Investigating Windows systems with Linux
Window Kit
A forensics expert explains how to extract interesting details from a confiscated Windows hard disk using standard Linux tools.
Criminals, intruders, and corporate saboteurs leave data behind on the hard disks of any computers they visit. Many of these computers are Windows systems, but you don't need Windows to extract valuable forensic information from a Windows hard disk. In this article, I will describe some simple techniques for getting forensic data from a Windows disk using Linux.
Before starting any forensic analysis, it is important to create a copy of the storage medium you will be investigating, either as a 1:1 copy or as an image or collection of images. You can copy the medium as a raw image (with dd) or use a format such as Expert Witness Format (EWF).
EWF is a proprietary format developed by Guidance Software [1] that is also supported by the X-Ways [2] commercial forensic tool. EWF images are compressed and thus are far smaller than raw images.
Linux tools such as Linux Encase (Linen) or Ewfacquire [3] will help you create an EWF image. Linen is included on the Helix forensics CD [4] as a free contribution by Guidance Software, but the dd tool, which is included on any Linux distribution, will normally do the trick. If you use dd, you can even launch a copy of the Windows system in a virtual environment such as VMware; EWF will not let you launch Windows without the proprietary add-on software because of its compressed format.
A command such as dd if=/dev/sda of=win_hd.dd bs=4096 conv=noerror, sync will create a dd image. Instead of /dev/sda, just specify the disk you want to copy. The block size bs=4096 accelerates the copy. The conv parameter ensures that the copy will not terminate if it encounters defective sectors.
By entering fdisk -lu, you can obtain information on the disk image. The administrator simply needs to pass in the image name (Listing 1).
Listing 1
Getting Information with fdisk
In Listing 1, the image contains a partition; the filesystem is NTFS. The disktype program from the standard Debian repositories provides more information (Listing 2). The partition obviously contains the Windows bootloader.
Listing 2
Disktype Data
To access the filesystem, the administrator first needs to mount it. The partition starts with sector 63, which is normal for a hard disk. The exception to this is Microsoft's latest offspring, Windows Vista, in which the first sector is 2047. The mount command thus specifies the matching offset:
# losetup -o $((63*512)) /dev/loop0 U win_hd.dd # mount -o ro,noatime,noexec /dev/loop0 /mnt
A quick glance at /mnt reveals the startup files and filesystem of a Windows drive. A quick glance at the boot.ini file reveals that they belong to a Windows 2000 Server (Listing 3).
Listing 3
Windows Filesystem
Seeking with Find
Criminal investigators often use the Linux find command with the --exec or xargs xx options to search for files with illegal content. After creating and mounting an image, find /mnt -type f will give you a detailed list of files. Because this approach does not take file names with blanks or non-standard characters into account, the investigator might opt for find /mnt -type f -print0 | xargs -0 ls -al.
Hash values help find identical and suspicious files on a system. You can create a hash automatically with a command such as find /mnt -type f -print0 | xargs -0 md5sum; you can even compare the hashes on the fly with existing reference material. However, it makes more sense to create a file containing hashes for all files (Figure 1).
Hashes Find Duplicates
In most cases, investigators already have hashes for files they want to find. Forensics experts compile databases with hashes of known files to help search for criminal material. If you just want to filter out Microsoft DLLs on a system you are investigating, this approach is useful.
A simple grep command will find any correlations between the subject of the investigation and your search targets. The following command, from which we have removed the individual filenames, saves a list of hashes for existing files in a file called big.txt:
# find /mnt -type f -print0 | xargs -0 md5sum | awk '{print $1}' | sort -g | uniq > big.txt
The awk command takes the hash values in the first column; sort -g sorts them, and uniq removes duplicate entries. An investigator who has stored the desired hash values in a file called small.txt, can then run grep -f small.txt big.txt to find duplicates, and thus any matching files.
Keyword Search
Forensic investigators search confiscated systems for specific keywords.
Creating a text file with the search keys for this purpose – such as keywords.txt – is a good idea. For example, you could add the words password and secret.
The command line
# cat win_hd.dd | strings | egrep -i --color -f keywords.txt
searches the complete Windows image for the keywords password and secret and highlights them in red in the output, as you can see in Figure 2. This approach is particularly interesting if you extend the search beyond the filesystem to other areas of a hard disk, such as:
- the swap file or hibernation file,
- unallocated areas of the disk,
- file slack data
- deleted files.
To find keywords stored in the 16-bit Unicode text that the Windows NT operating systems use, you must tell the strings command whether to perform a little – or big – endian [5] search. The required arguments are either -eb or -el. Listing 4 uses Ntfsundelete as an example of restoring files via inode allocations.
Listing 4
Restoring Files
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
Linux Servers Targeted by Akira Ransomware
A group of bad actors who have already extorted $42 million have their sights set on the Linux platform.
-
TUXEDO Computers Unveils Linux Laptop Featuring AMD Ryzen CPU
This latest release is the first laptop to include the new CPU from Ryzen and Linux preinstalled.
-
XZ Gets the All-Clear
The back door xz vulnerability has been officially reverted for Fedora 40 and versions 38 and 39 were never affected.
-
Canonical Collaborates with Qualcomm on New Venture
This new joint effort is geared toward bringing Ubuntu and Ubuntu Core to Qualcomm-powered devices.
-
Kodi 21.0 Open-Source Entertainment Hub Released
After a year of development, the award-winning Kodi cross-platform, media center software is now available with many new additions and improvements.
-
Linux Usage Increases in Two Key Areas
If market share is your thing, you'll be happy to know that Linux is on the rise in two areas that, if they keep climbing, could have serious meaning for Linux's future.
-
Vulnerability Discovered in xz Libraries
An urgent alert for Fedora 40 has been posted and users should pay attention.
-
Canonical Bumps LTS Support to 12 years
If you're worried that your Ubuntu LTS release won't be supported long enough to last, Canonical has a surprise for you in the form of 12 years of security coverage.
-
Fedora 40 Beta Released Soon
With the official release of Fedora 40 coming in April, it's almost time to download the beta and see what's new.
-
New Pentesting Distribution to Compete with Kali Linux
SnoopGod is now available for your testing needs