Website and url. 

Search for the keyword HTTP-memory- only-PB

A function used by Mozilla Firefox for Private Browsing (not saving cache data on the hard drive). Tor Browser uses the Private Browsing feature of Mozilla Firefox But Tor Browser typically uses an old Firefox version To distinguish if the browsing activity was made with Mozilla Firefox or with Tor Browser.Check if Firefox is installed .If it is installed, verify the actual version

ANALYSIS METHODOLOGY

REAL CASE

By analyzing the laptop we found evidence of Excel file opening from the same pen drive on personal laptop. 

But no traces were found in browsing history about the publishing activity on the blog… 

We indexed the entire hard drive and searched for the blog URL 

We found some interesting URLs in the page file, indicating the access to the Blog Admin page 

The URLs were always preceded by the string HTTP-MEMORY-ONLY-PB 

We found that the TOR Browser was downloaded with Google Chrome the night in which the file was published on the blog 

By analyzing the OS artifacts we found that it was installed and only executed once…10 minutes before the publish date and time on the blog! 

E-Mail Forensic Tools And Technique

E-mail forensics refers to the study of source and content of e-mail as evidence to identify the

actual sender and recipient of a message, data/time of transmission, detailed record of e-mail transaction, intent of the sender, etc. This study involves investigation of metadata, keyword searching, port scanning, etc. for authorship attribution and identification of e-mail scams.

Various approaches that are used for e-mail forensic are described and are briefly defined below:

1.1. Header Analysis

Meta data in the e-mail message in the form of control information i.e. envelope and headers

including headers in the message body contain information about the sender and/or the path along which the message has traversed. Some of these may be spoofed to conceal the identity of the sender. A detailed analysis of these headers and their correlation is performed in header analysis.

1.2. Bait Tactics In bait tactic investigation an e-mail with http: “<img src>” tag having image source at some computer monitored by the investigators is send to the sender of e-mail under investigation containing real (genuine) e-mail address. When the e-mail is opened, a log entry containing the IP address of the recipient (sender of the e-mail under investigation) is recorded on the http server hosting the image and thus sender is tracked. However, if the recipient (sender of the e-mail under investigation) is using a proxy server then IP address of the proxy server is recorded. The log on proxy server can be used to track the sender of the e-mail under investigation. If the proxy server’s log is unavailable due to some reason, the n investigators may send the tactic e-mail containing a) Embedded Java Applet that runs on receiver’s computer or b) HTML page with Active X Object. Both aiming to extract IP address of the receiver’s computer and e-mail it to the investigators.

1.3. Server Investigation

In this investigation, copies of delivered e-mails and server logs are investigated to identify source of an e-mail message. E-mails purged from the clients(senders or receivers) whose recovery is impossible may be requested from servers (Proxy or ISP)as most of them store a copy of all e-mails after their deliveries. Further, logs maintained by servers can be studied to trace the address of the computer responsible for making the e-mail transaction. However, servers store the copies of e-mail and server logs only for some limited periods and some may not co-operate with the investigators. Further, SMTP servers whichstore data like credit card number and other data pertaining to owner of a mailbox can be usedto identify person behind an e-mail address.

1.4. Network Device Investigation

In this form of e-mail investigation, logs maintained by the network devices such as routers,

firewalls and switches are used to investigate the source of an e-mail message. This form of investigation is complex and is used only when the logs of servers (Proxy or ISP) are unavailable due to some reason, e.g. when ISP or proxy does not maintain a log or lack of co-operation by ISP’s or failure to maintain chain of evidence.

1.5. Software Embedded Identifiers

Some information about the creator of e-mail, attached files or documents may be included with 

the message by the e-mail software used by the sender for composing e-mail. This information may be included in the form of custom headers or in the form of MIME content as a Transport Neutral Encapsulation Format (TNEF). Investigating the e-mail for these details may reveal some vital information about the senders e-mail preferences and options that could help client side evidence gathering. The investigation can reveal PST filenames, Windows logon username, MAC address, etc. of the client computer used to send e-mail message.

1.6. Sender Mailer Fingerprints

Identification of software handling e-mail at server can be revealed from the Received header field and identification of software handling e-mail at client can be ascertained by using different set of headers like “X-Mailer” or equivalent. These headers describe applications and their versions used at the clients to send e-mail. This information about the client computer of the sender can be used to help investigators devise an effective plan and thus prove to be very useful.

