Solving Magnet Forensics CTF with Plaso, Timesketch, and Colab

The folks at Magnet Forensics had a digital forensics-themed Capture the Flag competition and I wanted to take a crack at it using the open source tools we use/build here at Google: Plaso, Timesketch, and Colab/Python.

Solving Magnet Forensics CTF with Plaso, Timesketch, and Colab

The folks at Magnet Forensics had a conference recently, and as part of it they put together a digital forensics-themed Capture the Flag competition. I wasn't able to attend, but thankfully they released the CTF online a few days after the live competition ended.

It looked like a lot of fun and I wanted to take a crack at it using the open source tools we use/build here at Google: Plaso, Timesketch, and Colab/Python.

Forensics Preprocessing

I'm going to focus on how to find the answers to the CTF questions after all the processing has been done. I'll quickly summarize the processing steps I did to get to the state when I pick up my walkthrough.

I started off by processing the provided E01 image with a basic log2timeline command; nothing special added:

ryan:~$ log2timeline.py MUS2019-CTF.plaso MUS-CTF-19-DESKTOP-001.E01

Once that finished, I went to Timesketch, made a new sketch, and uploaded the MUS2019-CTF.plaso file I just made. The .plaso file is a database containing the results of my log2timeline run; Timesketch can read it and provide a nice, collaborative interface for reviewing and exploring that data.

Most of what I'm going to show you is done in Colab by accessing the Timesketch API in Python. You can do most of the steps in the Timesketch web interface directly, but I wanted to demonstrate how you can use Python, Colab, Timesketch, and Plaso together to work a case.

Timesketch & Colab Setup

First, you can run this notebook and play along instead of reading it here. The Timesketch GitHub has Colab (Timesketch and Colab) that walks through how to install, connect, and explore a Sketch using Colab. Please check it out if you want a more thorough explanation of the setup; I'm just going to show the commands you need to run to get it working:

In [1]:
# Install the TimeSketch API client if you don't have it
!pip install timesketch-api-client

# Import some things we'll need
from timesketch_api_client import client
import pandas as pd
pd.options.display.max_colwidth = 60
Out [1]
Requirement already satisfied: timesketch-api-client in /usr/local/lib/python2.7/dist-packages (20190124)
Requirement already satisfied: requests in /usr/local/lib/python2.7/dist-packages (from timesketch-api-client) (2.18.4)
Requirement already satisfied: beautifulsoup4 in /usr/local/lib/python2.7/dist-packages (from timesketch-api-client) (4.6.3)
Requirement already satisfied: idna<2.7,>=2.5 in /usr/local/lib/python2.7/dist-packages (from requests->timesketch-api-client) (2.6)
Requirement already satisfied: urllib3<1.23,>=1.21.1 in /usr/local/lib/python2.7/dist-packages (from requests->timesketch-api-client) (1.22)
Requirement already satisfied: certifi>=2017.4.17 in /usr/local/lib/python2.7/dist-packages (from requests->timesketch-api-client) (2019.3.9)
Requirement already satisfied: chardet<3.1.0,>=3.0.2 in /usr/local/lib/python2.7/dist-packages (from requests->timesketch-api-client) (3.0.4)

Connect to Timesketch

By default, this will connect to the public demo Timesketch server, which David Cowen has graciously allowed to host a copy of the Plaso timeline of the MUS2019-CTF. Thanks Dave!

In [2]:
#@title Client Information { run: "auto"}
SERVER = 'https://demo.timesketch.org' #@param {type: "string"}
USER = 'demo' #@param {type: "string"}
PASSWORD = 'demo' #@param {type: "string"}

ts_client = client.TimesketchApi(SERVER, USER, PASSWORD)

Now that we've connected to the Timesketch server, we need to select the Sketch that has the CTF timeline.

First we'll list the available sketches, then print their names:

In [3]:
sketches = ts_client.list_sketches()
for i, sketch in enumerate(sketches):
  print('[{0:d}] {1:s}'.format(i, sketch.name))
Out [3]
[0] MUSCTF 2019
[1] The Greendale incident - 2019
[2] The Greendale investigation

Then we'll select the MUS2019-CTF sketch:

In [4]:
ctf = sketches[0]

Lastly, I'll briefly explain a few parameters of the explore function, which we'll use heavily when answering questions.

sketch_name.explore() is how we send queries to Timesketch and get results back. query_string, return_fields, and as_pandas are the main parameters I'll be using:

  • query_string: This is the same as the query you'd enter if you were using the Timesketch web interface. It's also the default first parameter; I'll omit it in my queries below for brevity.
  • return_fields: Here we specify what fields we want back from Timesketch. This is where we can get really specific using Colab and only get the things we're interested in (which varies depending on what data types we're expecting back).
  • as_pandas: This just a boolean value which tells Timesketch to return a Pandas DataFrame, rather than a dictionary. We'll have this set to True in all our queries, since DataFrames are awesome!

Okay, enough setup. Let's get to answering questions!

Questions

Basic - Desktop Questions

I grouped the questions from the 'Basic - Desktop' section into three categories: NTFS, TeamViewer, and Registry.

NTFS Questions

This first set of questions relate to aspects of NTFS: MFT entries, sequence numbers, USN entries, and VSNs.

As a little refresher, the 64-bit file reference address (or number) is made up of the MFT entry (48 bits) and sequence (16 bits) numbers. We often see this represented as something like 1234-2, with 1234 being the MFT entry number and 2 being the sequence number. Plaso calls the MFT entry number the inode, since that's the more generic term that applies across file systems.

Q: What is the name of the file associated with MFT entry number 102698?

Since Plaso parses out the MFT entry (or as it calls it, inode) into its own field, let's do a query for all records with that value:

In [5]:
ts_results = ctf.explore(
    'inode:102698', 
    return_fields='datetime,timestamp_desc,data_type,inode,filename', 
    as_pandas=True)
ts_results[['datetime','timestamp_desc','data_type','inode','filename']]
Out [5]:
datetime timestamp_desc data_type inode filename
0 2016-04-03 20:18:47+00:00 Creation Time pe:compilation:compilation_time 102698 /Users/Administrator/Downloads/TeamViewer_Setup.exe
1 2019-02-25 20:40:00+00:00 Creation Time fs:stat 102698 /Users/Administrator/Downloads/TeamViewer_Setup.exe
2 2019-02-25 20:40:30+00:00 Content Modification Time fs:stat 102698 /Users/Administrator/Downloads/TeamViewer_Setup.exe
3 2019-02-25 20:40:45+00:00 Metadata Modification Time fs:stat 102698 /Users/Administrator/Downloads/TeamViewer_Setup.exe
4 2019-02-25 20:41:36+00:00 Last Access Time fs:stat 102698 /Users/Administrator/Downloads/TeamViewer_Setup.exe

Multiple results, as is expected since Plaso creates multiple records for different types of timestamps, but they all point to the same filename: /Users/Administrator/Downloads/TeamViewer_Setup.exe

Q: What is the file name that represented MFT entry 60725 with a sequence number of 10?

