AmcacheParser Forensic tools

The Amcache.hve file is a registry file that stores the information of executed applications.

A common location for Amcache.hve is:

\%SystemRoot%\AppCompat\Programs\Amcache.hve

Export >  Amcache.hve

Loading an Amcache.hve hive from a Windows 10 machine into Registry Explorer, we can see the following layout:

Registry Explorer > Open  Amcache.hve

AmcacheParser searches and sorts out cache information from Microsoft Windows` Amcache.hve registry (a file that stores information about recently run applications/programs). It allows users to differentiate between file entities and program entities when searching and exporting information.

#.\AmcacheParser.exe -f "I:\Export\Amcache.hve" --csv I:\Export

Export to csv file.

20220727154302_Amcache_UnassociatedFileEntries.csv  entry, which looks a bit like this:

Full Path:

Refer:

amcache-still-rules-everything-around

AmcacheParser
EricZimmerman

Amcache and Shimcache in forensic analysis

#WINDOWSFORENSIC #COMPUTERFORENSICS #DFIR #FORENSICS #DIGITALFORENSICS #COMPUTERFORENSIC #INVESTIGATION #CYBERCRIME #FRAUD #หลักสูตรการพิสูจน์หลักฐานทางดิจิทัล

หมายเหตุ:เนื้อหาในเว็บไซต์นี้มีขึ้นเพื่อวัตถุประสงค์ในการให้ข้อมูลและเพื่อการศึกษาเท่านั้น

* หากมีข้อมูลข้อผิดพลาดประการใด ขออภัยมา ณ ที่นี้ด้วย  รบกวนแจ้ง ADMIN เพื่อแก้ไขต่อไป
ขอบคุณครับ

DIGITAL FORENSICS: Booting a forensics image on a Virtual Machine

Starting with V9. of OSForensics, booting a forensic image of a system disk as a virtual machine has never been easier.

When performing forensic investigation on an image of a target system drive, it is often necessary to recreate and examine the live environment of the system to acquire all relevant data during the investigation. By running the image as a live system, the investigator can perform a live forensic analysis of the image, allowing for the potential discovery of additional forensic artifacts that may not have been previously uncovered from a traditional static analysis. Finally, because the system is running in a protected virtual environment created from the forensic image file, there is no risk of compromising the target system.

To access this feature from the Start screen, simply click the Boot Virtual Machine icon or module button as shown above.

Users simply need to point OSF to the forensic image file of the target O/S drive, review a few other options and features and click the ‘Boot VM’ button.

Steps

• 1. Select image file.
• 2. Choose OS if image is of a multi-boot system.
• 3. Choose VirtualBox or VM Workstation. (Must be pre-installed)
• 4. Review technical specifications.
• 5. Attach any additional disk images.
• 6. Choose or review VM options and User account to boot.
• 7. Click “Boot VM”
  

After clicking ‘Boot VM’, the real-time log with begin recording all of the processes taking place behind the scenes. Once completed, your VM software will launch and the selected user account will boot…

Analyzing the Live System

Once the boot process is complete, you may begin analyzing and searching through the live system. In addition to being able to review the Desktop layout, the Recycle Bin, and proprietary files in their native application, this also provides a great visual aid for screenshotting evidence to present to a client or in court when necessary.

Screenshots allow you to capture evidence files and artifacts just as they may have appeared through the eyes of the user. Some examples include…

• Jumplists (recent webpages, Word docs, etc.)
• Autorun Apps.
• Previous custom desktop backgrounds
• Settings for certain applications (e.g., CCleaner)
• Search term history from P2P and other applications

Autorun Apps.

A VHD File

Network Drive

Booting a forensic image in VirtualBox with FTK Imager

How to convert an Encase (E01) image using VFC

Forensic Image Virtual Boot:Learn how to create a Virtual Machine from a Forensic Disk Image

Credit:osforensics

 หมายเหตุ:เนื้อหาในเว็บไซต์นี้มีขึ้นเพื่อวัตถุประสงค์ในการให้ข้อมูลและเพื่อการศึกษาเท่านั้น

* หากมีข้อมูลข้อผิดพลาดประการใด ขออภัยมา ณ ที่นี้ด้วย  รบกวนแจ้ง Admin เพื่อแก้ไขต่อไป
ขอบคุณครับ

#WindowsForensic #computerforensic #ComputerForensics #dfir #forensics
#digitalforensics #investigation #cybercrime #fraud

Digital Forensics:The Memory Process File System (MemProcFS)

Digital Forensics:The Memory Process File System (MemProcFS)

The Memory Process File System (MemProcFS) is an easy and convenient way of viewing physical memory as files in a virtual file system.

