Interpreting ShellB...
 
Notifications
Clear all

Interpreting ShellBags

38 Posts
4 Users
0 Likes
1,471 Views
Cults14
(@cults14)
Posts: 367
Reputable Member
Topic starter
 

Thanks Harlan, I have done other stuff and reported it back here (Rob Lee's USB guides for example). I've also provided some tidbits which various people had missed or forgotten e.g. stated there are no VSCs available).

Some more various responses

AV - am awaiting feedback from our central IT people about what our AV (MS Forefront) logs - it is certainly supposed to check any inserted device but whether it logs that and how much data would be collected I don't as yet know although looking on my own system seems to suggest nothing relevant

Fourth Edition - when is that due? Does not have v3 miss anything out?

"…in the absence of any other convincing evidence…" - I also say "(so far)" so leaving the door open - but not indefinitely.

"Proving data exfil is extremely difficult…" - Am confused by this para as I specifically say I can't prove data exfil )

EMDMgmt - 11 devices listed but only two with key last written timestamp of relevance. One USB HDD in October and one USB HDD 17th September

Windows Portable Devices\Devices - 12 devices listed, 3 of which have timestamps of relevance
Blackberry (Drive I) 10th October @ 1443
Blackberry (BLACKBERRY1) 10th October @ 1921
CBM USB2.0 (Drive K) 10th October @ 1848

Windows Event Logs…….. Long story short - which evtx file contains the USB Storage info?

re ShellBags and the TZWorks app not extracting everything, am I right in thinking that it's also possible to extract device info along the lines the stuff you can get out of LNK files?

Cheers

 
Posted : 04/12/2013 8:52 pm
joachimm
(@joachimm)
Posts: 181
Estimable Member
 

In terms of this particular case, in the absence of any other convincing evidence (so far) I'm still inclined to believe that one hard drive with a particular folder structure was connected to the system and concurrently one or more other devices with (in some but not all cases) exactly the same folder structure was connected.

Beliefs are best left to religions. Facts is what you need. You can use your gut feeling (if that is what you mean by belief) to formulate hypotheses (plural) but then make sure to adopt the approach of "Thesis, antithesis, synthesis".
http//en.wikipedia.org/wiki/Thesis,_antithesis,_synthesis

Know that the readers of this thread are not seeing the whole case, we just see what you provide in your responses, which is not convincing in factual proving

that one hard drive with a particular folder structure was connected to the system and concurrently one or more other devices with (in some but not all cases) exactly the same folder structure was connected.

 
Posted : 05/12/2013 1:05 am
joachimm
(@joachimm)
Posts: 181
Estimable Member
 

Just stumbled across this post
http//www.4n6k.com/2013/12/shellbags-forensics-addressing.html

 
Posted : 05/12/2013 11:20 am
Cults14
(@cults14)
Posts: 367
Reputable Member
Topic starter
 

Just stumbled across this post
http//www.4n6k.com/2013/12/shellbags-forensics-addressing.html

Thanks Joachim - incredible timing

 
Posted : 05/12/2013 2:28 pm
keydet89
(@keydet89)
Posts: 3578
Famed Member
 

Thanks Harlan, I have done other stuff …

I'm not sure that any of this information really helps you with the issue of data exfil…

 
Posted : 05/12/2013 5:35 pm
Cults14
(@cults14)
Posts: 367
Reputable Member
Topic starter
 

In the original post
"………there is plenty evidence in JumpLists of file access to a Drive E around the same time"

So, JumpLists show 125 PDF files accessed on E\Folder5 between 000842 and 004910 on 12th Sept.

TZWorks output for F\Folder5\ and E\Folder5\ respectively
(apologies for formatting)
Regkey modtime [UTC] createdate ctime modifydate mtime accessdate atime
10/11/13 003723.099 12-Sep-13 000836 12-Sep-13 004912 12-Sep-13 004912
10/08/13 201118.514 12-Sep-13 000836 12-Sep-13 000836 12-Sep-13 000836

There is NO file access on Drive F recorded in JumpLists, MRUs, or LNKs.

And the pattern is repeated for the other folders in the original post.

I think this helps me?

 
Posted : 05/12/2013 9:53 pm
keydet89
(@keydet89)
Posts: 3578
Famed Member
 

TZWorks output for F\Folder5\ and E\Folder5\ respectively
(apologies for formatting)
Regkey modtime [UTC] createdate ctime modifydate mtime accessdate atime
10/11/13 003723.099 12-Sep-13 000836 12-Sep-13 004912 12-Sep-13 004912
10/08/13 201118.514 12-Sep-13 000836 12-Sep-13 000836 12-Sep-13 000836

What does this indicate to you?

I think this helps me?

To do what?

 
Posted : 06/12/2013 1:16 am
Cults14
(@cults14)
Posts: 367
Reputable Member
Topic starter
 

Harlan, can I get back to you on this? I'm sure it should be simple but it's doing my head in, I won't have time tomorrow as I'm out of town socially so is likely to be Monday

Cheers

 
Posted : 06/12/2013 2:23 am
Page 3 / 3
Share:
Share to...