±Partners and Sponsors

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 13
Overall: 26959
Visitors: 61

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Shellbag analysis

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2, 3, 4  Next 
  

Shellbag analysis

Post Posted: Thu Jan 10, 2013 8:18 am

Is anyone including shellbag artifacts in their analysis of Windows systems?

If so, what tool(s) are you using?

How are you analyzing/including/interpreting the DOSDate time stamps?

Thanks.  

keydet89
Senior Member
 
 
  

Re: Shellbag analysis

Post Posted: Thu Jan 10, 2013 10:31 am

Yes.

Regripper and TZWorks sbag.

Using the steps under Timestamp Verification on TZWorks site.  

BitHead
Senior Member
 
 
  

Re: Shellbag analysis

Post Posted: Thu Jan 10, 2013 11:10 am

- BitHead

Regripper and TZWorks sbag.


Over the lists/sites that I've posted this question to, you're the first one to mention RegRipper.

Have you had any issues with regards to validation of either tool, or between the two?

- BitHead

Using the steps under Timestamp Verification on TZWorks site.


That's great for verification. How are you incorporating those values into your analysis?

Thanks.  

keydet89
Senior Member
 
 
  

Re: Shellbag analysis

Post Posted: Mon Jan 14, 2013 4:10 am

I'm using following tools:
- TZWorks sbag
- RegRipper
- MiTeC Windows Registry Analyzer v1.5.2 (ShellBags + StreamMRUs)
- Nir Sorfer's ShellBagsView
and excellent EnPack, 42 LLC Bag Parser, by Yogesh Khatri (ShellBags + StreamMRUs)

My tools of choice are TZWorks sbag + 42LLC Bag Parser. I do like 42LLC Bag Parser for its ability to parse all relevant registry hive files in a single pass (located in all users' profiles, System Restore and so on), very detailed report and nice, Explorer-like form of presenting results (you can also export the results into Excel file for further processing, e.g. to compare and cross-verify with sbag results or to follow manual verification according to TZWorks).

Greg  

gmkk
Member
 
 
  

Re: Shellbag analysis

Post Posted: Mon Jan 14, 2013 7:01 am

Greg,

Thanks.

How are you analyzing/including/interpreting the DOSDate time stamps?

Also, do you have any thoughts on the output of TZWorks sbag.exe vs. the RegRipper plugin?

Thanks.  

keydet89
Senior Member
 
 
  

Re: Shellbag analysis

Post Posted: Tue Jan 15, 2013 6:38 am

I'm using Mitec, TZWorks but not RR so much. TZ is my tool of the moment. I've been a shellbag addict since 2005 - never really understood why everyone doesn't do it on every job.

I like the CSV output from TZWorks.

I hadn't heard of the ENpack that Greg mentions but I'll be hunting it down.  

BenUK
Member
 
 
  

Re: Shellbag analysis

Post Posted: Tue Jan 15, 2013 7:02 am

Ben,

Thanks.

How are you analyzing/including/interpreting the DOSDate time stamps?

Also, what have you done to validate the TZWorks tool?  

keydet89
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 4
Go to page 1, 2, 3, 4  Next