The quick way to answer this is to just search for the MFT entry number (60725) and look for references to sequence number 10 in the message field:

In [6]:
ts_results = ctf.explore(
    '60725', 
    return_fields='datetime,timestamp_desc,data_type,filename,message', 
    as_pandas=True)
ts_results[['datetime','timestamp_desc','data_type','filename','message']]
Out [6]:
datetime timestamp_desc data_type filename message
0 2019-02-26 23:59:41+00:00 Content Modification Time windows:evtx:record /Windows/System32/winevt/Logs/Microsoft-Windows-Store%4O... [2006 / 0x07d6] Source Name: Microsoft-Windows-Install-A...
1 2019-03-13 18:16:00+00:00 Metadata Modification Time fs:ntfs:usn_change energy-report-2019-02-19.xml energy-report-2019-02-19.xml File reference: 60725-9 Par...
2 2019-03-13 18:23:16+00:00 Metadata Modification Time fs:ntfs:usn_change telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64be... telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64be...
3 2019-03-13 18:23:16+00:00 Metadata Modification Time fs:ntfs:usn_change telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdce... telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdce...
4 2019-03-13 18:23:16+00:00 Metadata Modification Time fs:ntfs:usn_change telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64be... telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64be...
5 2019-03-13 18:23:16+00:00 Metadata Modification Time fs:ntfs:usn_change telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdce... telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdce...
6 2019-03-13 18:38:16+00:00 Metadata Modification Time fs:ntfs:usn_change utc.app.json.new utc.app.json.new File reference: 60725-12 Parent file re...
7 2019-03-13 18:38:16+00:00 Metadata Modification Time fs:ntfs:usn_change utc.app.json.new utc.app.json.new File reference: 60725-12 Parent file re...
8 2019-03-13 18:53:16+00:00 Metadata Modification Time fs:ntfs:usn_change telemetry.ASM-WindowsDefault.json.new telemetry.ASM-WindowsDefault.json.new File reference: 60...
9 2019-03-13 18:53:17+00:00 Metadata Modification Time fs:ntfs:usn_change telemetry.ASM-WindowsDefault.json.new telemetry.ASM-WindowsDefault.json.new File reference: 60...
10 2019-03-13 19:08:17+00:00 Metadata Modification Time fs:ntfs:usn_change TELEMETRY.ASM-WINDOWSSQ.json.new TELEMETRY.ASM-WINDOWSSQ.json.new File reference: 60725-1...
11 2019-03-13 19:08:17+00:00 Metadata Modification Time fs:ntfs:usn_change TELEMETRY.ASM-WINDOWSSQ.json.new TELEMETRY.ASM-WINDOWSSQ.json.new File reference: 60725-1...
12 2019-03-13 19:23:17+00:00 Metadata Modification Time fs:ntfs:usn_change utc.privacy.json.new utc.privacy.json.new File reference: 60725-15 Parent fil...
13 2019-03-13 19:23:17+00:00 Metadata Modification Time fs:ntfs:usn_change utc.privacy.json.new utc.privacy.json.new File reference: 60725-15 Parent fil...
14 2019-03-13 19:23:17+00:00 Creation Time fs:stat /ProgramData/Microsoft/Diagnosis/DownloadedSettings/utc.... TSK:/ProgramData/Microsoft/Diagnosis/DownloadedSettings/...
15 2019-03-13 19:23:18+00:00 Metadata Modification Time fs:ntfs:usn_change utc.privacy.json.new utc.privacy.json.new File reference: 60725-15 Parent fil...
16 2019-03-13 19:23:18+00:00 Metadata Modification Time fs:ntfs:usn_change utc.privacy.json utc.privacy.json File reference: 60725-15 Parent file re...
17 2019-03-13 19:23:18+00:00 Last Access Time fs:stat /ProgramData/Microsoft/Diagnosis/DownloadedSettings/utc.... TSK:/ProgramData/Microsoft/Diagnosis/DownloadedSettings/...
18 2019-03-13 19:23:18+00:00 Content Modification Time fs:stat /ProgramData/Microsoft/Diagnosis/DownloadedSettings/utc.... TSK:/ProgramData/Microsoft/Diagnosis/DownloadedSettings/...
19 2019-03-13 19:23:18+00:00 Metadata Modification Time fs:stat /ProgramData/Microsoft/Diagnosis/DownloadedSettings/utc.... TSK:/ProgramData/Microsoft/Diagnosis/DownloadedSettings/...
20 2019-03-13 19:23:18+00:00 Metadata Modification Time fs:ntfs:usn_change utc.privacy.json.new utc.privacy.json.new File reference: 60725-15 Parent fil...
21 2019-03-13 19:23:18+00:00 Metadata Modification Time fs:ntfs:usn_change utc.privacy.json utc.privacy.json File reference: 60725-15 Parent file re...

That's a bunch of rows, so let's filter it down by searching for messages that contain '60725-10':

In [7]:
ts_results[ts_results.message.str.contains('60725-10')]
Out [7]:
_id _index _source _type data_type datetime filename label message timestamp_desc
2 AWowcLcHTGJyHzo5vZNF 51f20fbeff6b4a7ca2dd3f76c1a41598 MUSCTF-2019 plaso_event fs:ntfs:usn_change 2019-03-13 18:23:16+00:00 telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64be... [] telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64be... Metadata Modification Time
4 AWowcLcHTGJyHzo5vZNG 51f20fbeff6b4a7ca2dd3f76c1a41598 MUSCTF-2019 plaso_event fs:ntfs:usn_change 2019-03-13 18:23:16+00:00 telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64be... [] telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64be... Metadata Modification Time

That filename is really long and cut off; let's just select that field, then deduplicate using set():

In [8]:
set(ts_results[ts_results.message.str.contains('60725-10')].filename)
Out [8]:
{u'telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json.new'}

Another way to solve this is to query for the file reference number directly. That's not as easy as it sounds, since Plaso stores it in the hex form (I'm working on fixing that). We can work with that though!

Let's do the same query as above, but add the file_reference field:

In [9]:
ts_results = ctf.explore(
    '60725', 
    return_fields='datetime,timestamp_desc,data_type,file_reference,filename,message', 
    as_pandas=True)
ts_results[['datetime','timestamp_desc','data_type','file_reference','filename','message']]
Out [9]:
datetime timestamp_desc data_type file_reference filename message
0 2019-02-26 23:59:41+00:00 Content Modification Time windows:evtx:record NaN /Windows/System32/winevt/Logs/Microsoft-Windows-Store%4O... [2006 / 0x07d6] Source Name: Microsoft-Windows-Install-A...
1 2019-03-13 18:16:00+00:00 Metadata Modification Time fs:ntfs:usn_change 2.533275e+15 energy-report-2019-02-19.xml energy-report-2019-02-19.xml File reference: 60725-9 Par...
2 2019-03-13 18:23:16+00:00 Metadata Modification Time fs:ntfs:usn_change 2.814750e+15 telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64be... telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64be...
3 2019-03-13 18:23:16+00:00 Metadata Modification Time fs:ntfs:usn_change 3.096225e+15 telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdce... telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdce...
4 2019-03-13 18:23:16+00:00 Metadata Modification Time fs:ntfs:usn_change 2.814750e+15 telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64be... telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64be...
5 2019-03-13 18:23:16+00:00 Metadata Modification Time fs:ntfs:usn_change 3.096225e+15 telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdce... telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdce...
6 2019-03-13 18:38:16+00:00 Metadata Modification Time fs:ntfs:usn_change 3.377700e+15 utc.app.json.new utc.app.json.new File reference: 60725-12 Parent file re...
7 2019-03-13 18:38:16+00:00 Metadata Modification Time fs:ntfs:usn_change 3.377700e+15 utc.app.json.new utc.app.json.new File reference: 60725-12 Parent file re...
8 2019-03-13 18:53:16+00:00 Metadata Modification Time fs:ntfs:usn_change 3.659175e+15 telemetry.ASM-WindowsDefault.json.new telemetry.ASM-WindowsDefault.json.new File reference: 60...
9 2019-03-13 18:53:17+00:00 Metadata Modification Time fs:ntfs:usn_change 3.659175e+15 telemetry.ASM-WindowsDefault.json.new telemetry.ASM-WindowsDefault.json.new File reference: 60...
10 2019-03-13 19:08:17+00:00 Metadata Modification Time fs:ntfs:usn_change 3.940650e+15 TELEMETRY.ASM-WINDOWSSQ.json.new TELEMETRY.ASM-WINDOWSSQ.json.new File reference: 60725-1...
11 2019-03-13 19:08:17+00:00 Metadata Modification Time fs:ntfs:usn_change 3.940650e+15 TELEMETRY.ASM-WINDOWSSQ.json.new TELEMETRY.ASM-WINDOWSSQ.json.new File reference: 60725-1...
12 2019-03-13 19:23:17+00:00 Metadata Modification Time fs:ntfs:usn_change 4.222125e+15 utc.privacy.json.new utc.privacy.json.new File reference: 60725-15 Parent fil...
13 2019-03-13 19:23:17+00:00 Metadata Modification Time fs:ntfs:usn_change 4.222125e+15 utc.privacy.json.new utc.privacy.json.new File reference: 60725-15 Parent fil...
14 2019-03-13 19:23:17+00:00 Creation Time fs:stat NaN /ProgramData/Microsoft/Diagnosis/DownloadedSettings/utc.... TSK:/ProgramData/Microsoft/Diagnosis/DownloadedSettings/...
15 2019-03-13 19:23:18+00:00 Metadata Modification Time fs:ntfs:usn_change 4.222125e+15 utc.privacy.json.new utc.privacy.json.new File reference: 60725-15 Parent fil...
16 2019-03-13 19:23:18+00:00 Metadata Modification Time fs:ntfs:usn_change 4.222125e+15 utc.privacy.json utc.privacy.json File reference: 60725-15 Parent file re...
17 2019-03-13 19:23:18+00:00 Last Access Time fs:stat NaN /ProgramData/Microsoft/Diagnosis/DownloadedSettings/utc.... TSK:/ProgramData/Microsoft/Diagnosis/DownloadedSettings/...
18 2019-03-13 19:23:18+00:00 Content Modification Time fs:stat NaN /ProgramData/Microsoft/Diagnosis/DownloadedSettings/utc.... TSK:/ProgramData/Microsoft/Diagnosis/DownloadedSettings/...
19 2019-03-13 19:23:18+00:00 Metadata Modification Time fs:stat NaN /ProgramData/Microsoft/Diagnosis/DownloadedSettings/utc.... TSK:/ProgramData/Microsoft/Diagnosis/DownloadedSettings/...
20 2019-03-13 19:23:18+00:00 Metadata Modification Time fs:ntfs:usn_change 4.222125e+15 utc.privacy.json.new utc.privacy.json.new File reference: 60725-15 Parent fil...
21 2019-03-13 19:23:18+00:00 Metadata Modification Time fs:ntfs:usn_change 4.222125e+15 utc.privacy.json utc.privacy.json File reference: 60725-15 Parent file re...

The file_reference value is not the format we want, since it's hard to tell what the sequence number is. We can convert it to a more useful form though:

In [10]:
# Drop any rows with NaN, since they aren't what we're looking for and will 
# break the below function.
ts_results = ts_results.dropna()
pd.options.display.max_colwidth = 110

# Replace the file_reference hex value with the human-readable MFT-Seq version. 
# This is basically what Plaso does to display the result in the 'message' 
# string we searched for. 
ts_results['file_reference'] = ts_results['file_reference'].map(
    lambda x: '{0:d}-{1:d}'.format(int(x) & 0xffffffffffff, int(x) >> 48))
ts_results[['datetime','timestamp_desc','data_type','file_reference','filename']]
Out [10]:
datetime timestamp_desc data_type file_reference filename
1 2019-03-13 18:16:00+00:00 Metadata Modification Time fs:ntfs:usn_change 60725-9 energy-report-2019-02-19.xml
2 2019-03-13 18:23:16+00:00 Metadata Modification Time fs:ntfs:usn_change 60725-10 telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json.new
3 2019-03-13 18:23:16+00:00 Metadata Modification Time fs:ntfs:usn_change 60725-11 telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json.new
4 2019-03-13 18:23:16+00:00 Metadata Modification Time fs:ntfs:usn_change 60725-10 telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json.new
5 2019-03-13 18:23:16+00:00 Metadata Modification Time fs:ntfs:usn_change 60725-11 telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json.new
6 2019-03-13 18:38:16+00:00 Metadata Modification Time fs:ntfs:usn_change 60725-12 utc.app.json.new
7 2019-03-13 18:38:16+00:00 Metadata Modification Time fs:ntfs:usn_change 60725-12 utc.app.json.new
8 2019-03-13 18:53:16+00:00 Metadata Modification Time fs:ntfs:usn_change 60725-13 telemetry.ASM-WindowsDefault.json.new
9 2019-03-13 18:53:17+00:00 Metadata Modification Time fs:ntfs:usn_change 60725-13 telemetry.ASM-WindowsDefault.json.new
10 2019-03-13 19:08:17+00:00 Metadata Modification Time fs:ntfs:usn_change 60725-14 TELEMETRY.ASM-WINDOWSSQ.json.new
11 2019-03-13 19:08:17+00:00 Metadata Modification Time fs:ntfs:usn_change 60725-14 TELEMETRY.ASM-WINDOWSSQ.json.new
12 2019-03-13 19:23:17+00:00 Metadata Modification Time fs:ntfs:usn_change 60725-15 utc.privacy.json.new
13 2019-03-13 19:23:17+00:00 Metadata Modification Time fs:ntfs:usn_change 60725-15 utc.privacy.json.new
15 2019-03-13 19:23:18+00:00 Metadata Modification Time fs:ntfs:usn_change 60725-15 utc.privacy.json.new
16 2019-03-13 19:23:18+00:00 Metadata Modification Time fs:ntfs:usn_change 60725-15 utc.privacy.json
20 2019-03-13 19:23:18+00:00 Metadata Modification Time fs:ntfs:usn_change 60725-15 utc.privacy.json.new
21 2019-03-13 19:23:18+00:00 Metadata Modification Time fs:ntfs:usn_change 60725-15 utc.privacy.json

There. Now we have the file_reference number in an easier-to-read format, and the history of filenames that MFT entry 60725 has had! It's easy to look for the entry with a sequence number of 10 and get our answer.

Q: Which file name represents the USN record where the USN number is 546416480?

Like other questions, the quick, generic way to answer is to just search for the unique detail; in this case, search in Timesketch for '546416480'. I'll show the more targeted way below, but it's pretty simple:

In [11]:
ts_results = ctf.explore(
    'update_sequence_number:546416480', 
    return_fields='datetime,timestamp_desc,data_type,update_sequence_number,filename', 
    as_pandas=True)
ts_results[['datetime','timestamp_desc','data_type','update_sequence_number','filename']]
Out [11]:
datetime timestamp_desc data_type update_sequence_number filename
0 2019-03-16 20:05:37+00:00 Metadata Modification Time fs:ntfs:usn_change 546416480 TransportSecurity~RF134e6674.TMP

Q: What is the MFT sequence number associated with the file "\Users\Administrator\Desktop\FTK_Imager_Lite_3.1.1\FTK Imager.exe"?

