MoonSols Windows Memory Toolkit

Matthieu Suiche has "made the move in a new direction" and created a new website and toolkit. His new site/company is MoonSols.

Matthieu states:

MoonSols is releasing his first product called "MoonSols Windows Memory Toolkit". MoonSols Windows Memory Toolkit is the most advanced toolkit for Windows physical memory snapshot management.

MoonSols Windows Memory Toolkit had been designed to deal with Microsoft Windows hibernation file (from Microsoft Windows XP to Microsoft Windows 7 in both 32-bits and 64-bits (x64) Editions), Microsoft full memory crashdump (in both 32-bits and 64-bits (x64) Editions), and raw memory dump files (from memory acquisition tools like win32dd or win64dd, or Virtualization application like VMWare). Moreover, MoonSols Windows Memory Toolkit also contains new version of win32dd and win64dd.

Two versions are available - Community (free) and Professional (cost).

Matthieu's WinDD tool has been part of our lab's Incident Response toolset for almost 2 years now. I expect that testing of his toolset will be equally as effective as WinDD.

The continued R&D and commitment of persons like Matthieu (and several others) continue to move our profession forward - almost at a rate that is difficult to keep up with :)

What are you telling your investigators/officers?

We had some discussion over the last few weeks about the ability (or inability) of non-forensically trained investigators to assist in the collection of digital evidence at crime scenes.

As we see the field of forensics adopting a stronger move towards live acquisitions (including RAM, certain (un)scripted processes and eventually the hard drive), we are wondering what we should be tasking our investigators to do. Our unir simply cannot assist at every scene. Too many cases and far too wide a geographical area. Is pulling the plug in these circumstances still acceptable? Should we be moving to a "Cofee-type" procedure where little training is required. One significant challenge is the numerous different areas in which our officers must acquire and maintain skills (in traditional policing areas). Can we really expect them to rise to a new level??

Any comments or suggestions would be welcome.

Knew it was going to happen....

It finally happened. Those "old school" forensic practices caught some colleagues while seizing a Dell laptop. The old practice of pulling the plug led to the drive being inaccessible when they returned to the lab due to a bios password being present. The actual hard drive was removed but various imaging techniques did not work. That being said, RAM had been imaged and a password was located in RAM (for an email account). Luckily the password was the same and we were able to access the drive.

One more reason to hasten our move to 100% live imaging at the scene; grabbing both the RAM and the drive. One more reason to get F-Response for everyone in the office!

FYI...once we had the password, we booted the laptop (with hard drive enclosed) using Helix Pro. Using Helix, we imaged the drive to a RW-mounted wiped external USB drive. Worked like a charm.

Good guys 1 - Bad guys 0 (but just barely).

Caine v1.0

I see that CAINE has released v1.0 today - from it's previous 0.5 release. From an initial view, it appears that many of the included programs have been updated. Overall, it has a nice selection of tools, including those used for both acquisition and analysis (Sleuthkit 3.01, MDD, Autopsy 2.21, Winen, Win32DD and probably about another 50 tools). Clear instructions on how to create a bootable USB drive as well.

The mounting policy claimed by the program states that it is the "same as Helix" and when the user clicks on a drive, it will mount as read-only. If the user mounts in terminal, it will mount "rw" by default unless the necessary "ro" commands are included.

Not sure how you feel about these all-inclusive tool sets, but like SIFT, it's nice to have all the necessary tools in a bootable CD or VM. Reboot and your workspace is clear.

Downloading v1.0 right now......let's take it for a spin!

Live Forensics just got a little easier....

Matthieu Suiche has released his latest version of his imaging tool "win32dd" (v. 1.3 final). Up until now, I've been using FastDump Pro and Winen as my imaging tools, largely because of the robustness and wide range of OS's, >4GB and 32vs64 bit platform support. With the release of Matthieu's latest tools (which I see has been under beta testing), you can be assured that this tool will also be making it to my list of memory acquisition tools. All this and MD5, SHA1 and SHA256 support.

What I find intriguing about this new product is the fact that you have the option of generating a "blue screen" or send a system into hibernation.

Matthieu has a great slide presentation titled "Challenges of Windows physical memory acquisition and exploitation". The presentation was given at Shakacon2009.

With the enhanced abilities of these tools, I'm interested in finding solutions to faster acquisition times using USB drives. Any comments? (ie: Thumbdrives with fast i/o times, external USB 2.5" drive, SSD, how about a SD card with 30MB/Sec transfer speed?) With larger and larger acquisitions, the time at scene is becoming an issue.

LiveDetector - H11 Digital Forensics

I spent some time testing LiveDetector from H11 Digital Forensics. The program(s) can be run from a CD however, I chose to run it from a USB thumbdrive to allow the output files/report to be exported.

When I first looked at the tool, I noticed that is uses Mantech Memory DD to capture RAM. Although this product captures a nice variety of 32-bit Windows OS's, it is "governed" by a 4GB RAM maximum and I read nothing about it working for 64-bit machines. The GUI is very easy to understand but does not allow for configuration of process (to run). The tool allows you to "Collect Volatile Data" (including or excluding RAM) and "Collect Nonvolatile Data".

Data is exported to a directory defined during the initial screen which allows you to enter case "tombstone" information. Reporting is actually quite nice. Sharp HTML reports with links to report generated by the individually-run apps. The apps are almost exclusively Nirsoft apps.

Overall, the program ran very nice. I'm not sure if the program is at the level that I could recommend it for "forensic" or "incident response" but perhaps for non-evidentiary type data collection. Two other suggestions: consider a more robust RAM acquisition tool and allow a greater degree of configurability ie: allowing user to chose which tools/features to run. .... now that Win32dd has been renamed Windd and supports 64-bit systems. Thanks Matthieu!!

Price: free