1
00:00:00,000 --> 00:00:02,680
I'm putting it in the GitHub repo there.

2
00:00:03,120 --> 00:00:10,360
I've got the lab files, I've got the software you need, and I do want to explain this because I know people are already clicking and cloning and stuff like that.

3
00:00:10,440 --> 00:00:15,460
What you're going to need, there's three components to the labs that we're going to do.

4
00:00:15,760 --> 00:00:17,700
One, you're going to need some software.

5
00:00:17,900 --> 00:00:31,480
I did it this way because with the work from home and COVID-19 stuff, I've done at least 20 workshops in the last couple of months, and I've started realizing that people's home internet isn't always reliable and stuff like that.

6
00:00:31,480 --> 00:00:49,000
So the attempt with this, and I've had a couple people say they didn't like it, but I think it saves a lot of us who didn't get a chance to download a 20 gig VM before the workshop, is that rather than doing a virtual machine for you, what you have here is four pieces of software you need that run off of Windows.

7
00:00:49,360 --> 00:00:53,980
So obviously you can get a VM if you want and install those, but any Windows 10 machine should work.

8
00:00:53,980 --> 00:00:57,560
You need the database browser for SQLite, Notepad++.

9
00:00:57,640 --> 00:01:01,740
Obviously you could use Atom or anything else, but that's the one I recommend.

10
00:01:01,740 --> 00:01:07,360
You need a hex editor such as HXD hex editor, and then you do need Registry Explorer.

11
00:01:07,360 --> 00:01:11,520
The one I'm using in the lab is version 1.5.2 or 20.

12
00:01:12,300 --> 00:01:14,660
And then there's three labs we're going to work on.

13
00:01:14,660 --> 00:01:20,020
I don't know if we'll get through all of them or not, but I've got the workthroughs and actually the answers.

14
00:01:20,020 --> 00:01:25,400
So if we only get through one or two of those labs, you've got everything you need.

15
00:01:25,400 --> 00:01:36,060
The third component that's not on the screen here is that what I did is I had a virtual machine with everything throughout the scenario that we're going to talk about.

16
00:01:36,100 --> 00:01:45,920
And with that, I then used Cape to extract the key artifacts that we're going to look for throughout the workshop.

17
00:01:45,920 --> 00:01:52,720
And so rather than getting a whole virtual machine with a couple of interesting things I wanted you to look at, I just extracted those interesting things.

18
00:01:52,720 --> 00:01:58,080
So there's a zip file that's called... let's see if I can find it on my screen here.

19
00:01:58,640 --> 00:02:06,560
It is evidence and then it's a dash, desktop dash, and some random numbers dot zip.

20
00:02:06,560 --> 00:02:10,020
That will need a password of infected all lowercase.

21
00:02:10,020 --> 00:02:12,840
I recommend you not use Windows Explorer to extract it.

22
00:02:12,840 --> 00:02:16,780
It generally has issues realizing that it's encrypted or has a password.

23
00:02:17,820 --> 00:02:19,880
Don't worry, there is no malware.

24
00:02:19,880 --> 00:02:22,780
I just wanted to password protect it and I knew I'd forget what it was called.

25
00:02:22,780 --> 00:02:26,200
So all my workshops I just use infected as the password.

26
00:02:26,320 --> 00:02:35,400
What you're going to have in there is those key artifacts from a Windows 10 machine where an incident happened and we'll kind of walk through that scenario and what that looked like.

27
00:02:35,780 --> 00:02:38,180
Okay, so I'll move on here.

28
00:02:38,820 --> 00:02:43,040
My name is Michael Wiley, Director of Cybersecurity Services at Richie Mae Technology Solutions.

29
00:02:43,140 --> 00:02:46,240
I'm an avid certification collector.

30
00:02:46,840 --> 00:02:48,380
It's just one after another.

31
00:02:48,380 --> 00:02:49,400
I love to learn.

32
00:02:49,400 --> 00:02:56,380
I've been in the industry for a while and the more I learn, the more I realize I don't know and I need to expand my knowledge.

33
00:02:56,380 --> 00:03:00,980
So some people ask why I've got certifications in such different areas.

34
00:03:00,980 --> 00:03:03,540
For example, I've got some pen testing certs.

35
00:03:03,540 --> 00:03:12,000
Then I also have some architecture and design certifications, your CCNAs, and then I also have a Windows Forensics certification.

36
00:03:12,000 --> 00:03:15,160
But I think that all those complement my day-to-day job.

37
00:03:15,260 --> 00:03:22,460
And the more I learn about other fields, I realize how that can help me in the tasks I do, even if I'm not a forensic examinator per se.

38
00:03:22,460 --> 00:03:24,720
I'm not for law enforcement or anything like that.

39
00:03:25,380 --> 00:03:28,460
I've got my LinkedIn and Twitter information on the bottom corner there.

40
00:03:28,520 --> 00:03:29,640
Please connect.

41
00:03:29,640 --> 00:03:31,820
That's probably the best way to get ahold of me after this.

42
00:03:32,160 --> 00:03:37,060
I respond quicker, even quicker than email if you connect with me on LinkedIn.

43
00:03:37,300 --> 00:03:41,800
I also post a lot of things I find relevant or interesting about the industry.

44
00:03:42,100 --> 00:03:47,840
Prior to my joining Richie Mae Technology Solutions, I owned a boutique cyber security firm in Los Angeles.

45
00:03:48,120 --> 00:03:51,140
That's where I really grew a lot of my security skills.

46
00:03:51,300 --> 00:03:58,220
Even though I'm a director now, I'm very hands-on, and I think you'll see that a lot of my workshops and slides are quite technical in my opinion.

47
00:03:58,760 --> 00:04:03,060
I get bored with paperwork, even though I have to do a lot of policy and procedure work these days.

48
00:04:03,060 --> 00:04:05,280
I still like doing pen tests.

49
00:04:05,280 --> 00:04:06,760
I'm a recovering red teamer.

50
00:04:06,760 --> 00:04:09,640
I still like doing forensic examinations.

51
00:04:09,640 --> 00:04:12,940
It's how I wake up in the morning, if you will.

52
00:04:13,700 --> 00:04:14,880
That's it about me.

