MC

#DFIR

[MC @grayfold3d]

@mhallman Value=3. I’ve parsed the prefetch with pecmd and see other entries on the date in question so just not sure why it’s not being recorded or was deleted. I seem to recall reading somewhere about cases where a pf file might not be created if it opened quickly but can’t find it now

[MC @grayfold3d]

#dfir question...Under what conditions would a program execution fail to create a prefetch file/prefetch file be deleted? Running Win10 and I have pf files with dates prior to the known execution of this application so I don’t think it’s getting removed due to a size limit.

[MC @grayfold3d]

@mhallman I also see execution evidence in amcache, appcompatcache

[MC @grayfold3d]

@mhallman Yep. One of the applications I’m looking at is TeamViewer. I know it was installed/executed due to its application logs but there are no prefetch entries. I’ve run this app in a lab and see pf files for the installer and application. Don’t have FD image to carve unfortunately

[MC @grayfold3d]

I should note these entries would be months old but I know this app does create pf files.

[MC @grayfold3d]

@bmmaloney97 The same is true in Splunk

[MC @grayfold3d]

Well...no logs. This seems like a great idea. “No logs are created on either the helper’s or sharer’s device”

https://t.co/AiSaqhH7Pd

[MC @grayfold3d]

Anyone aware of any logs showing sessions/connections from Microsoft Quick Assist (newer more user friendly Remote Assistance)? Not seeing anything in the normal RDP logs.

[MC @grayfold3d]

@bettersafetynet I love the fact that git is built into new Windows versions (starting at 1909 I think). I just run it from PS prompt now

[MC @grayfold3d]

@find_evil #stopthescale

[MC @grayfold3d]

@AkashhSawant @SwiftOnSecurity Administrative templates: https://t.co/eAJyrzCV3Z

[MC @grayfold3d]

Anyone know of good OSX forensic resources similar to the SANS “evidence of” posters?

[MC @grayfold3d]

@cglyer @m1ru1 We use a OneNote template with many of the things you listed. Just copy the template with each new investigation. Tables for timelines, IOCs etc. The only downside from my view is you can’t easily sort like you can in Excel.

[Lee Holmes @Lee_Holmes]

I've always thought a "PowerShell for PHBs" presentation would be fun. Here's one I used today to figure out what's been important to me recently. In Outlook, select your last 6 months of "Sent Items", and press CTRL-C. Then voila!

[Hal Pomeranz @hal_pomeranz]

My Linux Forensics material is now up at https://t.co/dXF5C8bWWp -- grab the torrent from https://t.co/ukKYM0ptUg

[MC @grayfold3d]

@byteya @EricRZimmerman Haha if there’s one thing I know, it’s that if @ericzimmerman writes it, it will be in C# and not Python

[MC @grayfold3d]

@HighViscosity Awesome post! First time of I’ve seen or heard of LNK files created from searches.

[MC @grayfold3d]

@ItsReallyNick @SBousseaden Yeah typically the same documents. But around 20 different pdf, CSV, etc. What I’ve seen have been things like contact sheets and other ref docs. There’s been a bunch of back and forth between our team and the business unit he works in with all the reasons this is a bad idea.

[MC @grayfold3d]

@SBousseaden We have a guy that likes putting office docs in his startup folder. How his machine manages to start with alll those files loading at startup is beyond me. Oh EDR loves him too 😑

[MC @grayfold3d]

@brianjmoran My wife and I play a game where she tells me the Hallmark movie name and I have to guess what it’s about. I’ve got a 75% success rate.