เป็นเครื่องมือช่วยในการศึกษาหน่วยความจำ (Memory) สามารถดึงข้อมูลจากหน่วยความจำ   ออกมาวิเคราะห์ แบบง่าย ๆ  โดยไม่ต้องใช้อาร์กิวเมนต์ commandline ที่ซับซ้อน!

Install

Windows

Download or clone the Memory Process File System github repository. Pre-built binaries are found in the files folder.

Please download and install the latest version of Dokany at: https://github.com/dokan-dev/dokany/releases/latest It is recommended to download and install the DokanSetup_redist version.

Mounting the file system requires the Dokany file system library to be installed.

#H:\MemProcFS\MemProcFS_files_and_binaries_v4.9.3-win_x64-2

0220718>MemProcFS.exe -device "H:\18 Computer Forensics\CTF\incident-response-challenge.com\Easy - Is that you\Easy - Volatility Find Evil - Is that you\Challenge\memdump.mem" -forensic 1

Python support requires Python 3.6 or later. The user may specify the path to the Python installation with the command line parameter -pythonhome, alternatively download Python 3.7 – Windows x86-64 embeddable zip file and unzip its contents into the files/python folder when using Python modules in the file system.

Mount

Memdump.mem

#M:\sys\proc\Proc.txt

#M:\Registry

ComputerName

#M:\Registry\HKLM\SYSTEM\Contolset001\Control\ComputerName\ComputerName

ProductName

#M:\Registry\HKLM\SOFTWARE\Micorsoft\Windows NT\CurrentVersion\ProdcutName.txt

Windows install Date

#M:\Registry\HKLM\SOFTWARE\Micorsoft\Windows NT\CurrentVersion\InstallDate.txt

ShutdownTime

#M:\Registry\HKLM\SYSTEM\Contolset001\Control\Windows\shutdownTime.txt

#M:\name\spoolsv.exe-1228\memmap\vad.txt

#M:\name\spoolsv.exe-1228\modules\advapi32.dll\fullname.txt

#M:\forensic\ntfs\ntfs_files.txt

timeline_process

#M:\forensic\timeline\timeline_process.txt

YouTube Credit : 13Cubed

Credit:  ufrisk 

อ่านเพิ่ม Memory Forensics

             HOW TO CHECK WINDOWS INSTALL DATE

             

หมายเหตุ:เนื้อหาในเว็บไซต์นี้มีขึ้นเพื่อวัตถุประสงค์ในการให้ข้อมูลและเพื่อการศึกษาเท่านั้น

* หากมีข้อมูลข้อผิดพลาดประการใด ขออภัยมา ณ ที่นี้ด้วย  รบกวนแจ้ง Admin เพื่อแก้ไขต่อไป
ขอบคุณครับ

#WindowsForensic #computerforensic #ComputerForensics #dfir #forensics
#digitalforensics #investigation #cybercrime #fraud

Digital Forensic:CompTIA Cybersecurity Analyst (CySA+)

• Cyber-Incident Response: Summarize the incident recovery and post-incident response process

Domain 3: Cyber Incident Response

• Phases of an incident response
• Creating an incident response team
• How to classify an incident
• Analyzing network events
• Basics of Digital Forensics

Exam objec tives covered in this

chapter :

✓✓ 3.1 Given a scenario, distinguish threat data or behavior

to determine the impact of an incident.

■■ Threat classification

■■ Factors contributing to incident severity and prioritization

✓✓ 3.2 Given a scenario, prepare a toolkit and use

appropriate forensics tools during an investigation.

■■ Forensics kit

■■ Forensic investigation suite

✓✓ 3.3 Explain the importance of communication during the

incident response process.

■■ Stakeholders

■■ Purpose of communication processes

■■ Role-based responsibilities

✓✓ 3.4 Given a scenario, analyze common symptoms to select

the best course of action to support incident response.