We'll handle this question like other ones involving the file reference address, except in this case we first need to find the MFT entry number (or inode) from the file name. Searching for the whole file path in Timesketch is problematic (slashes among other things), so let's search for the file name and then verify the path is right:

In [12]:
ts_results = ctf.explore(
    'FTK Imager.exe', 
    return_fields='datetime,timestamp_desc,data_type,inode,message', 
    as_pandas=True)
ts_results[['datetime','timestamp_desc','data_type','inode','message']]
Out [12]:
datetime timestamp_desc data_type inode message
0 2012-08-23 20:54:54+00:00 Creation Time pe:compilation:compilation_time 99916 PE Type: Executable (EXE) Import hash: 5d1d1d8cdc2296dfc99d791c9f2fdcb1
1 2016-04-13 22:33:42+00:00 Content Modification Time fs:stat 99916 TSK:/Users/Administrator/Desktop/FTK_Imager_Lite_3.1.1/FTK Imager.exe Type: file
2 2018-07-28 08:21:07+00:00 Creation Time windows:volume:creation 977 \VOLUME{01d4264bee777579-ccee841b} Serial number: 0xCCEE841B Origin: FTK IMAGER.EXE-C7E9245B.pf
3 2019-03-20 13:42:25+00:00 Metadata Modification Time fs:stat 99916 TSK:/Users/Administrator/Desktop/FTK_Imager_Lite_3.1.1/FTK Imager.exe Type: file
4 2019-03-20 21:26:49+00:00 Metadata Modification Time fs:ntfs:usn_change 83366 FTK Imager.exe File reference: 99916-4 Parent file reference: 99832-7 Update reason: USN_REASON_DATA_OVERW...
5 2019-03-20 21:26:49+00:00 Metadata Modification Time fs:ntfs:usn_change 83366 FTK Imager.exe File reference: 99916-4 Parent file reference: 99832-7 Update reason: USN_REASON_DATA_EXTEN...
6 2019-03-20 21:26:49+00:00 Last Access Time fs:stat 99916 TSK:/Users/Administrator/Desktop/FTK_Imager_Lite_3.1.1/FTK Imager.exe Type: file
7 2019-03-20 21:26:49+00:00 Creation Time fs:stat 99916 TSK:/Users/Administrator/Desktop/FTK_Imager_Lite_3.1.1/FTK Imager.exe Type: file
8 2019-03-20 21:26:49+00:00 Metadata Modification Time fs:ntfs:usn_change 83366 FTK Imager.exe File reference: 99916-4 Parent file reference: 99832-7 Update reason: USN_REASON_DATA_OVERW...
9 2019-03-20 21:26:49+00:00 Metadata Modification Time fs:ntfs:usn_change 83366 FTK Imager.exe File reference: 99916-4 Parent file reference: 99832-7 Update reason: USN_REASON_FILE_CREATE
10 2019-03-20 21:26:49+00:00 Metadata Modification Time fs:ntfs:usn_change 83366 FTK Imager.exe File reference: 99916-4 Parent file reference: 99832-7 Update reason: USN_REASON_DATA_OVERW...
11 2019-03-20 21:27:02+00:00 Last Time Executed windows:prefetch:execution 977 Prefetch [FTK IMAGER.EXE] was executed - run count 1 path: \USERS\ADMINISTRATOR\DESKTOP\FTK_IMAGER_LITE_3....
12 2019-03-20 21:27:12+00:00 Metadata Modification Time fs:ntfs:usn_change 83366 FTK IMAGER.EXE-C7E9245B.pf File reference: 977-5 Parent file reference: 83667-1 Update reason: USN_REASON_...
13 2019-03-20 21:27:12+00:00 Creation Time fs:stat 977 TSK:/Windows/Prefetch/FTK IMAGER.EXE-C7E9245B.pf Type: file
14 2019-03-20 21:27:12+00:00 Last Access Time fs:stat 977 TSK:/Windows/Prefetch/FTK IMAGER.EXE-C7E9245B.pf Type: file
15 2019-03-20 21:27:12+00:00 Metadata Modification Time fs:ntfs:usn_change 83366 FTK IMAGER.EXE-C7E9245B.pf File reference: 977-5 Parent file reference: 83667-1 Update reason: USN_REASON_...
16 2019-03-20 21:27:12+00:00 Metadata Modification Time fs:ntfs:usn_change 83366 FTK IMAGER.EXE-C7E9245B.pf File reference: 977-5 Parent file reference: 83667-1 Update reason: USN_REASON_...
17 2019-03-20 21:27:12+00:00 Metadata Modification Time fs:stat 977 TSK:/Windows/Prefetch/FTK IMAGER.EXE-C7E9245B.pf Type: file
18 2019-03-20 21:27:12+00:00 Content Modification Time fs:stat 977 TSK:/Windows/Prefetch/FTK IMAGER.EXE-C7E9245B.pf Type: file
19 2019-03-20 21:28:47+00:00 Content Modification Time windows:evtx:record 83669 [4798 / 0x12be] Source Name: Microsoft-Windows-Security-Auditing Strings: ['Administrator', 'DESKTOP-0QT80...

In the second row of the results, we can find the correct path we're looking for in the message and see that the corresponding inode is 99916. We could do another search, similar to how we answered other questions... or we could just look down a few rows for a USN entry that shows: "FTK Imager.exe File reference: 99916-4". There's the answer!

Q: What is the Volume Serial Number of the Desktop's OS volume?

I know the VSN can be found in multiple places, but the first one I thought of was as part of a Prefetch file, so let's do it that way.

I'll search for all 'volume creation' Prefetch records, since I don't really care about which particular one, beyond that it's from the OS drive.

In [13]:
ts_results = ctf.explore(
    'data_type:"windows:volume:creation"', 
    return_fields='datetime,timestamp_desc,data_type,device_path,hostname,serial_number,message', 
    as_pandas=True)
pd.options.display.max_colwidth = 70
ts_results[['datetime','timestamp_desc','data_type','device_path','hostname','serial_number','message']]
Out [13]:
datetime timestamp_desc data_type device_path hostname serial_number message
0 2018-07-28 08:21:07+00:00 Creation Time windows:volume:creation \VOLUME{01d4264bee777579-ccee841b} DESKTOP-0QT8017 3438183451 \VOLUME{01d4264bee777579-ccee841b} Serial number: 0xCCEE841B Origi...
1 2018-07-28 08:21:07+00:00 Creation Time windows:volume:creation \VOLUME{01d4264bee777579-ccee841b} DESKTOP-0QT8017 3438183451 \VOLUME{01d4264bee777579-ccee841b} Serial number: 0xCCEE841B Origi...
2 2018-07-28 08:21:07+00:00 Creation Time windows:volume:creation \VOLUME{01d4264bee777579-ccee841b} DESKTOP-0QT8017 3438183451 \VOLUME{01d4264bee777579-ccee841b} Serial number: 0xCCEE841B Origi...
3 2018-07-28 08:21:07+00:00 Creation Time windows:volume:creation \VOLUME{01d4264bee777579-ccee841b} DESKTOP-0QT8017 3438183451 \VOLUME{01d4264bee777579-ccee841b} Serial number: 0xCCEE841B Origi...
4 2018-07-28 08:21:07+00:00 Creation Time windows:volume:creation \VOLUME{01d4264bee777579-ccee841b} DESKTOP-0QT8017 3438183451 \VOLUME{01d4264bee777579-ccee841b} Serial number: 0xCCEE841B Origi...
5 2018-07-28 08:21:07+00:00 Creation Time windows:volume:creation \VOLUME{01d4264bee777579-ccee841b} DESKTOP-0QT8017 3438183451 \VOLUME{01d4264bee777579-ccee841b} Serial number: 0xCCEE841B Origi...
... ... ... ... ... ... ... ...
204 2018-07-28 08:21:07+00:00 Creation Time windows:volume:creation \VOLUME{01d4264bee777579-ccee841b} DESKTOP-0QT8017 3438183451 \VOLUME{01d4264bee777579-ccee841b} Serial number: 0xCCEE841B Origi...
205 2018-07-28 08:21:07+00:00 Creation Time windows:volume:creation \VOLUME{01d4264bee777579-ccee841b} DESKTOP-0QT8017 3438183451 \VOLUME{01d4264bee777579-ccee841b} Serial number: 0xCCEE841B Origi...
206 2018-07-28 08:21:07+00:00 Creation Time windows:volume:creation \VOLUME{01d4264bee777579-ccee841b} DESKTOP-0QT8017 3438183451 \VOLUME{01d4264bee777579-ccee841b} Serial number: 0xCCEE841B Origi...
207 2018-07-28 08:21:07+00:00 Creation Time windows:volume:creation \VOLUME{01d4264bee777579-ccee841b} DESKTOP-0QT8017 3438183451 \VOLUME{01d4264bee777579-ccee841b} Serial number: 0xCCEE841B Origi...
208 2018-07-28 08:21:07+00:00 Creation Time windows:volume:creation \VOLUME{01d4264bee777579-ccee841b} DESKTOP-0QT8017 3438183451 \VOLUME{01d4264bee777579-ccee841b} Serial number: 0xCCEE841B Origi...
209 2018-07-28 08:21:07+00:00 Creation Time windows:volume:creation \VOLUME{01d4264bee777579-ccee841b} DESKTOP-0QT8017 3438183451 \VOLUME{01d4264bee777579-ccee841b} Serial number: 0xCCEE841B Origi...