2. E-MAIL FORENSIC TOOLS

There are many tools which may assist in the study of source and content of e-mail message so

that an attack or the malicious intent of the intrusions may be investigated. These tools while 

providing easy to use browser format, automated reports, and other features, help to identify the origin and destination of the message, trace the path traversed by the message; identify spam and phishing networks, etc. This section introduces some of these tools.

2.1. eMailTrackerPro

eMailTrackerPro analyses the headers of an e-mail to detect the IP address of the machine that sent the message so that the sender can be tracked down. It can trace multiple e-mails at the same time and easily keep track of them. The geographical location of an IP address is key information for determining the threat level or validity of an e-mail message. This tool can pin point the city that the e-mail most likely came from. It identifies the network provider (or ISP) of the sender and provide contact information for further investigation. The actual path to the sender's IP address is reported in a routing table, providing additional location information to 

help determine the sender's true location. The abuse reporting feature in it can be used to make further investigation easier. It checks the mail against DNS blacklists such as Spamcop to further safeguard against spam and malicious emails. It supports Japanese, Russian and Chinese 

language spam filters besides English language. A major feature of this tool is abuse reporting that can create a report that can be sent to the ISP of sender. The ISP can then takes steps to prosecuting the account holder and help put a stop to spam. 

2.2. EmailTracer

EmailTracer is an Indian effort in cyber forensics by the Resource Centre for Cyber Forensics (RCCF) which is a premier centre for cyber forensics in India. It develops cyber forensic tools based on the requirements of law enforcement agencies. Among several other digital forensic tools, it has developed an e-mail tracer tool named EmailTracer. This tool traces the originating IP address and other details from e-mail header, generates detailed HTML report of email header analysis, finds the city level details of the sender, plots route traced by the mail and display the originating geographic location of the e-mail. Besides these, it has keyword searching facility on e-mail content including attachment for its classification. 

2.3. Adcomplain

Adcomplain [10] is a tool for reporting inappropriate commercial e-mail and usenet postings, as well as chain letters and "make money fast" postings. Itautomatically analyses the message, composes an abuse report, and mails the report to the offender's internet service provider by

performing a valid header analysis. The report is displayed for approval prior to mailing to U.S. Federal Trade Commission. Adcomplain can be invoked from the command line or automatically from many news and mail readers.

2.4. Aid4Mail Forensic

Aid4Mail Forensic is e-mail investigation software for forensic analysis, e-discovery, and litigation support. It is an e-mail migration and conversion tool,which supports various mail

formats including Outlook (PST, MSG files), Windows Live Mail,Thunderbird, Eudora, and mbox. It can search mail by date, header content, and by message body content. Mail folders and files can be processed even when disconnected (unmounted) from their email client including those stored on CD, DVD, and USB drives. Aid4Mail Forensic can search PST files and all supported mail formats, by date range and by keywords in the message body or in the headers. Special Boolean operations are supported. It is able to process unpurged (deleted) e-mail from mbox files and can restore unpurged e-mail during exportation.

2.5. AbusePipe

AbusePipe analyses abuse complaint e-mails and determines which of ESP’s customers is sending spam based on the information in e-mailed complaints. It automatically generates reports reporting customers violating ESP’s acceptable user policy so that action to shut them down can be taken immediately. AbusePipe can be configured to automatically reply to people reporting abuse. It can assist in meeting legal obligations such as reporting on the customers connected to a given IP address at a given date and time.

2.6. AccessData’s FTK

AccessData’s FTK [13] is standard court-validated digital investigations platform computer forensics software delivering computer forensic analysis, decryption and password cracking within an intuitive and customizable interface. It hasspeed, analytics and enterprise-class scalability. It is known for its intuitive interface, e-mail analysis, customizable data views and stability. It supports popular encryption technologies, such as Credant, SafeBoot, Utimaco, EFS, PGP, Guardian Edge, Sophos Enterprise and S/MIME. Its current supported e-mail types are: Lotus Notes NSF, Outlook PST/OST, Exchange EDB, Outlook Express DBX, Eudora, EML (Microsoft Internet Mail, Earthlink, Thunderbird, Quickmail, etc.), Netscape, AOL and RFC 833.

