EnScript to decode Yahoo chats in unallocated - UPDATED

A few days ago I posted an EnScript to decode Yahoo chat data in unallocated. You can find the original post here.

I have updated the EnScript to bookmark the data and put the decoded chat data in the comment of the bookmark.

I have also updated the pop-up window that displays when invalid data is encountered.

Download Here

EnScript to decode Yahoo chats in unallocated

Awhile back I created an EnScript to search for keywords that may appear in encrypted yahoo chat logs in unallocated. You can read about that EnScript here.

After creating that EnScript, I created a second one to parse the encrypted chat logs that you may find in unallocated. The following EnScript can be used to decode the chats that you may find in unallocated.

Before running the Enscript, click the cursor on the first character of the UNIX time stamp of the found Yahoo log data in unallocated. The structure of the Yahoo log files are date, type, user, size, message, the a dword null (see below). Once you click the cursor on the first byte of the UNIX timestamp, then run the EnScript and you will need to provide the local Yahoo user name, as this is used as the XOR key.

Here is a screenshot of some yahoo logs in unallocated as well as their structure. Take note where the cursor is placed (solid blue) before running the EnScript.

The cursor is placed on the first byte of the UNIX timestamp and then run the EnScript. It will continue to parse all the messages found until the data structure is no longer valid. After the highlighted data blocks in the picture above, you can see four null bytes, then another UNIX timestamp. The EnScript will continue parsing all the messages as long as it encounters this structure and/or the data values in the TYPE field and USER field contain valid values.

Download Here

EnScript to search unallocated for built-in File Signatures

This EnScript started as a kind of test EnScript for something else, but I thought others may find it useful.

By default, EnCase is installed with several hundred file signatures preconfigured in the File Signature tab. This EnScript uses those and any additional signatures that you may add and searches unallocated space for any that you select (blue check). So if you select all of them, then it will search unallocated for all of them. If you only select the signatures in the graphics folder, then only those will be searched. Any file signatures that are found are catagorized and bookmarked into a bookmark folder.



When you start the EnScript a simple window asks if you want to search on the cluster boundary or sector boundary. Normally, cluster boundary (default) is the best and fastest choice, since all the signatures should be found only on cluster boundaries. If you want to override this option and search on byte boundaries, then check the box. Checking the box will be much slower (about 8 times slower) since it will check the beginning of every sector instead of just the beginning of every cluster.

Once the EnScript is done, it will create a folder in the bookmark tree and then a sub folder for every file signature that you searched for and was found in unallocated.



Benchmark: A search for all included file signatures took 3.5 hours with 40gb of Unallocated space and having the checkbox selected (searching *every* sector).

A search for all included file signatures took 1.5 hours with 40gb of Unallocated space and having the checkbox unselected (searching *every* cluster).

Download Here

Maine State Police CP Project

A few months ago I posted an EnScript and some information about a project by Sgt. Glenn Lang of the Maine Sate Police. You kind find the original post here and EnScript.

Sgt. Lang asked me to post the following message:
----------------------------------------------------------------
Flint Waters and the folks at the Wyoming ICAC have tied our Harvester into their Tool Kit.

Its only been active for a short time, but it has already generated over 40,000 key words to be used in searching for contraband on suspect media.

While I am culling the key words into usable lists I have created a new one from the big list with 265 grep key words that are from some of the most frequently seen CP movies.

If you are interested in this list send me an e-mail and indicate where you are from.

All other items related to this project can be downloaded here:

http://www.mcctf.org/membersonly.htm
User: Guest2
Password: HasHerGL (it is case sensitive)

Sgt. Glenn Lang
Supervisor / ICAC Commander
Maine State Police Computer Crimes Unit
15 Oak Grove Rd. Vassalboro, Maine 04989
Phone (207) 877-8081
Fax (207) 877-8091
glang@mcctf.org
----------------------------------------------------------------

The Top 265 hex keywords are posted here

Maine State Police - Keyword Search & Export EnScript

Maine State Police Keyword Search and export EnScript – v1.0
April 28, 2009
EnCase v 6.13

This post is an update to a previous post here. This is an updated EnScript with new features and an official v1.0 project release. The following description is from the instruction document in the zip file linked below.

1. Introduction

This EnScript was born out of a concept from Sgt. Glenn Lang with the Maine State Police. Sgt. Lang needed a way to quickly and effectively identify known multimedia files that are commonly possessed by persons trafficking and possessing child pornography.

2. How it works

Sgt. Lang had an application named "harvester" written for the purposes of extracting a 10-byte string of hex values from inside any file. The thought was that instead of relying on file headers, to instead grab 10 hex values from the middle of a known video file or graphic file as a "mini" known signature for that specific file. The "harvester" program creates a simple text file with one 10-byte keyword per line (CRLF delimited). Investigators can use the "harvester" program to scan all their known bad media files and extract a mini "signature" for each of them, placing them into a small text file.

This EnScript was designed to read the text file created by "harvester" (or by any other means) and then begins searching the disk for those keywords. TheEnScript was designed to work in two ways. The first way is to search unallocated space, the second it to search all areas of the disk(s) (allocated files and unallocated clusters).

3. Configuration

When you start the EnScript, the investigator is presented with the following initial screen :



A. The first option asks for the text file where the keywords are stored. This text file should be a simple ASCII text file, one 10-byte keyword per line, in the format of:



B. This is the offset into the known file where the keyword was harvested from. The EnScript will search and export using this offset.

C. Total size of export - When a keyword is found, the EnScript will back up “x” bytes, as dictated by the offset value described above. The EnScript will then export from that offset (presumably the beginning of the file) for a total of “x” megabytes, as indicated by this value.

D. File Extension - When a keyword is found and the data around the keyword is exported (as described above), the exported data will be placed into the case default export folder and given the extension as indicated by this value. This is so if the investigator is searching for movie files and the data is carved from unallocated space into the default export folder, the investigator can quickly double click and use a viewer, such as VLC, to view the contents.

E. Comprehensive search - This checkbox dictates how the EnScript will search for the keywords. The normal built-in keyword search process in EnCase searches every byte of the disk (or unallocated cluster object). This EnScript, in an effort to speed this process up, by default, will search for the keyword only at the specified offset of each cluster, then move to the next cluster and look at the specific offset in that cluster and then move again to the next cluster. A typical Windows installation uses the NTFS file system and defaults to a cluster size of 4096 bytes (8 sectors per cluster). This means you are only searching 10 bytes out of those 4096 bytes, effectively only .2% of a cluster. The purpose of this is speed. If you think about how a file will always be saved on disk starting at a cluster boundary, then the keyword your looking for will always be found at the offset you specified in option B into a cluster. Searching the other areas of the cluster is unnecessary.

By checking this box (comprehensive search), the EnScript will instead search every sector. The reason for this option is in case the target drive had some files you are searching for and then the volume was formatted at some point in the past. The formatting process may inadvertently either change the number of sectors per cluster (i.e. was FAT, now is NTFS) or the boundaries of the volume have changed. Therefore, by selecting this option, the EnScript will search for the 10-byte keyword at a specific place in the sector, then move to the next sector and search again at the specific offset. This will increase the amount of time it takes to complete the search, but is still faster than a traditional keyword search where every byte of every sector is searched.

F. Bookmark - This will cause the specific keyword hit to be bookmarked when it found. Check in the bookmarks folder for a folder named “Found keywords in Unallocated – DATE & TIME”.

G. Search all files - The default is for this EnScript to only search unallocated space for the supplied keywords. Checking this box forces the EnScript to search unallocated, as well as every file in the case (allocated files).

4. Console - Real-time information is displayed in the console as the EnScript is running. If a keyword is found, the offset as well as full path of the file of where it was found is displayed.



5. Alert Sound - The EnScript will automatically check for the presence of a .wav file named "alarm.wav" in the “C:\Program Files\EnCase6\” root folder. If this file exists, this .wav file will be played every time a keyword is found during the search process. If the .wav file does not exist, the alert sound function will be skipped, but real-time information is still displayed in the console tab of EnCase.

Project information:
Sgt. Glenn Lang, Maine State Police
glang (at) mcctf.org

Download Here

Keyword List

Video demonstration #1
Video Demonstration #2

Recovering video files in unallocated space

Recently, Sgt. Glenn Lang from the Maine State Police contacted me regarding an EnScript request designed to export some data from keyword hits where he was searching for movie files in unallocated. Sgt. Lang is the ICAC coordinator and does a lot of child exploitation investigations. He has had great success in building some excellent GREP keywords to find movie files in unallocated.

The GREP keywords are usually characters that are located at various offsets inside the video files, not at the beginning. He needed a way to quickly export the suspected video files and view them.

By modifying the previous "export x bytes from a search hit" EnScript, I created an EnScript that will export x bytes in front of the keyword hit and then specify the total number of bytes to export:



It then saves the data into a file named after the original filename where the hit was found (usually unallocated) the search term, the offsets and then you can specify a extension for the export:



You can then double-click and use your registred viewer to view (vlc in this example).

Sgt. Lang has put together some basic videos demonstrating this technique and they can be viewed here:

Adding keywords and starting a search.wmv
Recovering Movies Located Using Harvester Key Words.wmv

Download GREP keyword list here (Import into EnCase Keyword tab)
Download EnScript here

Export IE Internet History from unallocated for use with 3rd party processors

A user recently contacted me about an old v4 EnScript that was used to export Internet Explorer Internet history from Unallocated so it could be processed with NetAnalysis. She asked if I would update the EnScript to work with v6 since she explained that she used NetAnalysis with almost every case and they have become accustomed to the output.

I have updated the EnScript to work with V6. Simply select (blue check) and file(s) you wish to search for IE Internet History (Unallocated, pagfile.sys, hiberfil.sys, etc.) and then run. If any history is found, it will be exported to a file that can then be parsed by NetAnalysis (or other 3rd party tool).

Download Here

Recovering MFT records from unallocated space or $Logfile

The $Logfile in NTFS file systems is a transaction journal of changes to the $MFT. You can commonly find file fragments and MFT records in this file. You can also sometimes find MFT records in unallocated space. MFT records are fairly easy to read once you know the structure, but I wanted an easier what to extract them and put them in a report type display. The value of searching and looking for old MFT records is that you can often find MFT records that show the filename of a file that no longer exists and extract the metadata about that file, such as timestamps and what the parent folder was.

To use this EnScript, conduct a keyword search for the MFT record header of 'FILE'. A good keyword is FILE[0\*] marked as GREP and case sensitive. Search the $Logfile, unallocated or any other file you want. Once the search is completed, view the results and select (blue check) the search hits you want to extract into readable text:



Once you have selected certain search hits (or all of them) run the EnScript and look in the console. Valid MFT records will be decoded and written out into the Console for easy reading and you can copy and paste into a report if you wish:



In the future I will add the search function into the script itself so you don't have to manually perform the search, I was just lazy and wrote it to fulfill a quick need. I also have an Enscript that will decode INDX (directory entries) records found in the $logfile (or any other file you wish) which I will publish soon.

Tested in v6.5
Download Here