210 rows | 7 columns

You can see the VSN in a readable format at the end of the device_path or in the message string. I'm only seeing one value here, so we don't need to determine which drive was the OS one. If we did, I'd look for some system processes that need to run from the OS drive to get the right VSN.

That's good enough for the question, but let's also convert the serial_number field from an integer to the hex format the answer wants, just to be sure:

In [14]:
'{0:08X}'.format(3438183451)
Out [14]:
'CCEE841B'

TeamViewer Questions

The next group of questions involved TeamViewer, a common remote desktop program.

Q: Which user installed Team Viewer?

We can start searching very broadly, then focus in on anything that stands out. Let's just search everything we have for "TeamViewer":

In [15]:
ts_results = ctf.explore(
    'TeamViewer', 
    return_fields='datetime,timestamp_desc,data_type,message', 
    as_pandas=True)
ts_results[['datetime','timestamp_desc','data_type','message']]
Out [15]:
datetime timestamp_desc data_type message
0 1970-01-01 00:00:00+00:00 Last Time Executed windows:registry:userassist [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explo...
1 2007-12-13 09:22:09+00:00 Creation Time pe:compilation:compilation_time PE Type: Driver (SYS) Import hash: fcbe966aa9c0053fe3d2d7f07dbdd41d
2 2016-04-03 20:18:56+00:00 Creation Time pe:compilation:compilation_time PE Type: Executable (EXE) Import hash: 4ea4df5d94204fc550be1874e1b...
3 2016-04-03 20:19:02+00:00 Creation Time pe:compilation:compilation_time PE Type: Executable (EXE) Import hash: e2a592076b17ef8bfb48b7e0396...
4 2017-05-12 08:54:01+00:00 Creation Time pe:compilation:compilation_time PE Type: Driver (SYS) Import hash: bd2fee8a544a1c6656edb847a80a08c5
5 2018-04-11 23:38:22+00:00 Creation Time windows:shell_item:file_entry Name: PROGRA~2 Long name: Program Files (x86) Localized name: @she...
... ... ... ... ...
660 2019-03-20 21:15:21+00:00 Previous Last Time Executed windows:prefetch:execution Prefetch [DLLHOST.EXE] was executed - run count 5 path: \WINDOWS\S...
661 2019-03-20 21:15:28+00:00 Previous Last Time Executed windows:prefetch:execution Prefetch [DLLHOST.EXE] was executed - run count 5 path: \WINDOWS\S...
662 2019-03-20 21:15:36+00:00 Last Time Executed windows:prefetch:execution Prefetch [DLLHOST.EXE] was executed - run count 5 path: \WINDOWS\S...
663 2019-03-20 21:15:59+00:00 Last Time Executed windows:prefetch:execution Prefetch [TASKHOSTW.EXE] was executed - run count 937 path: \WINDO...
664 2019-03-20 21:16:00+00:00 Last Time Executed windows:prefetch:execution Prefetch [DLLHOST.EXE] was executed - run count 25 path: \WINDOWS\...
665 2019-03-20 21:26:28+00:00 Last Time Executed windows:prefetch:execution Prefetch [RUNDLL32.EXE] was executed - run count 3 path: \WINDOWS\...

666 rows | 4 columns

That returned a lot of results (600+). We could page through them all, but why not see if there are any interesting clusters first? That sounds like a job for a visualization!

You can do this multiple ways; I'll do it in Python in a second, but the explanation is a bit complicated. The easier way is to do the search in TImesketch, then go to Charts > Histogram:

alt text

And here's how you'd do something similar in Python:

In [16]:
ts_results = ts_results.set_index('datetime')
ts_results['2018':].message.resample('D').count().plot()
Out [16]:
<matplotlib.axes._subplots.AxesSubplot at 0x7f8ba1ba2450>

Okay, so from the graphs it looks like we have a good cluster at the end of February; let's look closer. I'll slice the results to only show after 2019-02-20:

In [17]:
ts_results = ctf.explore(
    'TeamViewer', 
    return_fields='datetime,timestamp_desc,data_type,filename,message', 
    as_pandas=True)
ts_results = ts_results.set_index('datetime')
ts_results['2019-02-20':][['timestamp_desc','data_type','filename','message']]
Out [17]:
timestamp_desc data_type filename message
datetime
2019-02-25 18:28:14+00:00 Previous Last Time Executed windows:prefetch:execution /Windows/Prefetch/PICKERHOST.EXE-93018817.pf Prefetch [PICKERHOST.EXE] was executed - run count 4 path: \WINDOW...
2019-02-25 20:39:27+00:00 Previous Last Time Executed windows:prefetch:execution /Windows/Prefetch/CHROME.EXE-5FE9909D.pf Prefetch [CHROME.EXE] was executed - run count 3 path: \PROGRAM FI...
2019-02-25 20:39:41+00:00 Last Visited Time chrome:cache:entry /Users/Administrator/AppData/Local/Google/Chrome/User Data/Default... Original URL: https://www.google.com/search?q=teamviewer&oq=teamv&...
2019-02-25 20:39:41+00:00 Last Visited Time chrome:history:page_visited /Users/Administrator/AppData/Local/Google/Chrome/User Data/Default... https://www.google.com/search?q=teamviewer&oq=teamv&aqs=chrome.1.6...
2019-02-25 20:39:46+00:00 Last Visited Time chrome:history:page_visited /Users/Administrator/AppData/Local/Google/Chrome/User Data/Default... https://www.teamviewer.com/en-us/ (Home - TeamViewer) [count: 0] T...
2019-02-25 20:39:46+00:00 Last Visited Time chrome:cache:entry /Users/Administrator/AppData/Local/Google/Chrome/User Data/Default... Original URL: https://static.teamviewer.com/resources/2018/10/logo...
2019-02-25 20:39:54+00:00 Last Visited Time chrome:cache:entry /Users/Administrator/AppData/Local/Google/Chrome/User Data/Default... Original URL: https://www.teamviewer.com/en-us/teamviewer-automati...
2019-02-25 20:39:55+00:00 Last Visited Time chrome:history:page_visited /Users/Administrator/AppData/Local/Google/Chrome/User Data/Default... https://www.teamviewer.com/en-us/teamviewer-automatic-download/ (T...
2019-02-25 20:39:59+00:00 Last Visited Time chrome:cache:entry /Users/Administrator/AppData/Local/Google/Chrome/User Data/Default... Original URL: https://tracking.g2crowd.com/attribution_tracking/co...
2019-02-25 20:40:00+00:00 Last Visited Time chrome:cache:entry /Users/Administrator/AppData/Local/Google/Chrome/User Data/Default... Original URL: https://bat.bing.com/action/0?ti=5712416&Ver=2&mid=4...
2019-02-25 20:40:00+00:00 Last Visited Time chrome:cache:entry /Users/Administrator/AppData/Local/Google/Chrome/User Data/Default... Original URL: https://bat.bing.com/action/0?ti=26037780&Ver=2&mid=...
2019-02-25 20:40:10+00:00 Last Visited Time chrome:cache:entry /Users/Administrator/AppData/Local/Google/Chrome/User Data/Default... Original URL: https://static.teamviewer.com/resources/2018/10/team...
2019-02-25 20:40:47+00:00 Content Modification Time fs:stat /Users/Administrator/AppData/Local/Temp/TeamViewer/tvinfo.ini TSK:/Users/Administrator/AppData/Local/Temp/TeamViewer/tvinfo.ini ...
2019-02-25 20:40:47+00:00 Metadata Modification Time fs:stat /Program Files (x86)/TeamViewer/tvinfo.ini TSK:/Program Files (x86)/TeamViewer/tvinfo.ini Type: file
2019-02-25 20:40:47+00:00 Creation Time fs:stat /Users/Administrator/AppData/Local/Temp/TeamViewer TSK:/Users/Administrator/AppData/Local/Temp/TeamViewer Type: direc...
2019-02-25 20:40:47+00:00 Creation Time fs:stat /Users/Administrator/AppData/Local/Temp/TeamViewer/tvinfo.ini TSK:/Users/Administrator/AppData/Local/Temp/TeamViewer/tvinfo.ini ...
2019-02-25 20:40:47+00:00 Metadata Modification Time fs:stat /Users/Administrator/AppData/Local/Temp/TeamViewer/tvinfo.ini TSK:/Users/Administrator/AppData/Local/Temp/TeamViewer/tvinfo.ini ...
2019-02-25 20:40:47+00:00 Metadata Modification Time fs:stat /Users/Administrator/AppData/Local/Temp/TeamViewer/TeamViewer_.exe TSK:/Users/Administrator/AppData/Local/Temp/TeamViewer/TeamViewer_...
2019-02-25 20:40:47+00:00 Content Modification Time fs:stat /Program Files (x86)/TeamViewer/tvinfo.ini TSK:/Program Files (x86)/TeamViewer/tvinfo.ini Type: file
2019-02-25 20:40:49+00:00 Last Time Executed windows:prefetch:execution /Windows/Prefetch/TEAMVIEWER_.EXE-70DEDD02.pf Prefetch [TEAMVIEWER_.EXE] was executed - run count 1 path: \USERS...
2019-02-25 20:41:04+00:00 Creation Time fs:stat /Users/Administrator/AppData/Local/Temp/TeamViewer/TV14Install.log TSK:/Users/Administrator/AppData/Local/Temp/TeamViewer/TV14Install...
2019-02-25 20:41:06+00:00 Creation Time fs:stat /Program Files (x86)/TeamViewer TSK:/Program Files (x86)/TeamViewer Type: directory
2019-02-25 20:41:06+00:00 Content Modification Time windows:shell_item:file_entry /Users/Public/Desktop/TeamViewer 14.lnk Name: PROGRA~2 Long name: Program Files (x86) Localized name: @she...
2019-02-25 20:41:06+00:00 Content Modification Time windows:shell_item:file_entry /ProgramData/Microsoft/Windows/Start Menu/Programs/TeamViewer 14.lnk Name: PROGRA~2 Long name: Program Files (x86) Localized name: @she...
2019-02-25 20:41:06+00:00 Creation Time windows:shell_item:file_entry /Users/Administrator/AppData/Roaming/Microsoft/Windows/SendTo/Team... Name: TEAMVI~1 Long name: TeamViewer NTFS file reference: 96164-5 ...
2019-02-25 20:41:06+00:00 Creation Time windows:shell_item:file_entry /ProgramData/Microsoft/Windows/Start Menu/Programs/TeamViewer 14.lnk Name: TEAMVI~1 Long name: TeamViewer NTFS file reference: 96164-5 ...
2019-02-25 20:41:06+00:00 Creation Time windows:shell_item:file_entry /Users/Default/AppData/Roaming/Microsoft/Windows/SendTo/TeamViewer... Name: TEAMVI~1 Long name: TeamViewer NTFS file reference: 96164-5 ...
2019-02-25 20:41:06+00:00 Creation Time windows:shell_item:file_entry /Users/SelmaBouvier/AppData/Roaming/Microsoft/Windows/SendTo/TeamV... Name: TEAMVI~1 Long name: TeamViewer NTFS file reference: 96164-5 ...
2019-02-25 20:41:06+00:00 Creation Time windows:shell_item:file_entry /Users/Public/Desktop/TeamViewer 14.lnk Name: TEAMVI~1 Long name: TeamViewer NTFS file reference: 96164-5 ...
2019-02-25 20:41:11+00:00 Creation Time fs:stat /Program Files (x86)/TeamViewer/License.txt TSK:/Program Files (x86)/TeamViewer/License.txt Type: file
... ... ... ... ...
2019-03-20 21:04:58+00:00 Last Access Time fs:stat /Program Files (x86)/TeamViewer/TeamViewer_Note.exe TSK:/Program Files (x86)/TeamViewer/TeamViewer_Note.exe Type: file
2019-03-20 21:04:59+00:00 Last Access Time fs:stat /Program Files (x86)/TeamViewer/uninstall.exe TSK:/Program Files (x86)/TeamViewer/uninstall.exe Type: file
2019-03-20 21:04:59+00:00 Last Access Time fs:stat /Program Files (x86)/TeamViewer/TeamViewer_Resource_cs.dll TSK:/Program Files (x86)/TeamViewer/TeamViewer_Resource_cs.dll Typ...
2019-03-20 21:04:59+00:00 Last Access Time fs:stat /Program Files (x86)/TeamViewer/TeamViewer_Resource_ar.dll TSK:/Program Files (x86)/TeamViewer/TeamViewer_Resource_ar.dll Typ...
2019-03-20 21:04:59+00:00 Last Access Time fs:stat /Program Files (x86)/TeamViewer/TeamViewer_Resource_bg.dll TSK:/Program Files (x86)/TeamViewer/TeamViewer_Resource_bg.dll Typ...
2019-03-20 21:05:00+00:00 Last Access Time fs:stat /Program Files (x86)/TeamViewer/TeamViewer_Resource_el.dll TSK:/Program Files (x86)/TeamViewer/TeamViewer_Resource_el.dll Typ...
2019-03-20 21:05:00+00:00 Last Access Time fs:stat /Program Files (x86)/TeamViewer/TeamViewer_Resource_da.dll TSK:/Program Files (x86)/TeamViewer/TeamViewer_Resource_da.dll Typ...
2019-03-20 21:05:01+00:00 Last Access Time fs:stat /Program Files (x86)/TeamViewer/TeamViewer_Resource_fi.dll TSK:/Program Files (x86)/TeamViewer/TeamViewer_Resource_fi.dll Typ...
2019-03-20 21:05:01+00:00 Last Access Time fs:stat /Program Files (x86)/TeamViewer/TeamViewer_Resource_fr.dll TSK:/Program Files (x86)/TeamViewer/TeamViewer_Resource_fr.dll Typ...
2019-03-20 21:05:01+00:00 Last Access Time fs:stat /Program Files (x86)/TeamViewer/TeamViewer_Resource_he.dll TSK:/Program Files (x86)/TeamViewer/TeamViewer_Resource_he.dll Typ...
2019-03-20 21:05:01+00:00 Last Access Time fs:stat /Program Files (x86)/TeamViewer/TeamViewer_Resource_es.dll TSK:/Program Files (x86)/TeamViewer/TeamViewer_Resource_es.dll Typ...
2019-03-20 21:05:02+00:00 Last Access Time fs:stat /Program Files (x86)/TeamViewer/TeamViewer_Resource_hr.dll TSK:/Program Files (x86)/TeamViewer/TeamViewer_Resource_hr.dll Typ...
2019-03-20 21:05:02+00:00 Last Access Time fs:stat /Program Files (x86)/TeamViewer/TeamViewer_Resource_hu.dll TSK:/Program Files (x86)/TeamViewer/TeamViewer_Resource_hu.dll Typ...
2019-03-20 21:05:19+00:00 Content Modification Time windows:registry:key_value /Windows/appcompat/Programs/Amcache.hve [\Root\InventoryApplication\0000981a481f34fc4fa5d251dda6e3fe712300...
2019-03-20 21:05:20+00:00 Last Access Time fs:stat /Program Files (x86)/TeamViewer/x64 TSK:/Program Files (x86)/TeamViewer/x64 Type: directory
2019-03-20 21:05:20+00:00 Last Access Time fs:stat /Program Files (x86)/TeamViewer/Printer TSK:/Program Files (x86)/TeamViewer/Printer Type: directory
2019-03-20 21:05:20+00:00 Last Access Time fs:stat /Program Files (x86)/TeamViewer/Printer/x64 TSK:/Program Files (x86)/TeamViewer/Printer/x64 Type: directory
2019-03-20 21:05:20+00:00 Last Access Time fs:stat /Program Files (x86)/TeamViewer/outlook TSK:/Program Files (x86)/TeamViewer/outlook Type: directory
2019-03-20 21:05:24+00:00 Last Time Executed windows:prefetch:execution /Windows/Prefetch/RUNDLL32.EXE-F52D40E6.pf Prefetch [RUNDLL32.EXE] was executed - run count 36 path: \WINDOWS...
2019-03-20 21:05:43+00:00 Content Modification Time windows:registry:key_value /Windows/System32/config/SYSTEM [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Par...
2019-03-20 21:05:59+00:00 Previous Last Time Executed windows:prefetch:execution /Windows/Prefetch/TASKHOSTW.EXE-4DB99E1B.pf Prefetch [TASKHOSTW.EXE] was executed - run count 937 path: \WINDO...
2019-03-20 21:06:00+00:00 Previous Last Time Executed windows:prefetch:execution /Windows/Prefetch/DLLHOST.EXE-79BA10F2.pf Prefetch [DLLHOST.EXE] was executed - run count 25 path: \WINDOWS\...
2019-03-20 21:08:32+00:00 Previous Last Time Executed windows:prefetch:execution /Windows/Prefetch/DLLHOST.EXE-95989D99.pf Prefetch [DLLHOST.EXE] was executed - run count 5 path: \WINDOWS\S...
2019-03-20 21:10:56+00:00 Previous Last Time Executed windows:prefetch:execution /Windows/Prefetch/TASKHOSTW.EXE-4DB99E1B.pf Prefetch [TASKHOSTW.EXE] was executed - run count 937 path: \WINDO...
2019-03-20 21:15:21+00:00 Previous Last Time Executed windows:prefetch:execution /Windows/Prefetch/DLLHOST.EXE-95989D99.pf Prefetch [DLLHOST.EXE] was executed - run count 5 path: \WINDOWS\S...
2019-03-20 21:15:28+00:00 Previous Last Time Executed windows:prefetch:execution /Windows/Prefetch/DLLHOST.EXE-95989D99.pf Prefetch [DLLHOST.EXE] was executed - run count 5 path: \WINDOWS\S...
2019-03-20 21:15:36+00:00 Last Time Executed windows:prefetch:execution /Windows/Prefetch/DLLHOST.EXE-95989D99.pf Prefetch [DLLHOST.EXE] was executed - run count 5 path: \WINDOWS\S...
2019-03-20 21:15:59+00:00 Last Time Executed windows:prefetch:execution /Windows/Prefetch/TASKHOSTW.EXE-4DB99E1B.pf Prefetch [TASKHOSTW.EXE] was executed - run count 937 path: \WINDO...
2019-03-20 21:16:00+00:00 Last Time Executed windows:prefetch:execution /Windows/Prefetch/DLLHOST.EXE-79BA10F2.pf Prefetch [DLLHOST.EXE] was executed - run count 25 path: \WINDOWS\...
2019-03-20 21:26:28+00:00 Last Time Executed windows:prefetch:execution /Windows/Prefetch/RUNDLL32.EXE-A7B4E4F7.pf Prefetch [RUNDLL32.EXE] was executed - run count 3 path: \WINDOWS\...

