±Partners and Sponsors

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 6
New Yesterday: 8
Overall: 26814
Visitors: 56

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Ares search term decoder for FTK registry report

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

Ares search term decoder for FTK registry report

Post Posted: Tue Feb 12, 2013 4:35 pm

if anyone ever needs such a beast i just whipped up a converter for it.

it will take the registry report in HTML format, decode the search terms from hex to ascii, and add the decoded term next to the original.

some examples:

7A6F6F ==> zoo

70746863 ==> pthc


and so on

if you have a case where you have a ton of search terms to decode this can save you a ton of time.

hit me up via email or PM if anyone is interested in it.  

EricZimmerman
Senior Member
 
 
  

Re: Ares search term decoder for FTK registry report

Post Posted: Wed Feb 13, 2013 8:17 am

Not to take away from what you said.

I use Ares Decryptor from Frank Kolenbrander (carbonaria@gmail.com). Good guy, good progam, so I try to get it out there as much as possible. It will decode the share*.dat files to show current and historically shared files. It decodes the registry as well.

Worth 60 bucks if you do Ares periodically.  

twjolson
Senior Member
 
 
  

Re: Ares search term decoder for FTK registry report

Post Posted: Wed Feb 13, 2013 8:44 am

I may be displaying ignorance here - but what the heck is Ares?

Cheers  

Cults14
Senior Member
 
 
  

Re: Ares search term decoder for FTK registry report

Post Posted: Wed Feb 13, 2013 8:55 am

- Cults14
I may be displaying ignorance here - but what the heck is Ares?

Cheers


It's a P2P app - http://aresgalaxy.sourceforge.net/.
_________________
dfstream.blogspot.com 

ntexaminer
Member
 
 
  

Re: Ares search term decoder for FTK registry report

Post Posted: Wed Feb 13, 2013 8:57 am

Thanks ntexaminer, have never come across it in my limited corporate internal work  

Cults14
Senior Member
 
 
  

Re: Ares search term decoder for FTK registry report

Post Posted: Wed Feb 13, 2013 9:51 am

- EricZimmerman
if anyone ever needs such a beast i just whipped up a converter for it.


Great work, Eric.

There's an "ares.pl" plugin for RegRipper, which does just that. The plugin was originally written in May, 2011, and was updated shortly there after to add collecting additional info.

Thanks for your work.  

keydet89
Senior Member
 
 
  

Re: Ares search term decoder for FTK registry report

Post Posted: Wed Feb 13, 2013 10:56 am

this was more of a post FTK report tool thingy vs decoding artifacts like Franks tool (which is sweet!)

an ice agent contacted me about it as he was doing it by hand. nerds dont like that so i automated it =)

i figured RegRipper had a module. i had someone asking me the other day about processing hives for ares stuff. theres the answer =) i will point him to RegRipper.  

EricZimmerman
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 2
Go to page 1, 2  Next