■■ Common network-related symptoms

■■ Common host-related symptoms

■■ Common application-related symptoms

✓✓ 3.5 Summarize the incident recovery and post-incident

response process.

■■ Containment techniques

■■ Eradication techniques

■■ Validation

■■ Corrective actions

■■ Incident summary report

Lab Exercises

Create a Disk Image

In this exercise you will use dd to create a disk image and then verify the checksum of

the image.

Part 1: Boot a Kali Linux system and mount a drive

1. Start your Kali Linux virtual machine.

2. Select a USB thumb drive that is formatted as FAT32 to make an image of for this

practice session. A smaller drive will be faster to image, and you should make sure you

image a drive smaller than the space you have available for your Kali Linux system.

3. In the Devices menu for the running Kali virtual machine, select USB and then the

drive you have inserted. The device should now show up on your Kali Linux desktop.

4. Verify that you can navigate to the drive from the command line. Open a terminal

window, then navigate to /dev/disk/by-label, and make sure you see the name of the

thumb drive you have mounted.

Part 2: Clone the drive

1. Create a temporary working directory for your volume by running

mkdir ~/tmp

in your terminal window. This will create a directory called tmp in your home

directory.

2. Create an MD5 checksum of the volume you intend to clone in your home directory:

md5sum /dev/disk/by-label/[label of your drive] > ~/exercise7_1_original.md5

MD5= 027bcfd18c10718550b9dae5adfa0208

DD

• Standard Linux and UNIX tool
• Can clones drives using bit-by-bit copy

3. Clone the volume or disk:

dd if=/dev/disk/by-label/[label of your drive] of=~/tmp/exercise7_1_disk.img bs=64k

4. Once this completes, verify the integrity of the image using MD5:

md5sum ~/tmp/exercise7_1_disk.img > ~/exercise7_1_clone.md5

5. Now compare the MD5 files. You can do that by using the more command to view the

files, or you can record the values here:

MD5= 027bcfd18c10718550b9dae5adfa0208

DD command

Refer: CompTIA CySA+ Practice Tests: Exam CS0-002, 2nd Edition

           CompTIA CySA+ Study Guide Exam CS0-002 2nd Edition

หมายเหตุ:เนื้อหาในเว็บไซต์นี้มีขึ้นเพื่อวัตถุประสงค์ในการให้ข้อมูลและเพื่อการศึกษาเท่านั้น

* หากมีข้อมูลข้อผิดพลาดประการใด ขออภัยมา ณ ที่นี้ด้วย  รบกวนแจ้ง Admin เพื่อแก้ไขต่อไป
ขอบคุณครับ

#WindowsForensic #computerforensic #ComputerForensics #dfir #forensics
#digitalforensics #investigation #cybercrime #fraud

DumpIt

DumpIt  is one of the most widely used lightweight CLI tools for capturing physical volatile memory (RAM) on Windows systems during incident response and digital forensic investigations.

Step-by-Step Execution Guide

1.Prepare External Drive:Prevents evidence contamination.

Download DumpIt.exe and place it onto a clean, forensically formatted external USB drive (e.g., drive letter G:).

Navigate to Tool Directory

2.Open Elevated Command Prompt

Interactive Mode: Simply run DumpIt.exe and type y when prompted to confirm memory capture.

3.Verify Hash and Log File

CertUtil -hashfile E:\Evidence\HOSTNAME_RAM.raw SHA256

4.Output Comparison & Next Steps

Output File   > Auto-generates file named [HOSTNAME]-[TIMESTAMP].raw in tool folder

Once the memory dump file is acquired, you can proceed to offline memory forensics analysis using tools like Volatility 3 or MemProcFS to extract process trees, network connections, injected DLLs, and encryption keys.

* หากมีข้อมูลข้อผิดพลาดประการใด ขออภัยมา ณ ที่นี้ด้วย  รบกวนแจ้ง Admin เพื่อแก้ไขต่อไป
ขอบคุณครับ

#DataBreachCheck #คิดก่อนPrompt #AISecurity #NCSA2026

#WINDOWSFORENSIC #COMPUTERFORENSICS #DFIR #FORENSICS #DIGITALFORENSICS #COMPUTERFORENSIC #INVESTIGATION #CYBERCRIME #FRAUD