632 rows | 4 columns

So from this, in a short interval starting 2019-02-25T20:39, we can see:

  • a Google search for "teamviewer"
  • a visit in Chrome to teamviewer.com,
  • then teamviewer.com/en-us/teamviewer-automatic-download/,
  • and lastly a bunch of TeamViewer related files being created.

The web browser and files created were done under the Administrator account (per the path filename), so that's our answer.

Q: How Many Times

At least how many times did the teamviewer_desktop.exe run?

Prefetch is a great artifact for "how many times did something run"-type questions, so let's look for Prefetch execution entries for the program in question:

In [18]:
ts_results = ctf.explore(
    'data_type:"windows:prefetch:execution" AND teamviewer_desktop.exe', 
    return_fields='datetime,timestamp_desc,data_type,executable,run_count,message', 
    as_pandas=True)
ts_results[['datetime','timestamp_desc','data_type','executable','run_count','message']]
Out [18]:
datetime timestamp_desc data_type executable run_count message
0 2019-03-18 17:59:21+00:00 Previous Last Time Executed windows:prefetch:execution TEAMVIEWER_DESKTOP.EXE 3 Prefetch [TEAMVIEWER_DESKTOP.EXE] was executed - run count 3 path:...
1 2019-03-18 18:34:19+00:00 Previous Last Time Executed windows:prefetch:execution TEAMVIEWER_DESKTOP.EXE 3 Prefetch [TEAMVIEWER_DESKTOP.EXE] was executed - run count 3 path:...
2 2019-03-18 18:36:49+00:00 Last Time Executed windows:prefetch:execution TEAMVIEWER_DESKTOP.EXE 3 Prefetch [TEAMVIEWER_DESKTOP.EXE] was executed - run count 3 path:...

Q: Execute Where

After looking at the TEAMVIEWER_DESKTOP.EXE prefetch file, which path was the executable in at the time of execution?

We did all the work for this question with the previous query (the answer is in the message string), but we can explicitly query for the path:

In [19]:
ts_results = ctf.explore(
    'data_type:"windows:prefetch:execution" AND teamviewer_desktop.exe', 
    return_fields='datetime,timestamp_desc,data_type,executable,run_count,path', 
    as_pandas=True)
ts_results[['datetime','timestamp_desc','data_type','executable','run_count','path']]
Out [19]:
datetime timestamp_desc data_type executable run_count path
0 2019-03-18 17:59:21+00:00 Previous Last Time Executed windows:prefetch:execution TEAMVIEWER_DESKTOP.EXE 3 \PROGRAM FILES (X86)\TEAMVIEWER\TEAMVIEWER_DESKTOP.EXE
1 2019-03-18 18:34:19+00:00 Previous Last Time Executed windows:prefetch:execution TEAMVIEWER_DESKTOP.EXE 3 \PROGRAM FILES (X86)\TEAMVIEWER\TEAMVIEWER_DESKTOP.EXE
2 2019-03-18 18:36:49+00:00 Last Time Executed windows:prefetch:execution TEAMVIEWER_DESKTOP.EXE 3 \PROGRAM FILES (X86)\TEAMVIEWER\TEAMVIEWER_DESKTOP.EXE

Registry Questions

This last set of questions can be answered using the Windows Registry (and one from event logs).