53
00:04:14,880 --> 00:04:18,180
Let's get on to a little bit about the company I work for.

54
00:04:18,760 --> 00:04:28,000
I did have my firm for a long time, and once I had a kid , I realized I wanted to not work as many hundred-hour weeks, and I wanted to spend a little more time with the family.

55
00:04:28,000 --> 00:04:32,200
So my firm merged with Richie Mae to form Richie Mae Technology Solutions.

56
00:04:32,320 --> 00:04:35,180
We do a lot of cloud workflow integrations.

57
00:04:35,520 --> 00:04:45,420
I work with, specifically since I'm near Hollywood, I work with a lot of the studios and the vendors that make the movies you used to watch at AMC, and now you watch at home or on streaming platforms.

58
00:04:45,500 --> 00:04:48,660
So I do a lot of content protection and workflow and stuff like that.

59
00:04:49,220 --> 00:04:57,120
I used to be one of 20, now I'm one of 40 worldwide that can do security assessments on behalf of the major studios that make films.

60
00:04:58,060 --> 00:05:05,180
So the learning objectives for this workshop, we're going to learn what file artifacts are available in cloud solutions, cloud file storage solutions.

61
00:05:05,180 --> 00:05:10,040
We're going to see what kind of cloud file storage user activities can be enumerated.

62
00:05:10,040 --> 00:05:17,460
We'll be introduced to application log capabilities, examine the difference between providers, and so on and so forth.

63
00:05:17,460 --> 00:05:18,920
Now, one thing I do want to...

64
00:05:18,920 --> 00:05:21,320
I want to give recognition where recognition is due.

65
00:05:21,760 --> 00:05:31,940
I worked in Instant the first time I started getting into some of these cloud file storage solutions and trying to dig a little bit deeper was I was working a case, I don't know, three years ago-ish.

66
00:05:31,940 --> 00:05:38,140
And it was a company where the COO was a relative to the CEO.

67
00:05:38,260 --> 00:05:42,620
And that person left the company and there was suspicion that they poached a lot of the clients.

68
00:05:43,240 --> 00:05:50,200
And they asked us to do a forensic examination on the hard drive and figure out if information was sent, stolen.

69
00:05:50,320 --> 00:05:53,740
There was just a lot of odd behaviors about how that person left the company.

70
00:05:53,740 --> 00:06:03,340
And so one of the things I found there was a cloud file storage solution, and we were able to identify what files were uploaded, synced, things like that.

71
00:06:03,340 --> 00:06:06,160
And this cloud file storage solution was not sanctioned by the company.

72
00:06:06,160 --> 00:06:12,220
So this was a personal account that was installed on the Windows machine and was used to exfiltrate data, essentially.

73
00:06:12,220 --> 00:06:19,640
And so I got into it in that forensic examination, and I got curious, did a little more research, and then I ended up taking a SANS course as well.

74
00:06:19,640 --> 00:06:23,880
And they had a section on that that filled in a lot of the gaps of my research that was missing.

75
00:06:23,880 --> 00:06:27,100
So, you know, there's a lot of people and their research involved.

76
00:06:27,100 --> 00:06:40,200
So I do want to put their names on the screen and recognize them, including SANS Institute and a lot of people that had research on sections of these tools, because there's a lot of information throughout here, and they've helped fill in a lot of the gaps for me.

77
00:06:41,060 --> 00:06:46,680
So cloud file storage overviews, you know, what exactly we're talking about when I say cloud file storage solutions?

78
00:06:46,680 --> 00:06:56,600
Well, we're talking about your boxes, Dropbox, OneDrive, Amazon Drive, Google Drive, ShareFile, iCloud, those kind of things when I talk about a cloud file storage solution.

79
00:06:56,820 --> 00:07:06,180
Now, the reason they're becoming so popular is that there's this perceived benefit that you get when you switch to one of these, reuse one of these over, let's say, a file sharing, an on-premise file share.

80
00:07:06,180 --> 00:07:20,360
You get protections against disasters, and these are perceived because obviously everyone's had their outage, but these providers can do a lot better job than system administrators, in my opinion, from every organization to keep their data available.

81
00:07:20,360 --> 00:07:26,700
So when there's a pandemic, and everyone's got to work from home, you know, overnight, essentially, you still have access to those files.

82
00:07:27,120 --> 00:07:31,760
Disperse teams, they can have access to these files, rather than having a VPN in.

83
00:07:31,760 --> 00:07:41,260
You've got decrease in maintenance, so system admins don't have to update the underlying operating system, they don't have to patch Adobe, they don't have to do all that maintenance on the file share.

84
00:07:41,280 --> 00:07:49,140
If anyone's ever worked with DFS, I mean, that's why cloud file storage solutions are becoming more popular, in my opinion.

85
00:07:49,140 --> 00:07:51,580
They've got that high availability, they're scalable.

86
00:07:51,580 --> 00:08:01,320
So rather than adding hard drives to RAID, or adding more servers to a cluster, you just literally say, Google, here's an extra 10 bucks a month, now give me an extra terabyte.

87
00:08:01,320 --> 00:08:04,460
So it's very easy to scale that.

88
00:08:04,720 --> 00:08:06,560
You've got ease of management.

89
00:08:06,560 --> 00:08:13,840
So you've just got GUIs and web interfaces, you can provision new users through web portals, as well as single sign on, etc.

90
00:08:13,840 --> 00:08:16,520
It's very easy for user management.

91
00:08:16,820 --> 00:08:20,240
And then we may see two different solutions that I'll kind of talk about a little bit later.

92
00:08:20,240 --> 00:08:26,120
And one is that you may have a business authorized or business sanctioned cloud file storing solution.

93
00:08:26,180 --> 00:08:33,060
So maybe it's an enterprise Office 365 account, and they give you OneDrive, or you have a business version of Dropbox.

94
00:08:33,060 --> 00:08:42,300
But then we also run into scenarios where I often see these different providers out there on Windows machines, or even Mac machines, where they were not sanctioned by the company.

95
00:08:42,300 --> 00:08:46,580
And maybe someone thought they were doing the company a favor because they had to move files from one machine to another.

96
00:08:46,580 --> 00:08:55,520
I vividly remember coming in trying to help architect a more secure solution for a plastic surgery firm in Beverly Hills.