2.7. EnCase Forensic

EnCase Forensic is computer forensic application that provides investigators the ability to image a drive and preserve it in a forensic manner using the EnCase evidence file format (LEF or E01), a digital evidence container vetted by courts worldwide. It contains a full suite of analysis, bookmarking and reporting features. Guidance Software and third party vendors provide support for expanded capabilities to ensure that forensic examiners have the most comprehensive set of utilities. Including many other network forensics investigations, it also supports Internet and e-mail investigation. It included Instant Messenger toolkit for Microsoft Internet Explorer, Mozilla Firefox, Opera and Apple Safari. The e-mail support includes for Outlook PSTs/OSTs, Outlook Express DBXs, Microsoft Exchange EDBParser, Lotus Notes, AOL, Yahoo, Hotmail, Netscape Mail and MBOX archives.

2.8. FINALeMAIL

FINALeMAIL can recover the e-mail database file and locates lost e-mails that do not have data location information associated with them. FINALeMAIL has the capability of restoring lost e-mails to their original state, recover full e-mail database files even when such files are attacked by viruses or damaged by accidental formatting. It can recover E- mail messages and attachments emptied from the ‘Deleted Items folder’ in Microsoft Outlook Express, Netscape Mail, and Eudora.

2.9. Sawmill-GroupWise

Sawmill-GroupWise is a GroupWise Post Office Agent log analyser which can process log files in GroupWise Post Office Agent format, and generate dynamic statistics from them, analysing and reporting events. It can parse these logs, import them into a MySQL, Microsoft SQL Server, or Oracle database (or its own built-in database), aggregate them, and generate dynamically filtered reports, through a web interface. It supports Window, Linux, FreeBSD, OpenBSD, Mac OS, Solaris, other UNIX, and several other platforms. 

2.10. Forensics Investigation Toolkit (FIT)

Forensics Investigation Toolkit (FIT) is content forensics toolkit to read and analyse the content of the Internet raw data in Packet CAPture (PCAP) format.FIT provides security administrative officers, auditors, fraud and forensics investigators well as lawful enforcement officers the power to perform content analysis and reconstruction on pre-captured Internet raw data from wired or wireless networks. All protocols and services analysed and reconstructed are displayed in readable format to the users. The other uniqueness of the FIT is that the imported raw data files can be immediately parsed and reconstructed. It supports case management functions, detailed information including Date-Time, Source IP,Destination IP, Source MAC, etc., WhoIS and Google Map integration functions. Analysing and reconstruction of various Internet traffic types which includes e-mail (POP3, SMTP, IMAP),Webmail (Read and Sent), IM or Chat (MSN, ICQ, Yahoo, QQ, Skype Voice Call Log, UT ChatRoom, Gtalk, IRC Chat Room), File Transfer (FTP, P2P), Telnet, HTTP (Content, Upload/Download, Video Streaming,

Request) and Others (SSL) can be performed using this toolkit.

2.11. Paraben (Network) E-mail Examiner Paraben (Network) E-mail Examiner has comprehensive analysis features, easy bookmarking and reporting, advanced Boolean searching, searching within attachments, and full  UNICODE language support. It supports America On-line (AOL),Microsoft Outlook (PST,OST), Thunderbird, Outlook Express, Eudora, E-mail file (EML),Windows mail databases and more than 750 MIME Types and related file extensions. It can recover deleted e-mails fromOutlook (PST), Thunderbird, etc. Network E-mail Examiner [http://www.paraben.com/network-email-examiner.html], can thoroughly examine Microsoft Exchange (EDB), Lotus Notes (NSF), and GroupWise e-mail stores. It works with E-mailExaminer and all output is compatible and can easily be loaded for more complex tasks.

According to Simson L. Garfinkel current forensic tools are designed to help examiners in finding specific pieces of evidence and are not assisting in investigations. Further, these tools were created for solving crimes committed against people where the evidence resides on a computer; they were not created to assist in solving typical crimes committed with computers oragainst computers. Current tools must be re-imagined to facilitate investigation and exploration.This is especially important when the tools are used outside of the law enforcement context for activities such as cyber-defense and intelligence. Construction of a modular forensic processing framework for digital forensics that implements the “Visibility, Filter and Report” model would be the first logical step in this direction

Hacking Open Source Tools

Nmap (Network Mapper)

Used to Scan Ports and Map Networks - and a whole bunch more!

