DIGITAL FORENSICS:How to Determine the Last Shutdown Time and Date in Windows

หากคุณเป็นผู้ตรวจสอบหลักฐานทางดิจิทัล อาจมีบางครั้งที่คุณจำเป็นต้องทราบประวัติการ ปิดเครื่องของคอมพิวเตอร์ มีหลายวิธี ทำตามขั้นตอนด้านล่างเพื่อดูประวัติการปิดใน Windows เช่น เครื่องมือ Windows ในตัวที่เรียกว่า Event Viewer

Windows Event log.

To find when was a computer last shutdown, check the Event Viewer for the most recent Event ID 1074.

1. Run eventvwr.msc to start the Event Viewer.
2. In the Event Viewer, expand Windows Logs → System
3. Sort the log by Date (descending)
4. Click Filter Current Log… on the right pane.
5. Add event id: 1074 in the Includes list, and enable all event types

Event ID 6005 and 6006

Alternately, you can also look for Event ID 6006 “The Event log service was stopped.” and 6005 “The Event log service was started.” which denotes that a shutdown or a restart event had taken place at the specified time.

Using Windows  registry

Windows also stores the last shutdown date and time in a REG_BINARY value named ShutdownTime in the following

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Windows

ShutdownTime Value = 4A 49 00 25 5C 3D D7 01

Time Decoding Using DCode

• DCode™ – Timestamp Decoder  You can decode values in the form of Little-Endian Hexadecimal, Big-Endian Hexadecimal, 64-bit Integers, 32-bit Integers, Double-precision floating-point numbers and various text formats.

Format  Little-Endian Hexadecimal  Windows Filetime (UTC) 2021-04-30 00:59:59

ShutdownTime Value = 4A 49 00 25 5C 3D D7 01

Working with a forensics image, you can follow the same steps with the image that you’ll have previously mounted as an Item on FTK Imager (or Imager Lite if you prefer).

To do this, you must launch FTK Imager and then click File→Add Evidence Item→Image file and then click on your image.

To extract Registry files you must search in the directory at the path %SystemRoot%\System32\Config, right-click on the file you need them and then select the export option. To extract the System file.

• AccessData Registry Viewer is a program that lets you view the contents of Windows operating system registries.

ShutdownTime Data = 4A 49 00 25 5C 3D D7 01  (30-Apr-21 00:59:59 UTC)

• Registry Recon, developed by Arsenal Recon, is a powerful computer forensics tool used to extract, recover, and parse registry data from Windows systems.

ShutdownTime Data = 4A 49 00 25 5C 3D D7 01  (30 Apr 21 12:59:59 AM UTC)

 Time Decoding Using DCode

อ่านเพิ่มเติม : เวลา UTC คือ

                      

                          HOW TO CHECK WINDOWS INSTALL DATE

REF: Windows Registry extraction with FTK Imager

              Shutdown Time and Date in Windows

 

#WINDOWSFORENSIC #COMPUTERFORENSICS #DFIR #FORENSICS #DIGITALFORENSICS #COMPUTERFORENSIC #INVESTIGATION #CYBERCRIME #FRAUD

หมายเหตุ:เนื้อหาในเว็บไซต์นี้มีขึ้นเพื่อวัตถุประสงค์ในการให้ข้อมูลและเพื่อการศึกษาเท่านั้น
* หากมีข้อมูลข้อผิดพลาดประการใด ขออภัยมา ณ ที่นี้ด้วย  รบกวนแจ้ง Admin เพื่อแก้ไขต่อไป
ขอบคุณครับ

Windows Forensic:Registry Recon

Features

• Efficient harvesting of Registry data from entire disk images

• Resurrection of Registries long since forgotten

• Access to enormous amounts of deleted Registry data

• Unique keys and values shown by default in historical fashion

• Seamless access to all instances of keys and values

• Windows restore point and Volume Shadow Copy support

• Ability to view keys (and their values) at particular points in time

• Automatic decoding of particularly interesting Registry keys

To solve the Windows Forensics challenges, we used the following resources:

• Registry Recon
• CyberChef

.Registry Recon supports adding forensic images in EnCase (E01) and raw (dd) formats, VHD disk images, physically mounted slave drives, and the contents of directories as evidence.

1.Add Evidence  

2. Add Evidence >Mount option

3. Adding Evidence  >add

4. Add Evidence >Enter Evidence Name

5. Adding Evidence > Importing system hives from active windows installs.

6.Adding Evidence >Importing complete.

Process 

7. #Windows-1 Hostname? (DESKTOP-0J3S8C2)

Open the file using a Registry Recon

SYSTEM\ControlSet001\Control\ComputerName\ComputerName registry key. Note the data value of the ComputerName.

8.# Windows-2 Time-zone (UTC)

Still using the Registry Recon and the SYSTEM file, navigate to the SYSTEM\ControlSet001\Control\TimeZoneInformation registry key. Note the data value for TimeZoneKeyName.

9.#Windows-3 Build number (19042)

Open the Registry Recon then navigate to the Software\Microsoft\Windows Nt\CurrentVersion registry key. Note the data value for the CurrentBuildNumber.

10.#Windows-4 Product name

From the same steps and results obtained from the previous challenge, the product name is also listed there (on the same registry key).

11. #Windows-5 SID  (John Doe)

You can also determine a user's SID by looking through the ProfileImagePath values in each S-1-5-21 prefixed SID listed under:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

 Select each SID under this in turn and look at the ProfileImagePath and at the end of this string is the name of the user.

12. Windows-6 TypedURLs  (http://go.microsoft.com)

The last link entered is a bit different. In our case, the browser used is Internet Explorer and the urls are also in the hive. Other browsers usually keep their data in other locations on the drive. The path to the key is NTUSER.DAT\SOFTWARE\Microsoft\Internet Explorer\TypedURLs and the value we are looking for is the first value named url1. The answer is (http://go.microsoft.com)

13.Windows-7   Recently accessced docs folder (HACKPLANET)

(CyberChef  tools )Converts a hexadecimal byte string back into its raw value.

14.Windows-8  Run  (OneDrive.exe)

The key takeaway from the description is “Finding a software that runs when system is restarted”.

So we go to the software registry in Windows\system32\config\ and under Microsoft\Windows\Current Version\Run\, in the execute key

ปัญหาที่พบ

• โปรแกรมยังไม่สามารถ Automate decode ได้ เราต้อง copy ค่าใน Registry ไป  Decode โดยเครื่องมืออื่น ๆ
• supports  forensic images  (E01) and raw (dd) formats, VHD disk images, physically mounted slave drives, and the contents of directories as evidence แต่ไม่สนับสนุน  *.L01,*.AD

Introducing Registry Recon

Refer:Registry Recon

           How to Find a User's Security Identifier (SID) in Windows

#WINDOWSFORENSIC #COMPUTERFORENSICS #DFIR #FORENSICS #DIGITALFORENSICS #COMPUTERFORENSIC #INVESTIGATION #CYBERCRIME #FRAUD #หลักสูตรการพิสูจน์หลักฐานทางดิจิทัล

หมายเหตุ:เนื้อหาในเว็บไซต์นี้มีขึ้นเพื่อวัตถุประสงค์ในการให้ข้อมูลและเพื่อการศึกษาเท่านั้น

* หากมีข้อมูลข้อผิดพลาดประการใด ขออภัยมา ณ ที่นี้ด้วย  รบกวนแจ้ง ADMIN เพื่อแก้ไขต่อไป
ขอบคุณครับ