97
00:08:55,900 --> 00:09:02,580
And the company ended up, they only had a couple people, but they were doing plastic surgery on famous people.

98
00:09:02,580 --> 00:09:05,740
And they wanted to have isolated air gap networks.

99
00:09:05,740 --> 00:09:06,760
And I thought, great.

100
00:09:06,900 --> 00:09:08,180
And they said, so this is kind of what we did.

101
00:09:08,180 --> 00:09:11,560
We want a better solution because we've got one computer here for internet access.

102
00:09:11,840 --> 00:09:14,840
And then we have another computer over here and that has medical files.

103
00:09:14,840 --> 00:09:17,560
And everyone's got two computers and they're swiveling back and forth.

104
00:09:17,560 --> 00:09:18,560
We call it swivel net.

105
00:09:18,920 --> 00:09:21,740
So you do one job or another, so there's got to be a better way.

106
00:09:21,740 --> 00:09:25,060
And I was like, well, this actually sounds fairly secure, but let me look into it.

107
00:09:25,060 --> 00:09:39,800
And as I dug into it, I realized, yes, they were two different computers, but they had personal Dropbox accounts on both computers and they were syncing the files back and forth because they needed to, obviously they downloaded stuff from, let's say an EMR and they needed to move it into the,

108
00:09:39,800 --> 00:09:42,500
I don't want to say production network, but the medical network.

109
00:09:42,500 --> 00:09:45,000
And there was that bridge that was gap there.

110
00:09:45,000 --> 00:09:46,760
And so that was not a commercial version.

111
00:09:46,760 --> 00:09:55,400
That was a Gmail or Yahoo or an AOL account that the employees set up because they thought they were making their job more efficient, but there was no control over that.

112
00:09:55,400 --> 00:09:58,140
So this came from Spiceworks.

113
00:09:58,140 --> 00:09:58,700
I apologize.

114
00:09:58,700 --> 00:09:59,520
I don't have the source there.

115
00:09:59,520 --> 00:10:01,280
I'll try and post that later on.

116
00:10:01,320 --> 00:10:03,040
But it's a Spiceworks study.

117
00:10:03,040 --> 00:10:04,140
You can Google it.

118
00:10:04,140 --> 00:10:08,100
Cloud file storage solutions, Spiceworks, market research, and you'll find this.

119
00:10:08,100 --> 00:10:13,960
But I tried to extrapolate some of the interesting things that I saw here, obviously from a couple of perspectives.

120
00:10:13,960 --> 00:10:22,060
One, so you know what's more prevalent, but two, depending on which side of the fence you are on, if you're offensive security, you can see what you're most likely to see, right?

121
00:10:22,060 --> 00:10:28,180
And obviously Microsoft OneDrive, they've baked that into Windows 10 and they make it very easy for you to use OneDrive.

122
00:10:28,240 --> 00:10:34,200
And so we're seeing that organizations more and more are using OneDrive solutions, right?

123
00:10:34,200 --> 00:10:35,540
Followed by Google Drive.

124
00:10:35,540 --> 00:10:37,980
I believe that's because of G Suite and that's kind of bundled in there.

125
00:10:37,980 --> 00:10:43,080
And then Dropbox is the largest independent source that you may see out there in the enterprise.

126
00:10:43,280 --> 00:10:47,780
And then followed by Box has a very small market share, except for large enterprises.

127
00:10:47,840 --> 00:10:51,600
We see a lot of that within different studios and post-production houses.

128
00:10:51,600 --> 00:10:55,260
They've done some work with the MPA and I think that's why we see that.

129
00:10:55,660 --> 00:11:00,600
And then Citrix ShareFile, not very popular, but I see a lot in the financial sector.

130
00:11:00,600 --> 00:11:03,260
So Richie May really focuses on two verticals.

131
00:11:03,260 --> 00:11:05,880
We're in the media entertainment space and we're in the financial space.

132
00:11:05,880 --> 00:11:10,260
We've got clients in all different industries, but those are really our niches.

133
00:11:10,320 --> 00:11:12,900
And so I see a lot of Citrix ShareFile.

134
00:11:12,900 --> 00:11:16,340
I thought it was going to be more than whatever it says there, about five to 10%.

135
00:11:16,340 --> 00:11:21,500
But since I see it so much, I have the research and I included it in this workshop.

136
00:11:21,520 --> 00:11:23,920
So here's the two different scenarios you might run across.

137
00:11:23,920 --> 00:11:28,460
You may see that on the left side there of my screen, I've got that corporate environment.

138
00:11:28,460 --> 00:11:31,560
Maybe they've got CASB solution involved.

139
00:11:31,560 --> 00:11:32,540
There's a firewall.

140
00:11:32,540 --> 00:11:35,640
It's a sanctioned cloud file storage solution there.

141
00:11:35,640 --> 00:11:51,380
On the right hand side there, we've got some that they may even still have that sanctioned cloud file storage solution like OneDrive, but then the end user may use their personal G drive or Dropbox account because they wanted to get the certain data on and off of that computer system.

142
00:11:51,380 --> 00:11:54,400
And USB drives are just not as popular these days.

143
00:11:54,400 --> 00:11:57,520
So you may see that that bypasses CASB solutions.

144
00:11:57,520 --> 00:12:02,480
A lot of the CASB solutions I've looked at are limited as far as they're not in line.

145
00:12:02,480 --> 00:12:19,940
And so there's certain instances where you may install or use these cloud file storage solutions, whether it's you install the agent or you go through the web browser and that expensive CASB solution that you've got as your one of your layers of security may not even see that data leave or come in and out of the network.

146
00:12:20,560 --> 00:12:24,060
Okay, so what kind of gems are we talking about here that we might be able to see?

147
00:12:24,200 --> 00:12:27,320
If we're again, I'm trying to phrase this as two different sides.

148
00:12:27,320 --> 00:12:31,340
You've got this workshop I think can go well for incident responders and forensic people.

149
00:12:31,340 --> 00:12:33,840
They can see what artifacts are left behind.

150
00:12:33,840 --> 00:12:49,880
But I also think that as offensive security, there's also something you can gain here and seeing that looking at this post exploitation, seeing what kind of data might be stored and what things you can extrapolate from these agents or artifacts left behind,

151
00:12:49,880 --> 00:12:54,060
you may be able to get a lot of interesting things during a pen test or red team engagement.

152
00:12:54,360 --> 00:12:57,720
So many organizations are now using these tools as a file server replacement.

153
00:12:57,720 --> 00:13:05,740
So you might find customer data, financials, employee data, whatever you'd see on a file share, you may see there.

154
00:13:05,740 --> 00:13:08,120
I mean, all kinds of confidential stuff.

155
00:13:08,680 --> 00:13:17,720
The apps, if they install the application, whether it's business sanctioned, or a personal install of the desired application, you might see cached files.

156
00:13:17,720 --> 00:13:28,700
So whether that file exists still in the file system, maybe they downloaded something and deleted it, that cached copy because it was opened up may still be there may be remnants there that you can now pull out.

157
00:13:28,700 --> 00:13:35,080
So someone downloaded customer data, they realized they shouldn't have it, they go ahead and delete it, that cache copy still there.

158
00:13:35,080 --> 00:13:38,900
And if you're on a pen test, you can just go grab that cache copy and recreate all the data.

159
00:13:38,940 --> 00:13:54,860
You might see local files, even for cloud files, most of the cloud file storage solutions we're going to look at, even though you don't see the you're not going to touch the cloud files, you know, maybe they've disconnected or they are not syncing anymore,

160
00:13:54,860 --> 00:14:01,400
we still can look at the databases and we can see all the files they have access to in the cloud, even if it's not on the local file system.

161
00:14:01,400 --> 00:14:04,980
So we might not be able to get those files, but now we know they're sitting there.

162
00:14:05,300 --> 00:14:13,560
We can get usage of different files, we can say, wow, they're really, you know, there's a lot of work going into this one file, this customer file, this might be something I want to look at.

163
00:14:13,560 --> 00:14:16,440
You may also get to be able to see traces of deleted files.

164
00:14:16,440 --> 00:14:25,900
So even if they do delete it and maybe we'll see it in the cache, maybe we won't, but even if they didn't open it up on the local file system, we may be able to get remnants of that file.

165
00:14:27,420 --> 00:14:33,020
So I would kind of went over this already, it's either going to be company issued or you might have a free account.

166
00:14:33,780 --> 00:14:46,860
Depending on which side you're on, again, defense or offense, if you're on the defense and you're trying to find some of this stuff from incident response perspective or forensics, you might look at this and say, well, if it's a free account, we don't get access to the logs.

167
00:14:46,860 --> 00:14:52,260
But if it's a business account, we might actually get access to some more advanced logging.

168
00:14:52,260 --> 00:14:56,280
But again, it's depending on where you sit, your background and how you're going to use this.

169
00:14:57,620 --> 00:15:01,680
With the business or enterprise accounts, you know, for Google, you've got G Suite.

170
00:15:01,680 --> 00:15:03,680
For Microsoft, you have Office 365.

171
00:15:03,680 --> 00:15:06,460
For Box, it's called Box for Business or Box Enterprise.

172
00:15:06,460 --> 00:15:09,080
And then Dropbox, they call it Dropbox Pro.

173
00:15:09,380 --> 00:15:13,960
On the free side, you can actually get some decent size storage there.

174
00:15:13,960 --> 00:15:16,660
For Google Drive, you can get free 15 gigs.

175
00:15:16,660 --> 00:15:21,280
Can you imagine the amount of stuff that people can exfiltrate from your environment with 15 gigs?

176
00:15:21,280 --> 00:15:24,680
With OneDrive Basic, you only get five gigs.

177
00:15:24,680 --> 00:15:26,860
Dropbox is the smallest, two gigs.

178
00:15:26,860 --> 00:15:30,060
And then Box Starter, it's 100 gigs.

179
00:15:30,060 --> 00:15:33,880
The reason I don't have Citrix share file on here is that it's only trial.

180
00:15:33,880 --> 00:15:35,040
There is no free version.

181
00:15:35,040 --> 00:15:36,760
It's an enterprise grade tool.

182
00:15:37,620 --> 00:15:41,200
It's behind a paywall or trial wall that you have to go and get that.

183
00:15:41,220 --> 00:15:50,900
So you can use it obviously for a while, but it's not something I'm generally going to see as an unauthorized or free version, just because it's on the enterprise side.

184
00:15:51,500 --> 00:15:54,700
Okay, so let's now dive into Microsoft OneDrive.

185
00:15:56,300 --> 00:15:57,760
So a little bit about it.

186
00:15:57,760 --> 00:16:00,600
It's baked into Windows 8 and plus.

187
00:16:00,600 --> 00:16:02,940
Windows 10, it's built into it.

188
00:16:02,940 --> 00:16:04,280
It's almost like a virus, right?

189
00:16:04,280 --> 00:16:05,220
It's there.

190
00:16:05,220 --> 00:16:12,920
However, it's sitting there, but a lot of the artifacts and directories, registry keys are not there until you actually authenticate.

191
00:16:12,920 --> 00:16:20,840
So once you authenticate, it then becomes enabled and directories such as the AppData, local Microsoft OneDrive directory is then created.

192
00:16:20,840 --> 00:16:26,800
So obviously, if that folder is not there, you can assume that they have not been using OneDrive on that system.

193
00:16:28,540 --> 00:16:33,520
There's a lot of differences between the personal and the paid version of OneDrive.

194
00:16:33,520 --> 00:16:41,320
So for example, the personal OneDrive log files, you're going to see them within AppData, local Microsoft OneDrive logs.

195
00:16:41,320 --> 00:16:44,860
And then if it's a personal account, you'll see personal directory.

196
00:16:44,860 --> 00:16:52,460
If it is a business Office 365 account, you're going to see business one is the first account that's synced.

197
00:16:52,540 --> 00:16:56,820
And if you sync more accounts, you'll see business two, business three, business four, and so on.

198
00:16:57,240 --> 00:17:04,720
Now, from my research, there's no logging on the web side of it for personal accounts.

199
00:17:04,720 --> 00:17:09,940
However, with business, you have Office 365 unified audit logs that provide a lot more information.

200
00:17:09,940 --> 00:17:12,400
And by default, those are set at 90 days.

201
00:17:12,440 --> 00:17:20,320
From an incident that my team is working on currently with a massive breach, I can tell you that 90 days is probably not long enough.

202
00:17:20,740 --> 00:17:24,100
So there is some stuff there, but it does get rolled over pretty quickly.

203
00:17:25,960 --> 00:17:26,260
Okay.

204
00:17:26,400 --> 00:17:33,780
And if you look at the logging capabilities, obviously on the right-hand side, you've got the business version there with the unified audit logs.

205
00:17:33,780 --> 00:17:45,540
But the personal version, you're probably, if you want to start looking at behavior or what's happened on that endpoint, you're going to have to look at more of the logs that are stored locally on the file system.

206
00:17:46,340 --> 00:17:56,200
Okay, so this grid here is really meant just to show the different locations and what those locations are, whether it's a file or a directory.

207
00:17:56,900 --> 00:18:03,220
For example, OneDrive, if you see a OneDrive directory, it's a personal, that's where all their personal files are stored.

208
00:18:03,220 --> 00:18:07,680
If you see OneDrive dash the company name, that's going to tell you two things.

209
00:18:07,680 --> 00:18:10,220
One, the company name, and they're using Office 365.

210
00:18:10,220 --> 00:18:14,960
So you know immediately there's more logging capability, probably up to 90 days somewhere on the cloud.

211
00:18:16,580 --> 00:18:23,040
Then there's other things like the root, or we've already talked about the root log directories and how it's either personal or business one.

212
00:18:23,280 --> 00:18:29,900
There's an interesting file called SyncDiagnostics.log, and that provides you with metadata for both local and cloud files.

213
00:18:29,900 --> 00:18:39,460
So even if they've decided not to sync, or they have yet to sync a file from the cloud, you get access to the name of that file in the SyncDiagnostics log, potentially, and we'll talk about that in a second.

214
00:18:40,180 --> 00:18:48,340
There's a .dat file, and so the way it's going to work is if whether it's a personal or business account, it's going to be their CID.

215
00:18:48,340 --> 00:18:52,700
So the customer ID number .dat, and so that's going to differ for every system you look at.

216
00:18:52,700 --> 00:19:01,340
So one thing there, you get their CID number, or CID string, and once you go into that, you're going to see a list of all the local and cloud files.

217
00:19:01,780 --> 00:19:18,660
If you look at the CID.ini file, you're going to see the file store locations, the last sync time, usage details of how they're using OneDrive, and if you look at the CID-profile-service-response.txt file, that's going to give you only for a personal account.

218
00:19:18,660 --> 00:19:29,460
For business accounts, it does not exist for my testing, but for personal accounts, it'll get you the name, email address, CID, email, I guess I have email twice there, phone number, title, department, that kind of stuff.

219
00:19:29,460 --> 00:19:37,440
I think it's interesting though, because what personal user, or if you sign up for OneDrive, it doesn't ask for that information, like your phone number or your business title.

220
00:19:37,780 --> 00:19:39,300
However, that's listed there.

221
00:19:39,300 --> 00:19:50,680
So I didn't even see a location when I went to OneDrive.com to go to my profile and actually add a title and department and stuff, which is most of the time why you're going to see those fields as null if you look at that text file.

222
00:19:51,080 --> 00:19:54,500
Then there's also an obfuscation string map text file.

223
00:19:55,160 --> 00:19:57,980
That one's a little bit interesting, and I'll kind of show you how that works a little bit later.

224
00:20:01,440 --> 00:20:06,720
I types of those sync diagnostic log files, and I haven't done extensive testing on this.

225
00:20:06,720 --> 00:20:09,560
However, I do have a theory based off my limited testing.

226
00:20:10,760 --> 00:20:17,260
So during my testing, I had Office 365 OneDrive, and I had... so it's a business version, right?

227
00:20:17,260 --> 00:20:23,820
And I didn't want to go buy 10 different versions to test this, but I got what I'm going to call the summary version of the sync diagnostics file.

228
00:20:23,820 --> 00:20:25,460
And I'll show you the two versions.

229
00:20:26,060 --> 00:20:35,880
Now, when I set up a free personal account, and I had two virtual machines in my lab environment, the first virtual machine got what I'm calling the detailed sync diagnostics file.

230
00:20:35,880 --> 00:20:37,300
It was much more verbose.

231
00:20:37,360 --> 00:20:47,560
Then I synced a second virtual machine to basically see how that would work, and I opened up the sync diagnostic file on the second VM, and I got what I'm calling the summary version.

232
00:20:47,800 --> 00:21:02,820
So my theory is that it's possibly the first machine you sync with OneDrive, it gets the detailed version, and everyone after that, like the secondary machines within the sync cluster, if you will, those get the detailed version.

233
00:21:03,260 --> 00:21:05,360
It's more of statistical data.

234
00:21:06,000 --> 00:21:08,160
So let's look at the two different versions.

235
00:21:08,320 --> 00:21:15,580
So with the detailed sync diagnostics log file, I can see things here like files and folders that are added.

236
00:21:15,580 --> 00:21:23,520
And the weird part, though, is you'll see mount point followed by what looks like a GWID, or a CID followed by some kind of unique character.

237
00:21:23,740 --> 00:21:33,980
And then it'll have a backslash, and then it'll have three words like far, jump, sue, sea, bat, egg, car, reg, tax, rat, tad, up.

238
00:21:33,980 --> 00:21:36,280
So there are three words grouped together.

239
00:21:36,680 --> 00:21:39,100
And when I first looked at that, I thought, what the heck is this?

240
00:21:39,100 --> 00:21:45,080
Obviously, there's some kind of pattern going on, you know, three different words in the capitalization, but where is this coming from?

241
00:21:45,080 --> 00:21:49,960
I don't have any files called far, jump, saw, or sue, or sea, bat, egg.

242
00:21:49,960 --> 00:21:52,560
That's not a folder that I added.

243
00:21:53,460 --> 00:21:56,920
I'll show you how that works in a second, but we'll come back to that.

244
00:21:56,920 --> 00:22:13,240
On the right hand side there, I've got the summary diagnostics file, which is the other version where you get more of stuff like this, where you get sync progress, you get the last sync time in Unix epoch, you get the number of files uploaded, downloaded,

245
00:22:13,240 --> 00:22:17,000
files, folders created, you get basically more of summary type data.

246
00:22:17,480 --> 00:22:31,180
Now, going back to that detailed version, what I eventually figured out is that those names, those three word names like sea, bat, egg, or far, jump, sue, those things map back to the obfuscation string map.

247
00:22:31,180 --> 00:22:43,620
So I don't really have a knowledge of why Microsoft did this, but I do find it interesting that if you go to the sync diagnostics, you're not going to see the actual file names, you're seeing those obfuscated strings.

248
00:22:43,700 --> 00:22:47,860
It's not terribly difficult to de-obfuscate them, it's just time consuming.

249
00:22:47,860 --> 00:22:57,540
And I'm sure someone's written a parser for this, but you have to open up that string obfuscation map text file, and there you can then map back those files.

250
00:22:57,540 --> 00:23:01,920
And we can see on the left side, I have sea, bat, egg, which is equivalent to my desktop.

251
00:23:01,920 --> 00:23:06,240
So basically, the sync diagnostics folder is saying that my desktop was synced.

252
00:23:06,240 --> 00:23:08,240
That folder was added to the sync.

253
00:23:09,860 --> 00:23:19,180
Okay, and here's just, again, another example, a little bit bigger, where you could see that those different names, like joke, yak, log, equates to my C directory.

254
00:23:19,340 --> 00:23:26,160
Or coy, you, quill, that's going to be myly, which is probably my user's directory.

255
00:23:27,620 --> 00:23:31,360
Okay, the CID.dat file, it's a little hard to read.

256
00:23:31,580 --> 00:23:34,880
If you open it up in the editor, you will kind of see the file names.

257
00:23:34,880 --> 00:23:37,800
However, searching, I wasn't able to do this.

258
00:23:37,800 --> 00:23:45,300
And I do think it's because, obviously, those dots that are between each character, and I'm pretty sure there's a way to search more human readable.

259
00:23:45,300 --> 00:23:51,440
But when I search for travel, or itinerary, or PDF, it was not found because of those dots.

260
00:23:51,680 --> 00:24:01,060
So you can parse through that manually, but a better version is probably, or a better way to do that is probably using something like strings, or B strings.

261
00:24:01,060 --> 00:24:06,560
So here I use strings against that CID.dat file on the personal version.

262
00:24:06,560 --> 00:24:12,740
And I was able to extract things there that are human readable, like documents, personal, vault, pictures, camera roll.

263
00:24:12,840 --> 00:24:21,780
Those other things up there, as far as like E94, 23, blah, blah, blah, explanation point, explanation point 104, I don't know what those are.

264
00:24:21,780 --> 00:24:24,680
And they come back to haunt us in the business version as well.

265
00:24:24,820 --> 00:24:29,300
I'm not sure if those are like the CID, and then some inode ID.

266
00:24:29,300 --> 00:24:31,720
I'm still doing some research into that piece.

267
00:24:32,460 --> 00:24:37,120
Now on the business version, though, if we look at the CID.dat file, it's not as easy.

268
00:24:37,460 --> 00:24:42,160
We don't see as clear things, even if we pull it out in strings.

269
00:24:42,160 --> 00:24:47,320
However, when I started looking through this, I saw what looked again like quids, or maybe hashes there.

270
00:24:47,680 --> 00:24:51,220
And so I'm thinking more along the lines of their MD5 hashes.

271
00:24:51,220 --> 00:24:57,260
But when I tried to search that in the string obfuscation text file, it doesn't pull things up properly.

272
00:24:57,260 --> 00:25:02,600
We can see that that hash or that string is mapped somewhere, but it doesn't really tell us what it is.

273
00:25:02,600 --> 00:25:06,280
It says something like 23-paged CT equals one.

274
00:25:06,280 --> 00:25:08,560
I don't really know what that maps back to.

275
00:25:08,560 --> 00:25:15,480
So on the business versions, we didn't really get a full list of files and folders that were added.

276
00:25:16,720 --> 00:25:29,460
With the CID.ini, we could see things there like the location or the URL for their OneDrive or their Google Drive, sorry, not Google Drive, their OneDrive or their share file, I'm sorry, share sync.

277
00:25:29,880 --> 00:25:37,020
And then with the last refresh time, it's in Unix Epoch, we can see the last time they actually synced if they've got the up-to-date versions.

278
00:25:37,180 --> 00:25:43,500
You could see even there, I've got all the different libraries that are shared with me, and we could see even the amount of bytes transferred.

279
00:25:44,440 --> 00:25:56,480
Now that CID.dash profile service response, that one will give us, as I mentioned, only for the personal version of Office 365, I'm sorry, personal version of OneDrive, you've got things like the display names.

280
00:25:56,480 --> 00:25:58,660
We could see Michael Wiley or Mike Wiley there.

281
00:25:58,660 --> 00:26:01,180
We could see the ID or the CID of my user.

282
00:26:01,180 --> 00:26:04,160
We can see the email address that I have registered there.

283
00:26:04,160 --> 00:26:06,600
So it was a Gmail account.

284
00:26:06,600 --> 00:26:11,360
We could see a business phone number, which again, I don't know why is there, and every time I've looked is null.

285
00:26:11,560 --> 00:26:15,940
Same thing with job title, mobile phone, office location, that kind of stuff.

286
00:26:17,260 --> 00:26:19,440
I did try and compare the registry keys.

287
00:26:19,440 --> 00:26:30,100
So in my lab environment, I went ahead and installed or activated OneDrive for business, and I recorded all the different registry keys that I saw.

288
00:26:30,340 --> 00:26:35,620
Then I did that for the personal version, which is that middle column there, to see which registry keys were added.

289
00:26:35,620 --> 00:26:37,500
You can see there's a lot less.

290
00:26:37,840 --> 00:26:45,720
And then I tried to do essentially a merge of those and see which were common, so that way we can identify which registry keys were not common.

291
00:26:45,720 --> 00:26:51,560
And so the only two keys in the personal version that are different are isUpgradeAvailable and VaultShortcutPath.

292
00:26:51,560 --> 00:26:57,140
Otherwise, everything in the personal registry keys, they're also going to be for the business keys.

293
00:26:58,100 --> 00:27:06,880
Hey, one interesting registry key that we can find is that if we do a reg query or we use in the lab environment, I'm going to give you a dump of the registry.

294
00:27:06,880 --> 00:27:22,200
So you can't obviously do a live query like I'm doing here on the screen, but with the business version of OneDrive or Office 365, what happens is if you go into HKeyCurrentUser, Software, Sync Engines, Providers, OneDrive.

295
00:27:22,200 --> 00:27:28,660
When we go into there, you're going to see potentially multiple different keys there.

296
00:27:28,660 --> 00:27:34,260
And what looks like a bunch of random characters like B736EE blah, blah, blah, plus one.

297
00:27:34,260 --> 00:27:39,460
And then you see C4F29 blah, and so on and so forth.

298
00:27:39,460 --> 00:27:48,240
So those are actually what I think is the CID for users that have shared folders with the user you're looking at.

299
00:27:48,240 --> 00:27:55,560
So you can go in here again, depending on your perspective, if it's offensive or defensive, but you can now see that they have access to other users files.

300
00:27:55,960 --> 00:28:02,420
Or if you're doing incident response or forensics, you can see that they might have data that's mapped there that doesn't belong to them.

301
00:28:02,880 --> 00:28:18,060
Now, if you do another reg query below that on one of those CIDs, so the B7 blah, blah, blah, if you go ahead and do a reg query on that string, what's going to happen is you're going to see more keys under there, and you're going to see the actual name,

302
00:28:18,060 --> 00:28:20,720
what they're calling the mount point of what's shared to them.

303
00:28:20,720 --> 00:28:27,960
So now I can see there's a projects documents directory that they don't own, but someone shared with them and they added to their OneDrive.

304
00:28:27,960 --> 00:28:30,840
And then obviously, you can also see the URL namespace.

305
00:28:30,840 --> 00:28:32,900
So you can actually see the URL to get that.

306
00:28:32,900 --> 00:28:37,720
So if you are on their machine, you could possibly pop in that URL into their browser.

307
00:28:37,720 --> 00:28:40,380
And if it's cached, you might be able to actually get that as well.

308
00:28:41,100 --> 00:28:49,200
One thing to note with these tests, though, if someone shares something with the user, it doesn't automatically mean you're going to see it when you do the reg query.

309
00:28:49,200 --> 00:28:54,700
They do have to press add to your OneDrive in order for that to now show up in the registry.

310
00:28:54,840 --> 00:29:06,660
So once they press add on the web browser version of OneDrive, if they click add this shared folder, for in this case, I did test on a personal account, when you do the reg query, you're going to be able to see that there.

311
00:29:06,660 --> 00:29:15,660
And so the difference between the business version here and the personal version of OneDrive is that with the personal version, there is no CID of the user that shared it.

312
00:29:15,660 --> 00:29:19,020
Instead, you're just going to see the name of the shared folder.

313
00:29:19,420 --> 00:29:25,500
If you dive into that a little deeper with another reg query, we can actually see the CID of the user that shared it with them.

314
00:29:25,500 --> 00:29:38,120
Possibly if you've compromised multiple machines with an organization, you can look at that the CID, or if you're on the defensive side, you can take a look at that and say, well, I know Bob or Betty or Joe or whoever shared this with that person.

315
00:29:40,100 --> 00:29:52,940
One other thing just to know about a lot of these tools, I'm just going to focus here on OneDrive for a second, is that with Microsoft OneDrive space saver, it basically allows you to not sync everything.

316
00:29:52,940 --> 00:29:56,860
And I remember back in the day, Dropbox was the first cloud file storage solution that I used.

317
00:29:57,200 --> 00:30:01,520
And when I would sync that, I had multiple directories and subdirectories.

318
00:30:01,520 --> 00:30:08,100
The challenge I had was that I couldn't get enough space off of my machine.

319
00:30:08,100 --> 00:30:14,200
I had terabytes of data, and I would try and say, don't sync this folder, but I really wanted a subfolder within that.

320
00:30:14,200 --> 00:30:22,740
So it was challenging to tell Dropbox which folders to sync, which folders not to sync, get what I wanted, and also not fill up my hard drive.

321
00:30:23,380 --> 00:30:27,960
So Microsoft OneDrive, their solution to that is called space saver.

322
00:30:27,960 --> 00:30:30,560
And what that'll do is that it doesn't download everything.

323
00:30:30,560 --> 00:30:39,980
It'll essentially get you a cached copy of the file name, and you'll see there that it's got a little cloud that's empty, and it basically means that it's cloud only.

324
00:30:40,000 --> 00:30:46,960
However, you can double click on that file, and it will then be cached locally, which will have a green check mark.

325
00:30:47,060 --> 00:30:48,960
Now, that'll eventually go away.

326
00:30:48,960 --> 00:31:02,100
I don't have documentation on how long it stays cached locally, but if you want it to stay always locally so you could access it when you're on an airplane or train or you don't have internet access, you could right click and say always keep on this device.

327
00:31:04,080 --> 00:31:07,660
So now what we're going to do is we're going to dive into the OneDrive lab.

328
00:31:07,660 --> 00:31:13,340
I do have a scenario for you that I don't think I properly put into the slides here.

329
00:31:13,400 --> 00:31:27,280
So what I'm going to have you do is go to the GitHub repo, make sure you've got, again, those four tools that you're going to use, the database browser, Notepad++, so on, so forth, and I want those two tools installed.

330
00:31:27,280 --> 00:31:35,980
And then I want you to go ahead and extract the evidence-desktop-q50 blah blah blah dot zip file, which has all the artifacts for the lab.

331
00:31:36,980 --> 00:31:47,460
And then I want you to start just looking at those files and seeing that it looks like basically a C drive, but it's only a couple megs in size.

332
00:31:48,020 --> 00:31:57,440
What I'm going to do while you get that going, and if there's any questions, obviously post them there on YouTube in the comments, and those will be relayed to me so I can answer those questions.

333
00:31:57,500 --> 00:32:02,960
I'm going to go ahead and get the scenario built up.

