Analisis Registry Hive

- get ip
rip.pl -r SYSTEM -p nic_mst2
rip.pl -r SYSTEM -p nic



- get computer name
rip.pl -r SYSTEM -p compname



- get timezone
rip.pl -r SYSTEM -p timezone

Salin UsnJrnl utk forensic analisis

mmls diskimage.raw
(dapatkan offset partition)



1)
fls -r -i raw -o _offset_ diskimage.raw | grep Usn
(dapatkan inode number)
Output:
+ r/r 88280-128-3:      $UsnJrnl:$J
+ r/r 88280-128-17:     $UsnJrnl:$Max


2)
istat -i raw -o _ofset_  diskimage.raw _inode_number_      (eg: 88280)
Output:
..
..
..
Attributes:
Type: $STANDARD_INFORMATION (16-0)   Name: N/A   Resident   size: 72
Type: $FILE_NAME (48-1)   Name: N/A   Resident   size: 82
Type: $DATA (128-3)   Name: $J   Non-Resident, Sparse   size: 4731298448  init_size: 4731298448
..
..


3)
icat -i raw -o _offset_   diskimage.raw   88280-128-3  > UsnJrnl.bin


4) To convert to csv, can use:
    -  https://github.com/jschicht/UsnJrnl2Csv  or
    - usnj.pl -f UsnJrnl.bin  -c > Usnjrnl.bin.csv



refer

https://countuponsecurity.com/2017/05/25/digital-forensics-ntfs-change-journal/amp/
http://az4n6.blogspot.com/2015/03/usn-journal-where-have-you-been-all-my.html

Persediaan Forensic utk vmdk

File vmdk ada 2 jenis:
1- compress vmdk. (yg di eksport ke ovf, akan ada file vmdk juga)
2- normal vmdk file



---Jenis Pertama(Compress)------
Header file spt berikut


$ cat mydisk-1.vmdk | head -n 24
KDMV
����������


# Disk DescriptorFile
version=1
CID=c5c13606
parentCID=ffffffff
createType="streamOptimized"


# Extent description
RDONLY 167772160 SPARSE "generated-stream.vmdk"


# The Disk Data Base
#DDB


ddb.adapterType = "lsilogic"
ddb.deletable = "true"
ddb.geometry.cylinders = "10443"
ddb.geometry.heads = "255"
ddb.geometry.sectors = "63"
ddb.longContentID = "00302ffb1ab341039d5bd86cdfdc2093"
ddb.toolsInstallType = "1"
ddb.toolsVersion = "10305"
ddb.virtualHWVersion = "13"





-------Jenis Ke-2 (Normal vmdk)---------------
Header file spt berikut:

$ cat mydisk-disk1.vmdk | head -n 26
KDMV
�)(�P

# Disk DescriptorFile
version=1
encoding="windows-1252"
CID=5760ddb4
parentCID=ffffffff
createType="monolithicSparse"

# Extent description
RW 167772160 SPARSE "mydisk-disk1.vmdk"

# The Disk Data Base
#DDB

ddb.adapterType = "lsilogic"
ddb.deletable = "true"
ddb.geometry.cylinders = "10443"
ddb.geometry.heads = "255"
ddb.geometry.sectors = "63"
ddb.longContentID = "759eeb7f459530d2044013365760ddb4"
ddb.toolsInstallType = "1"
ddb.toolsVersion = "10305"
ddb.uuid = "60 00 C2 9d 9d 85 7f 58-7b d8 30 ac 1b ae 1d bb"
ddb.virtualHWVersion = "13"

--------Mounting-Jenis 2(normal)--------

0) sudo -i    (attemp using normal user with sudo, failed)
1) affuse mydisk.vmdk mnt_affuse/point/

2) mmls mnt_affuse/point/mydisk.vmdk.raw  (utk dapatkan offset(start * 512(bytes size per sector)))

3) mount -o ro,loop,show_sys_files,streams_interface=windows,offset=_offset_number_   mnt_affuse/point/mydisk.vmdk.raw  mnt_dir/point
  
4) do your work/analysis on mnt_dir/point

5) umount mnt_dir/point
6) fusermount -u mnt_affuse/point/

##notes about losetup##
On step3, will result /dev/loopX being created
Can  check with losetup -l   (to list)
losetup -f (check next available number loopX)

On step5, will remove /dev/loopX

##Notes about Steps 0##
Alternatively you can ommit steps 0, but must use sudo for steps 1, 2, 3

--------Mounting-Jenis 1(compress vmdk)--------

1) kena import dulu ova tersebut. (ini akan hasil kan vmdk yg normal)

2) teruskan langkah mounting Jenis 2 diatas.







