🔍 Want to see what USB devices were plugged into a system?

Check the Registry key:
HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR

Each subkey represents a device, storing its serial number, make, and model.

#LearningDFIR #DFIR

Transferring my existing Windows forensics for IR course to Podia to finally make it online available.

#LearningDFIR #DFIR

You can use the command line tool ewfverify to calculate the hash value and verify a forensic image on Linux in the EWF
format (Expert Witness Compression Format):

sudo apt install ewf-tools
ewfverify <>

It works on single files as well as multiple part files.

#LearningDFIR #DFIR

I realised that some of the knowledge I have stored away and tips are useful, should I keep doing the small #dfir tips each day to help people #learningdfir ?

Inspired after teaching my class at 0xCC the last few days

What Are Shellbags?

Shellbags are Windows artefacts that track folders a user has accessed via the File Explorer. They store view settings and folder paths, even for folders that have since been deleted.

#LearningDFIR #DFIR

Windows loads applications at startup via specific registry keys.

Registry paths:
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Review for suspicious entries or executables in unusual locations.
#LearningDFIR #DFIR

WMI can be abused for stealthy persistence.

🔍 Check registry:
HKLM\SOFTWARE\Microsoft\Wbem\CIMOM

Investigate:

__EventFilter

__EventConsumer

__FilterToConsumerBinding

#DFIR #LearningDFIR #ThreatHunting

The Master File Table (MFT) is a crucial component of the NTFS file system used by Windows operating systems. It functions as a central database that records information about every file and directory on an NTFS volume.

#DFIR #LearningDFIR

Without gatekeepers, there is a single barrier to entry when it comes to #dfir and that's hardware. You NEED a beast in most instances to do the work effectively.

I am not sure if there is a way around it? Cloud isn't the answer cause that's also $$$.

Thoughts??

#LearningDFIR #HomeLabs

NTUSER.DAT is a system file found in every user profile on a Windows system. It stores the user's Registry hive under HKEY_CURRENT_USER (HKCU).

🧠 Inside?

* Program settings
* Recent files
* User preferences
* Evidence of activity

#DFIR #LearningDFIR #WindowsForensics

Identify user logins using Windows Security Event Logs. These are stored in: C:\Windows\System32\winevt\Logs\Security.evtx

Watch for Event IDs that show login activity and privilege use. #LearningDFIR #DFIR

Attackers often establish persistence or move laterally by creating services.

🧠 Check for Event ID 7045 in the System log

<>

#DFIR #LearningDFIR

C'mon those #LearningDFIR or interested!

#PopQuiz