Tuesday, June 17, 2014

Possible Unknown Field Identified in Prefetch V23

I started looking for a good project where I could start working on a tool that I could use as an example for my series on what to incorporate in a good DFIR tool and show code examples in both Perl and Python along the way. I ended up on a prefetch parser that can send output to a MySQL database for centralization of multiple systems. I will get into why this could be useful later and more details on the tool later. However, some of Harlan Carvey's older posts might give you an idea:

Joachim Metz has documented the the prefetch structure very well (in fact, he updated it this month). You can see his documentation here:

One of the things that grabbed my attention recently about the prefetch is that you can find file reference numbers in it. Something that not many tools will show you. Needless to say, I think I have identified two of the unknown  fields for the metrics array entries (v23) and want to continue doing more testing. (Offset Table Pictures come from Metz's paper).

If you change Unknown1 (offset 24) to Size of 6 and Unknown 2 (offset 28) to Size of two, the fields reflect accurately a file record number and file sequence number. That is to say, if starting at offset 24 for a length of 8 bytes, it reflects that of a file reference field.

Not sure why they would be listed as empty values… so maybe a version thing, I need to look at more files.

Anyways, this example prefetch from the DC3 2009 Challenge seems to line up. I haven’t tested on others yet though. But I have found another prefetch where it does not appear to have a volume information entry but there are metric entries. So it could be helpful to have file references in the metrics and not just in the file reference array.

The File Reference array is pointed to via the Volume Information structures:
I hope this information helps.

Here is the prefetch file I am looking at: https://docs.google.com/file/d/0B0hXPgyAlcJ1TVAxcmIzYkwtNGM 

Hopefully I will finish my tool soon and get back to the series I am wanting to do.

No comments:

Post a Comment