Ref:
1) https://sanbarrow.com/vmdk-howtos.html

semak vmdk corrupt

Salah satu cara nak semak samada vmdk file corrupt atau tidak?

vmware-mount -p vmdk_file.vmdk

kalau ok, akan paparkan partition.

Nr      Start       Size Type Id Sytem
-- ---------- ---------- ---- -- ------------------------
 1       2048   10479616 BIOS  7 HPFS/NTFS

kalau masalah akan keluarkan paparan:

Failed to open disk: The specified file is not a virtual disk (16063)
Failed to get the list of partitions: The virtual disk specified is invalid.

On Windows:
c:\Program Files (x86)\VMware\VMware Workstation\vmware-vdiskmanager.exe" -e disk-4.vmdk
Disk chain is consistent.

>"c:\Program Files (x86)\VMware\VMware Workstation\vmware-vdiskmanager.exe" -e disk-3.vmdk
Failed to open the disk 'disk-3.vmdk' : The specified file is not a virtual disk (0x3ebf).

ref:

1- http://az4n6.blogspot.com/2015/04/dealing-with-compressed-vmdk-files.html

create installer from iso to usb

1- cucuk usb ke pc
2- unmount usb(tapi jgn tanggalkan)
3- sudo dd bs=4M if=/home/sana/Downloads/ubuntu-18.04.2-live-server-amd64.iso of=/dev/sdb status=progress oflag=sync

Convert virtual disk to RAW disk image

1- Format VBox

vboxmanage clonemedium  ./disk.raw --format=raw

Now disk.raw can be read by mmls to get partition offset.

mmls disk.raw

(ref https://www.andreafortuna.org/2017/06/28/extract-filesystem-bodyfile-from-a-virtualbox-vm/)

2- VMDK

If your mmls support afflib, you can directly process it.

mmls -i afflib vmDisk.vmdk

If yours does not support afflib, you need to convert to raw format using qemu-img

qemu-img convert -f vmdk -O raw vmImage/vm_disk.vmdk vm_disk.raw

Now disk.raw can be read by mmls to get partition offset.

mmls disk.raw

Snapshot:

Lets say the image has 2 snapshot of disk vm_disk.vmdk

File *.vmsd will track this snapshot(mapping snapshot name to the vmdk file). Lets say vmImage.vmsd is as as follow:

.encoding = "UTF-8"
snapshot.lastUID = "2"
snapshot.current = "2"
snapshot0.uid = "1"
snapshot0.filename = "vmImage-Snapshot1.vmsn"
snapshot0.displayName = "asal"
snapshot0.createTimeHigh = "365944"
snapshot0.createTimeLow = "26982807"
snapshot0.numDisks = "1"
snapshot0.disk0.fileName = "vm_disk.vmdk"
snapshot0.disk0.node = "scsi0:0"
snapshot.numSnapshots = "2"
snapshot.mru0.uid = "2"
snapshot1.uid = "2"
snapshot1.filename = "vmImage-Snapshot2.vmsn"
snapshot1.parent = "1"
snapshot1.displayName = "kedua"
snapshot1.createTimeHigh = "365947"
snapshot1.createTimeLow = "170475548"
snapshot1.numDisks = "1"
snapshot1.disk0.fileName = "vm_disk-000001.vmdk"
snapshot1.disk0.node = "scsi0:0"
snapshot.mru1.uid = "1"

This file show the image has 2 snapshot, 'asal' and 'kedua'. 

Snapshot 'asal' point the disk to vm_disk.vmdk. 

Snapshot 'kedua' point the disk to vm_disk-000001.vmdk.

Current state of disk is set in the vmImage.vmx file:

scsi0:0.fileName = "vm_disk-000002.vmdk"

To convert the snapshot disk to raw disk, just pass the any of snapshotXX.diskXX.fileName value(eg: vm_disk-000001.vmdk) to the qemu-img convert as pointed previously.

qemu-img convert -f vmdk -O raw vm_disk-000001.vmdk /tmp/snap_kedua.raw

source: https://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vddk.pg.doc_50%2FvddkDataStruct.5.3.html

winlogbeat change index name

For NonCluster

  setup.template.name: 'my-winlogbeat-%{[beat.version]}'
  setup.template.pattern: 'my-winlogbeat-%{[beat.version]}-*'

  output.elasticsearch.index: 'my-winlogbeat-%{[beat.version]}-%{+yyyy.MM}'

Notes: Winlogbeat version 7 when push to CLUSTER will default to 'ilm'(index lifecycle management) 

For Cluster :
  setup.ilm.enabled: auto
  setup.ilm.rollover_alias: "my-winlogbeat"
  setup.ilm.pattern: "{now/d}-000001"




ref: 
1- https://discuss.elastic.co/t/changing-the-index-name-for-winlogbeat-sent-to-elasticsearch/168722/6