{"id":1106,"date":"2021-05-23T16:25:30","date_gmt":"2021-05-23T16:25:30","guid":{"rendered":"https:\/\/cas.cybercop-training.ch\/?page_id=1106"},"modified":"2021-05-31T10:07:36","modified_gmt":"2021-05-31T10:07:36","slug":"timestomping","status":"publish","type":"page","link":"https:\/\/cas.cybercop-training.ch\/index.php\/timestomping\/","title":{"rendered":"Timestomping"},"content":{"rendered":"<h2>1. Introduction<\/h2>\n<ul>\n<li>At the RatherInsecure Bank, a USB Stick is used to import account data into the core banking system.<\/li>\n<li>The employee in charge of the import left the USB Stick unattended for several days.<\/li>\n<li>Shortly after the next import, a customer complained that money was missing from his account with number 222222222.<\/li>\n<li>It was quickly determined, that customer Adams somehow gained access to the account. The current assumption is, that a new file was created on the USB Stick, which was wrongfully imported. It is unclear when this happened.<\/li>\n<li>Another analyst has already created an image of the found stick using dd and made it available to you under RESOURCES.<\/li>\n<\/ul>\n<p>Your task is to:<\/p>\n<ul>\n<li>Analyze the data on the USB Stick. Describe what files were created directly on the usb stick and which ones were probably moved (volume move) there.<\/li>\n<li>Describe two different time anomalies that are observed while analyzing the USB Stick.<\/li>\n<li>Determine what file timestamps were tempered with.<\/li>\n<li>Determine the real time the file NewestAccounts.txt was created \/ last modified<\/li>\n<\/ul>\n<h2>2. Linux analysis<\/h2>\n<p>Mount dd image in read only mode<\/p>\n<blockquote>\n<p>mount -o ro,loop,show_sys_files,streams_interface=windows timestomping.dd \/mnt\/usb_disk2<\/p>\n<p>ls -lia<\/p>\n<\/blockquote>\n<p><img decoding=\"async\" src=\"https:\/\/cas.cybercop-training.ch\/wp-content\/uploads\/2021\/05\/time01.png\" alt=\"\" \/><\/p>\n<p>Here we can see the first anamoly. The <code>inode number<\/code> \/ file id usually roughly aligns with the time when a file is created.<br \/>\nNotice, how the file <code>NewestAccounts.txt<\/code> has an inode number of 41 but is created significantly earlier (Apr 1 2019) than other files on the device!<\/p>\n<p>Let&#8217;s have a closer look on the timestamp:<\/p>\n<blockquote>\n<p>ls- full-time<\/p>\n<\/blockquote>\n<p><img decoding=\"async\" src=\"https:\/\/cas.cybercop-training.ch\/wp-content\/uploads\/2021\/05\/time02.png\" alt=\"\" \/><\/p>\n<p>It is highly unlikely that a file ever has a millisecond timestamp of zero on an NTFS filesystem.<\/p>\n<ul>\n<li>However, the file NewestAccounts.txt does have such a zero millisecond timestamp (000000000 in 17:30:32.000000000).<\/li>\n<li>This is a very direct indication towards the presence of timestomping.<\/li>\n<li>Furthermore, the timestamp is created from another timezone than the other files present on the drive. This is indicated by the offset -0400 (instead of -0500).<\/li>\n<\/ul>\n<p>For the next analysis I&#8217;ll use <code>the sleuth kit<\/code><\/p>\n<blockquote>\n<p>fls -r .\/timestomping.dd | grep &#8218;NewestAccounts&#8216;<\/p>\n<\/blockquote>\n<p><img decoding=\"async\" src=\"https:\/\/cas.cybercop-training.ch\/wp-content\/uploads\/2021\/05\/time03.png\" alt=\"\" \/><\/p>\n<p>Use <code>istat<\/code> to determine the timestamps of the MFT for the according file:<\/p>\n<pre><code>\u256d\u2500 ~\/Desktop\/Exercises\/10 - Forensics\/Timestomping                           \u2714 \n\u2570\u2500 istat .\/timestomping.dd 41-128-1                                       \nMFT Entry Header Values:\nEntry: 41        Sequence: 1\n$LogFile Sequence Number: 2113362\nAllocated File\nLinks: 1\n\n$STANDARD_INFORMATION Attribute Values:\nFlags: Archive\nOwner ID: 0\nSecurity ID: 264  ()\nCreated:    2019-04-01 11:30:32.000000000 (EDT)\nFile Modified:  2019-04-01 11:30:32.000000000 (EDT)\nMFT Modified:   2021-03-03 02:25:24.535884000 (EST)\nAccessed:   2019-04-01 11:30:32.000000000 (EDT)\n\n$FILE_NAME Attribute Values:\nFlags: Archive\nName: NewestAccounts.txt\nParent MFT Entry: 5     Sequence: 5\nAllocated Size: 0       Actual Size: 0\nCreated:    2021-03-03 02:20:13.277008400 (EST)\nFile Modified:  2021-03-03 02:20:13.277008400 (EST)\nMFT Modified:   2021-03-03 02:20:13.277008400 (EST)\nAccessed:   2021-03-03 02:20:13.277008400 (EST)\n\nAttributes: \nType: $STANDARD_INFORMATION (16-0)   Name: N\/A   Resident   size: 72\nType: $FILE_NAME (48-2)   Name: N\/A   Resident   size: 102\nType: $DATA (128-1)   Name: N\/A   Resident   size: 440\n<\/code><\/pre>\n<p>There is another tool called analyzeMFT.py<br \/>\nI&#8217;ll start it in a python2 environment<\/p>\n<blockquote>\n<p>python analyzeMFT.py -a -f \/mnt\/usb_image\/\\$MFT -o ..\/MFTanomalies.csv -p<\/p>\n<\/blockquote>\n<p><img decoding=\"async\" src=\"https:\/\/cas.cybercop-training.ch\/wp-content\/uploads\/2021\/05\/time04.png\" alt=\"\" \/><\/p>\n<h2>3. Windows analysis<\/h2>\n<p>On the windows side I use FTK Imager to mount the <code>dd image<\/code><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cas.cybercop-training.ch\/wp-content\/uploads\/2021\/05\/time05.png\" alt=\"\" \/><\/p>\n<p>I extract the $MFT file and do a further analysis with the forensic tool <code>MFTECmd.exe<\/code><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cas.cybercop-training.ch\/wp-content\/uploads\/2021\/05\/time06.png\" alt=\"\" \/><\/p>\n<p>With TimelineExplorer we can the I load the generated CSV File and search for further anomalies.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cas.cybercop-training.ch\/wp-content\/uploads\/2021\/05\/time07.png\" alt=\"\" \/><\/p>\n<p>The file <code>NewAccounts.txt<\/code> was probably moved to the USB Stick<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cas.cybercop-training.ch\/wp-content\/uploads\/2021\/05\/time08.png\" alt=\"\" \/><\/p>\n<p>For the modification of the timestamps, please have a look on the output from <code>istat<\/code> above.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>1. Introduction At the RatherInsecure Bank, a USB Stick is used to import account data into the core banking system. The employee in charge of the import left the USB Stick unattended for several days. Shortly after the next import, a customer complained that money was missing from his account with number 222222222. It was [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-1106","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/pages\/1106","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/comments?post=1106"}],"version-history":[{"count":2,"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/pages\/1106\/revisions"}],"predecessor-version":[{"id":1230,"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/pages\/1106\/revisions\/1230"}],"wp:attachment":[{"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/media?parent=1106"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}