Cost of Tool: Free

Nmap is an abbreviation of ‘Network Mapper’, and it’s very well known free open source hackers tool. Nmap is mainly used for network discovery and security auditing.

Literally, thousands of system admins all around the world will use nmap for network inventory, check for open ports, manage service upgrade schedules, and monitor host or service uptime.

Nmap, as a tool uses raw IP packets in creative ways to determine what hosts are available on the network, what services (application name and version) those hosts are providing information about, what operating systems (fingerprinting) and what type and version of packet filters/ firewalls are being used by the target.

There are dozens of benefits of using nmap, one of which is that fact that the admin user is able to determine whether the network (and associated nodes) need patching.

Nmap’s been featured in literally every hacker movie out there, not least the recent Mr. Robot series.

It’s also worth mentioning that there’s a GUI version of Nmap called ‘Zenmap’. We’d advise you to learn using Nmap (i.e. the ‘command line’) then rotate into Zenmap when you are feeling all confident.

Metasploit Penetration Testing Software

Vulnerability Exploitation Tool

Cost of Tool: Free & Paid

The Metasploit Project is a hugely popular pentesting or hacking framework.

Metasploit, along with nmap (see above) and Wireshark (see below) and probably the ‘best known’ three hacker software tools out there.

If you are new to Metasploit think of it as a ‘collection of hacking tools and frameworks’ that can be used to execute various tasks. Also – we should also add that if you have never heard of Metasploit and are interested in getting into the Cybersecurity Industry, especially as a Penetration Tester, then this is a ‘must-learn’ tool.Most practical IT Security courses such as OSCP and CEH include a Metasploit component.

Widely used by cybersecurity professionals and penetration testers this is an awesome piece of software that you really out to learn.

Metasploit is essentially a computer security project (framework) that provides the user with vital information regarding known security vulnerabilities and helps to formulate penetration testing and IDS testing plans, strategies and methodologies for exploitation.

There’s a ton of incredibly useful Metasploit information out there and we hope that the books that we’ve chosen go someway to help you on your journey, not least if you are a beginner just starting out and looking for beginners tutorials in how to use Metasploit.

John The Ripper

Password Cracking Tool

Cost of Tool: Free

Quite frankly – this is the coolest named tool out there: John the Ripper.

Often you’ll see it abbreviated as ‘JTR’ this is an awesome bit of hacking software that is designed to crack even very complicated passwords.

John the Ripper, mostly just referred to as simply, ‘John’ is a popular password cracking pentesting tool that is most commonly used to perform dictionary attacks. John the Ripper takes text string samples (from a text file, referred to as a ‘wordlist’, containing popular and complex words found in a dictionary or real passwords cracked before), encrypting it in the same way as the password being cracked (including both the encryption algorithm and key), and comparing the output to the encrypted string. This tool can also be used to perform a variety of alterations to dictionary attacks.

If you are somewhat confused between John the Ripper and THC Hydra then think of John the Ripper as an ‘offline’ password cracker whilst THC Hydra is an “online” cracker. Simple.

THC Hydra
Password Cracking Tool

Cost of Tool: Free

We’ve purposely placed THC Hydra underneath John The Ripper because they often go ‘hand-in’hand’. THC Hydra (we’ve abbreviated to simply ‘Hydra’ throughout our site) is a hugely popular password cracker and has a very active and experienced development team. Essentially THC Hydra is a fast and stable Network Login Hacking Tool that will use dictionary or brute-force attacks to try various password and login combinations against an log in page. This hacking tool supports a wide set of protocols including Mail (POP3, IMAP, etc.), Databases, LDAP, SMB, VNC, and SSH. Take a look at John the Ripper as well.

OWASP Zap

Web Vulnerability Scanner

Cost of Tool: Free

The Zed Attack Proxy (ZAP) is now one of the most popular OWASP projects. The fact that you’ve reached this page means that you are likely already a relatively seasoned cyber security professional so it’s highly likely that you are very familiar with OWASP, not least the OWASP Top Ten Threats listing which is considered as being the ‘guide-book’ of web application security. This hacking and pen testing tool is a very efficient as well as being an ‘easy to use’ program that finds vulnerabilities in web applications. ZAP is a popular tool because it does have a lot of support and the OWASP community is really an excellent resource for those that work within Cyber Security. ZAP provides automated scanners as well as various tools that allow you the cyber pro to discover security vulnerabilities manually. Understanding and being able to master this tool would also be advantageous to your career as a penetration tester. If you are a developer then you have it’s obviously highly recommended that you learn how to become very proficient with this ‘hacker tool!’

