Note:I translated Japanese into English using Google Translate.Thank you, Google. Summary: I tested the Recycle.bin delete option of the Storage sense feature. Files in Recycle.bin are deleted by task SilentCleanup??. Sample JPEG file in R…

Note:I translated Japanese into English using Google Translate.Thank you, Google. Summary: I confirmed that the latest Last Access Time is written to disk by accessing the file after 1 hour has elapsed. After one hour elapsed, when shuttin…

Note:I translated Japanese into English using Google Translate.Thank you, Google. Summary: I used FTK Imager and Autopsy as a tool to check Last Access Time on NTFS volume. However, adding Local Drive did not produce the expected results.(…

Note:I translated Japanese into English using Google Translate.Thank you, Google. Summary: NTFS's Last Access Time resolution is one hour. ( I started the test on Win 10 ver 1803.) "fsutil file layout" command and PowerShell displays the l…

Note:I translated Japanese into English using Google Translate.Thank you, Google. I confirmed DisableLastAccess in verification environment. The size of C: is 40 GB.The value of DisableLastAccess was "2" and "Disabled"...."Disabled"??? I c…

Note:I translated Japanese into English using Google Translate.Thank you, Google. Delete the registry key and check the time stamp.Create sample registry keys and values under SYSTEM. Last write timestamp:2018-12-09 05:33:00(UTC) Delete th…

Note:I translated Japanese into English using Google Translate.Thank you, Google. This is the continuation of the Amcache test. I connected a USB memory and created an LNK file.Each LNK file targets the CLI and the GUI program that exist o…

Note:I translated Japanese into English using Google Translate.Thank you, Google. Have you seen the Amcache season of Forensic Lunch Test Kitchen? Unfortunately, I have not seen everything yet. I am planning to enjoy them at the weekend. a…

Note:I translated Japanese into English using Google Translate.Thank you, Google. The File ID of ReFS looks different from NTFS. Using USN Journal, confirm the ReFS File ID. I enabled the USN Journal on the ReFS volume used for testing. Cr…

Note:I translated Japanese into English using Google Translate.Thank you, Google. I got the Refs volume of Win10 1803 as E01 image. You can download it from the following URL. (That is the volume I tested last time.) Win10_1083_Refs.E01htt…

Note:I translated Japanese into English using Google Translate.Thank you, Google. A little while ago I learned that ReFS supports the USN Journal. How do I check the USN Journal on ReFS? Format E: drive with ReFS. Start the administrator c…

Note:I translated Japanese into English using Google Translate.Thank you, Google. When audit setting "Audit PNP Activity" is enabled on Windows 10, event ID 6416 is recorded. Auditing is not enabled for this item by default. Let's check th…

Note:I translated Japanese into English using Google Translate.Thank you, Google. Last week I enjoyed File System Tunneling.Unfortunately, I could not reproduce File System Tunneling with NTFS 'E: drive. This time I use the C: drive for te…

Note:I translated Japanese into English using Google Translate.Thank you, Google. iria_piyo has published some interesting verifications on File System Tunneling in the blog. I read those blogs and I wanted to see how the USN Journal was r…

Note:I translated Japanese into English using Google Translate.Thank you, Google. My question is Can I find timestamp changes using USN Journal? Let's try it.Enable USN Journal with volume E :. Copy the sample JPEG file to the E: drive, us…

Note:I translated Japanese into English using Google Translate.Thank you, Google. Let's create a record labeled (realloc). Create Example folder and create several files in the folder. In the following, a long file name is set to create In…

Note:I translated Japanese into English using Google Translate.Thank you, Google. FireEye has released a report on APT 10's TTPs. I was interested in the method using ESENTUTL tool. https://www.fireeye.com/blog/threat-research/2018/09/apt1…

Note:I translated Japanese into English using Google Translate.Thank you, Google. Let's check NTFS $ObjID:$O and the deleted ObjectID. There is image files on the sample E: drive, but these files do not have an ObjectID. Browse the image f…

Note:I translated Japanese into English using Google Translate.Thank you, Google. Check the record of $LogFile when setting ObjectID.E: drive used for verification is newly formatted with NTFS. Copy the sample JPEG file to the E drive. Thi…

Note:I translated Japanese into English using Google Translate.Thank you, Google. Use $LogFile to check overwriting of the cluster. Two images are used for the test. These two image files are almost the same size. Copy Dragonfly.jpg to for…

Note:I translated Japanese into English using Google Translate.Thank you, Google. Enable USN Journal on sample NTFS volumes and Copy Example.jpg to the Pictures folder. Check the status of ObjectID, ObjectID is not set. Using USN Analytics…

Note:I translated Japanese into English using Google Translate.Thank you, Google. Hop Step Jumplist. Display file 5f7b5f1e01b83767.automaticDestinations-ms with HEX.Only 'DestList' exists in this file. I started explorer and I looked up 4 …

Note:I translated Japanese into English using Google Translate.Thank you, Google. I did not know about the artifacts in the Jumplist mentioned below. http://www.hecfblog.com/2018/07/daily-blog-426-directory-copy-and-paste.html So new as of…

Note:I translated Japanese into English using Google Translate.Thank you, Google. Last week I checked the symbolic link using the mklink command. The Symbolic link reparse data has a field of Print name, but the mklink command can not set …

Note:I translated Japanese into English using Google Translate.Thank you, Google. Today, I would like to confirm the NTFS symbolic link.Copy the JPEG file to the sample VHD Disk. Use the mklink command for this JPEG file to create a symbol…

Note:I translated Japanese into English using Google Translate. Thank you, Google. I will use the sample VHD Disk created last week. $ATTRIBUTE_LIST of FILE record 39 is as follows. Several $FILE_NAME saved in FILE record number 40. Filena…

Note:For experimental purposes, I use Google Translate to convert Blog to English.Unfortunately, I do not know whether it was translated into an appropriate English expression. Please let me know if there is a more appropriate expression. …

NTFSの$MFTファイルをパースするツール”MFTECmd”をEricさんがリリースしています。素晴らしいツールをありがとうございます！ <2018/6/27 Add>ｖ0.2.6.0がリリースされています</add> セキュリティキャンプ2018でE6トラックを選択する若者達には、ぜひ調査で利用し…

先週の続きです。 OSの日付を6月25日へ変更し、レコード削除を発生させます。 OSを再起動し、-wal ファイルがActivitiesCache.dbへ反映された状態にします。 ActivitiesCache.dbファイルをHEXで参照し、ファイル名を検索してみます。 DeleteSample.jpgを発見…

先週の続きです。 テスト環境は先週からずっとシャットダウンしていましたので、先ほど起動しました。 アクティビティの状態を確認します、アクティビティには何も表示されません。 ActivitiesCache.dbファイルをエクスポートします。ActivitiesCache.dbファ…