SRUM Forensics

Delving into the world of SRUM forensics.

Transcript

1. Veronica Schmitt
2. whoami Veronica Schmitt P01z0n_P1x13 Slides Published online: • https://medium.com/ • @P01z0n_P1x13 • veronica@dfirlabs.com • www.dfirlabs.com
4. What does it monitor? 1 3 5 2 4
5. • • • • • • •
6. NOT AVAILABLE
10. SRUM Energy Usage (Long Term)
15. • Timestamps are in UTC in OLE format (64 bits) and FILETIME format (64 bits) • Network interfaces are specified as InterfaceLuid (NET_LUID)
18. Prefetch file records start time of process, not duration
19. • Prefetch only retains last 8 start times, no record of prior runs • SRUM can tell you if an app was run or not
21. Downloads to Ares and Utorrent and he was running OpenVPN
22. Application Resource Manager
25. Energy Usage
26. Well, what did we find...
27. • Utorrent and Ares downloading. • Network connected to and total downloads. • TOR being used • Veracrypt • Ccleaner being run. • OpenVPN being used • Skype Activity • Viber Chat Activity
28. Using srum-dump-master https://github.com/MarkBaggett/srum-dump LET'S DO THIS