Wireshark

Web Vulnerability Scanners

Cost of Tool: Free

Wireshark is a very popular pentesting tool and for over a year it was not included on our list, however, by popular demand we added it in late June 2016. Wireshark essentially captures data packets in a network in real time and then displays the data in human-readable format (verbose). The tool (platform) has been highly developed and it includes filters, color-coding and other features that lets the user dig deep into network traffic and inspect individual packets. If you’d like to become a penetration tester or work as a Cyber Security practioner, then learning how to use Wireshark is a must. There are a ton of resources out there to learn Wireshark, and, of particular interest, there’s also a Wireshark Certification which you can achieve and place on your LinkedIn profile.

Aircrack-ng

Password Cracking Tool

Cost of Tool: Free 

The Aircrack suite of Wifi (Wireless) hacking tools are legendary because they are very effectively when used in the right hands. For those new to this wireless-specific hacking program, Aircrack-ng is an 802.11 WEP and WPA-PSK keys cracking hacking tool that can recover keys when sufficient data packets have been captured (in monitor mode). For those tasked with penetrating and auditing wireless networks Aircrack-ng will become your best friend. It’s useful to know that Aircrack-ng implements standard FMS attacks along with some optimizations like KoreK attacks, as well as the PTW attacks to make their attacks more potent. If you are a mediocre hacker then youll be able to crack WEP in a few minutes and you ought to be pretty proficient at being able to crack WPA/ WPA2. For those interested in Wireless Hacking we’d also highly recommend taking a look at the very awesome Reaver, another very popular hacking tool that alas we couldn’t add to our list.

Maltego

Digital Forensics

Cost of Tool: Free & Paid

Maltego is different in that it works within a digital forensics sphere. Maltego is a platform that was designed to deliver an overall cyber threat picture to the enterprise or local environment in which an organization operates. One of the awesome things about Maltego which likely makes it so popular (and included in the Kali Linux Top Ten) is its’s unique perspective in offering both network and resource based entities is the aggregation of information sourced throughout the web – whether it’s the current configuration of a vulnerable router within a network or the current whereabouts of your staff members on their international visits, Maltego can locate, aggregate and visualize this data! For those interested in learning how to use Maltego we’d also recommend learning about OSINT cyber security data procurement.

Cain and Abel Hacking Tool

Password Cracker/ Password Hacking

Cost of Tool: Free

Cain and Abel (often simply abbreviated to Cain) is a hugely popular hacking tool and one that is very often mentioned online in a variety of ‘hacking tutorials’. At its’ heart, Cain and Abel is a password recovery tool for Microsoft Windows but it can be used off-label in a variety of uses, for example, white and black hat hackers use Cain to recover (i.e. ‘crack’) many types of passwords using methods such as network packet sniffing and by using the tool to crack password hashes. Cain, for example, when used to crack password hashes would use methods such as dictionary attacks, brute force, rainbow table attacks and crypt analysis attacks.

Nikto Website Vulnerability Scanner

Website Vulnerability Scanner Hacking Tool

Cost of Tool: Free

Nikto is another classic ‘Hacking Tool’ that a lot of pen testers like to use. Worth mentioning that Nickto is sponsored by Netsparker (which is yet another Hacking Tool that we have also listed in our directory). Nikto is an Open Source (GPL) web server scanner which is able to scan and detect web servers for vulnerabilities. The system searches against a database of over 6800 potentially dangerous files/ programs when scanning software stacks. Nikto, like other scanners out there, also scans for outdated (unpatched) versions of over 1300 servers, and version specific problems on over 275 servers. Interestingly, Nikto can also check server configuration items such as the presence of multiple index files, HTTP server options, and the platform will also try to identify installed web servers and web applications. Nikto will get picked up by any semi-decent IDS tool so its’ really useful when conducting a white-hat/ white-box pen test. Certainly a great tool to learn your skills on when attacking an open box for training.