Lots of registry questions depend on the Current Control Set, so let's verify what it is:

In [20]:
# Escaping fun: We need to escape the slashes in the key_path once for Timesketch and once for Python, so we'll have triple slashes (\\\)
ts_results = ctf.explore(
    'data_type:"windows:registry:key_value" AND key_path:"HKEY_LOCAL_MACHINE\\\System\\\Select"', 
    return_fields='datetime,timestamp_desc,data_type,message', 
    as_pandas=True)
ts_results[['datetime','timestamp_desc','data_type','message']]
Out [20]:
datetime timestamp_desc data_type message
0 2018-04-11 23:38:44+00:00 Content Modification Time windows:registry:key_value [HKEY_LOCAL_MACHINE\System\Select] Current: [REG_DWORD_LE] 1 Defau...

From the message, the Current control set is 1.

Q: What was the timezone offset at the time of imaging? and What is the timezone of the Desktop

I'm combining these, since the answer is in the same query:

In [21]:
ts_results = ctf.explore(
    'data_type:"windows:registry:key_value" AND key_path:"HKEY_LOCAL_MACHINE\\\System\\\ControlSet001\\\Control\\\TimeZoneInformation"', 
    return_fields='datetime,timestamp_desc,data_type,message', 
    as_pandas=True)
ts_results[['datetime','timestamp_desc','data_type','message']]
Out [21]:
datetime timestamp_desc data_type message
0 2019-03-10 10:00:00+00:00 Content Modification Time windows:registry:key_value [HKEY_LOCAL_MACHINE\System\ControlSet001\Control\TimeZoneInformati...

The message is really long; let's pull it out:

In [22]:
set(ts_results.message)
Out [22]:
{u'[HKEY_LOCAL_MACHINE\\System\\ControlSet001\\Control\\TimeZoneInformation] ActiveTimeBias: 420 Bias: 480 DaylightBias: -60 DaylightName: @tzres.dll,-211 DynamicDaylightTimeDisabled: 0 StandardBias: 0 StandardName: @tzres.dll,-212 TimeZoneKeyName: Pacific Standard Time'}

The name of the Timezone is in the message string, as is the ActiveTimeBias, which we can use to get the UTC offset:

In [23]:
# The ActiveTimeBias is in minutes, so divide by -60 (I don't know why it's stored negative): 
420 / -60
Out [23]:
-7

Q: When was the Windows OS installed?

Plaso actually parses this out as its own data_type, so querying for it is easy:

In [24]:
ts_results = ctf.explore(
    'data_type:"windows:registry:installation"', 
    return_fields='datetime,timestamp_desc,data_type,message', 
    as_pandas=True)
ts_results[['datetime','timestamp_desc','data_type','message']]
Out [24]:
datetime timestamp_desc data_type message
0 1970-01-01 00:00:00+00:00 Installation Time windows:registry:installation Windows 10 Enterprise 6.3 Owner: owner Origin: HKEY_LOCAL_MACHINE\...
1 2018-07-28 07:27:53+00:00 Installation Time windows:registry:installation Windows 10 Enterprise 6.3 Owner: owner Origin: HKEY_LOCAL_MACHINE\...

Q: What is the IP address of the Desktop?

We already confirmed the Control Set is 001, so let's query for the registry key under that control set that holds the Interface information:

In [25]:
ts_results = ctf.explore(
    'key_path:"System\\\ControlSet001\\\Services\\\Tcpip\\\Parameters\\\Interfaces"', 
    return_fields='datetime,timestamp_desc,data_type,message', 
    as_pandas=True)
ts_results[['datetime','timestamp_desc','data_type','message']]
Out [25]:
datetime timestamp_desc data_type message
0 2018-07-28 07:24:53+00:00 Content Modification Time windows:registry:key_value [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters...
1 2018-07-28 07:25:03+00:00 Content Modification Time windows:registry:key_value [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters...
2 2018-07-28 07:36:43+00:00 Content Modification Time windows:registry:key_value [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters...
3 2019-03-20 20:55:53+00:00 Content Modification Time windows:registry:key_value [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters...

There are a few entries, but only the last one has what we want. Reading through it (or using Ctrl+F) we can find the 'IPAddress' is 64.44.141.76.

In [26]:
set(ts_results.message)
Out [26]:
{u'[HKEY_LOCAL_MACHINE\\System\\ControlSet001\\Services\\Tcpip\\Parameters\\Interfaces\\{237df97c-14eb-4ba8-af9e-a99d8dd8b936}] AddressType: [REG_DWORD_LE] 0 DhcpConnForceBroadcastFlag: [REG_DWORD_LE] 0 DhcpDefaultGateway: [REG_MULTI_SZ] 64.44.141.1 DhcpGatewayHardware: [REG_BINARY] DhcpGatewayHardwareCount: [REG_DWORD_LE] 1 DhcpIPAddress: [REG_SZ] 64.44.141.76 DhcpInterfaceOptions: [REG_BINARY] DhcpNameServer: [REG_SZ] 8.8.8.8 8.8.4.4 DhcpServer: [REG_SZ] 167.88.4.2 DhcpSubnetMask: [REG_SZ] 255.255.255.0 DhcpSubnetMaskOpt: [REG_MULTI_SZ] 255.255.255.0 Domain: [REG_SZ]  EnableDHCP: [REG_DWORD_LE] 1 IsServerNapAware: [REG_DWORD_LE] 0 Lease: [REG_DWORD_LE] 21600000 LeaseObtainedTime: [REG_DWORD_LE] 28 LeaseTerminatesTime: [REG_DWORD_LE] 21600028 NameServer: [REG_SZ]  T1: [REG_DWORD_LE] 10800028 T2: [REG_DWORD_LE] 18900028',
 u'[HKEY_LOCAL_MACHINE\\System\\ControlSet001\\Services\\Tcpip\\Parameters\\Interfaces\\{33b71fd7-9aaa-4528-a0e5-006a2123864a}] Domain: [REG_SZ]  EnableDHCP: [REG_DWORD_LE] 1 NameServer: [REG_SZ] ',
 u'[HKEY_LOCAL_MACHINE\\System\\ControlSet001\\Services\\Tcpip\\Parameters\\Interfaces\\{ac3af346-923f-11e8-87fa-806e6f6e6963}] Value: No values stored in key.',
 u'[HKEY_LOCAL_MACHINE\\System\\ControlSet001\\Services\\Tcpip\\Parameters\\Interfaces] Value: No values stored in key.'}

Q: Which User Shutdown Windows on February 25th 2019?

Event logs seem like a good place to look for this answer, since a shutdown generates a 1074 event in the System event log. From the question, we have a fairly-narrow timeframe, so let's slice the results down to that after we do our query:

In [27]:
ts_results = ctf.explore(
    'data_type:"windows:evtx:record" AND filename:"System.evtx" AND 1074', 
    return_fields='datetime,timestamp_desc,data_type,username,message', 
    as_pandas=True)
ts_results = ts_results.set_index('datetime')
ts_results['2019-02-25':'2019-02-26'][['timestamp_desc','data_type','username','message']]
Out [27]:
timestamp_desc data_type username message
datetime
2019-02-25 20:04:42+00:00 Content Modification Time windows:evtx:record Administrator [1074 / 0x0432] Source Name: User32 Strings: ['C:\Windows\System32...
2019-02-25 20:13:53+00:00 Content Modification Time windows:evtx:record Administrator [1074 / 0x0432] Source Name: User32 Strings: ['C:\Windows\System32...

Wrap Up

That's it! Thanks for reading and I hope you found this useful. This walkthrough covered most of the questions from the 'Basic - Desktop' category; I may do other sections as well if there is time/interest. If you found this useful, check out Kristinn's demonstration of Timesketch and Colab.

You can get the free, open source tools I used to solve the CTF: