Windows Live Triage: USN Journal, Registry Artifacts & a Fake "Cloud Sync" | Live Lab 14

Описание: Dana Kessler's workstation is still running, and that is exactly the point. Pull the plug and you lose the processes, the live network connections and the open handles — none of which ever show up in a disk image. So before we image anything, we do live triage.

Task Manager's Details tab and process Properties. Resource Monitor's live TCP connections and listening ports. Then the NTFS change journal: fsutil usn queryjournal, creating a file and watching Next USN move, dumping the journal to CSV, and turning a File ID back into a full path with fsutil file queryFileNameById.

Then the registry — InstallDate, the DHCP lease timestamps, Winlogon and her SID, RecentDocs spelling out a filename in hex, and a Run key called "HLR Cloud Sync" that turns out to be a batch file quietly robocopying the project folder onto any USB stick that gets plugged in.

This is the first half of a Harbor Light Robotics case. Next lab we image the drive and open it in Autopsy.

Every name, company and file in this lab is fake.

Previous lab (port security):    • Switch Port Security in Packet Tracer: Sti...  

Chapters:
0:00 The machine is still running
0:24 Order of volatility
0:35 Task Manager (and why not the Run box)
0:58 The Details tab
1:11 Process Properties and MAC times
1:36 13 Mbps on an idle machine
1:48 Resource Monitor, elevated
1:57 Live TCP connections
2:20 Listening ports
2:43 fsutil fsinfo ntfsinfo
2:59 The USN journal
3:24 Make a file, watch Next USN move
3:49 You are contaminating the scene
4:12 The HLR-7 Auto-Dock folder
4:25 Finding the file in the journal
4:39 File ID, both directions
5:09 Into the registry
5:32 DHCP lease timestamps
5:45 Winlogon and her SID
6:07 RecentDocs gives up a filename
6:25 The Run key
6:48 cloudsync.bat
7:26 What triage proved, and what it didn't
8:04 Try it yourself
8:14 Next: imaging and Autopsy

This video was made with the help of AI.

Try out my new 5v5 shooter game I built in Roblox, Purge Night: https://www.roblox.com/games/90420890...