334
00:32:02,960 --> 00:32:07,320
I'm going to put that on the screen so you have the scenario in front of you so you could see what we're doing.

335
00:32:07,740 --> 00:32:16,940
Obviously, there could be many different scenarios, but I tried to make this fake scenario up, do it in the lab, and then I collected those artifacts for you to kind of dig into.

336
00:32:16,940 --> 00:32:24,560
So what you're going to want to do is open up, and I'm going to do here on my screen, there's three Word docs that are lab files.

337
00:32:25,640 --> 00:32:34,240
And the first one we're going to do here is OneDrive, so it should be examining cloud file storage incidents dash lab dash OneDrive.

338
00:32:34,420 --> 00:32:36,980
So I'm going to make this bigger on my screen for you.

339
00:32:38,560 --> 00:32:49,920
Expand that, zoom in, and this tells you here to navigate to the CID dash profile services, and there's a question you're going to answer.

340
00:32:49,920 --> 00:32:53,760
So you basically have to answer, what's Bob's Microsoft OneDrive CID?

341
00:32:53,760 --> 00:32:58,500
There's another question here, examine this file, get the user principal name.

342
00:32:58,500 --> 00:33:01,860
So these are questions that you're going to go ahead and answer and walk you through.

343
00:33:01,860 --> 00:33:13,020
Now, I will tell you, if you're stuck, or you've never done this before, and you need some help, what I have is all the way at the bottom, if you keep scrolling down, there should be a detailed walkthrough.

344
00:33:13,060 --> 00:33:17,020
So it'll give you the question again, exactly as you saw it before.

345
00:33:17,040 --> 00:33:21,620
And it'll give you then, or the steps, the question, and then it'll also give you the answer.

346
00:33:21,620 --> 00:33:25,660
And a lot of times here at the answer, what I also do is I give a screenshot.

347
00:33:25,660 --> 00:33:36,600
So if you want to walk through this, and you've got less experience, and you're saying, it's all too new to me, well, then just kind of walk through this, and you should be able to see the same exact things on your system.

348
00:33:36,660 --> 00:33:39,680
So I'm going to go silent for a little while on mute here.

349
00:33:39,680 --> 00:33:42,240
So you have a little bit of time to walk through these labs.

350
00:33:42,600 --> 00:33:51,920
When you're done, if you could start commenting and let us know on YouTube, that way I can get an idea of when the first 10 or 15 people are done, and we can kind of move on from there.

351
00:33:52,360 --> 00:33:56,060
So as I mentioned, go ahead and open this lab file, get started on that.

352
00:33:56,060 --> 00:34:00,900
I'm going to put on my screen in just a second here, the scenario, and I'll start talking about that scenario.

353
00:34:00,900 --> 00:34:02,960
Apologize, I didn't have that teed up for you.

354
00:34:07,580 --> 00:34:13,920
Hey, Michael, a quick question in the chat around cloud file storage security.

355
00:34:14,480 --> 00:34:22,520
Do you have any recommendation for, you know, scanning files for any malicious links or malicious files themselves?

356
00:34:22,920 --> 00:34:25,760
Any tools, something along those lines?

357
00:34:26,440 --> 00:34:35,120
Yeah, so a lot of the tools or the different solutions nowadays, they have AV built in.

358
00:34:35,120 --> 00:34:38,780
I don't know a lot of details about what they are.

359
00:34:38,780 --> 00:34:42,300
I can tell you that they are getting really good.

360
00:34:42,800 --> 00:34:48,500
I haven't done a full test where I've gotten, let's say like 1500 malware samples, uploaded them all to see what happens.

361
00:34:48,500 --> 00:35:00,580
But I can tell you from experience, both Google Drive as well as OneDrive has eaten up my malware samples that I have placed there for different lab environments.

362
00:35:00,620 --> 00:35:15,140
Even when I have encrypted and password protected zip files with malware built into them, both Google Drive and OneDrive have opened them up and used the password infected to look inside of them.

363
00:35:15,140 --> 00:35:17,120
I was kind of blown away the first time I saw it.

364
00:35:17,240 --> 00:35:19,060
And they're constantly improving it.

365
00:35:19,060 --> 00:35:20,840
They don't provide a lot of detail to that.

366
00:35:20,840 --> 00:35:24,740
So I used to keep a lot of my malware in like Google Drive.

367
00:35:24,860 --> 00:35:32,060
And even more so, I now sometimes have PCAP files, so network traffic that I have collected.

368
00:35:32,280 --> 00:35:34,420
And well, an incident happened.

369
00:35:34,420 --> 00:35:37,220
So let's say a user downloads a copy of WannaCry.

370
00:35:37,240 --> 00:35:39,480
I captured that network traffic.

371
00:35:39,660 --> 00:35:41,840
Within that PCAP, there's a lot of stuff.

372
00:35:41,840 --> 00:35:44,980
There's ping, there's all kinds of stuff in there.

373
00:35:45,100 --> 00:35:47,540
But there is an object, right?

374
00:35:47,540 --> 00:35:49,020
So they downloaded that file.

375
00:35:49,020 --> 00:35:56,160
And if it's over a clear text protocol, all those bits and bytes and everything are sitting in there.

376
00:35:56,380 --> 00:35:59,760
Nowadays, OneDrive will actually flag that.

377
00:35:59,760 --> 00:36:06,860
My PowerPoint slides for my incident response workshop for Wireshark, I can no longer share my PowerPoints.

378
00:36:06,860 --> 00:36:09,700
And it won't even let me download it to my computer.

379
00:36:09,700 --> 00:36:20,780
I actually have to go to OneDrive, confirm that I realized that they have found a virus within a PCAP file, and then confirm that I guarantee I'm serious, I do want to download that, and it'll let me download it.

380
00:36:20,780 --> 00:36:23,780
But they will not let it sync, and they will not let me share it.

381
00:36:23,780 --> 00:36:37,440
So a lot of the tools, I can't speak on all of them and what their engines are like, but I can tell you they're getting pretty good at finding stuff, even opening zip files with, I'm guessing they're using common passwords, like infected, you know, password.

382
00:36:37,480 --> 00:36:40,940
And they're trying to open up your zip files and scan those as well.

383
00:36:41,180 --> 00:36:46,660
If you do want a little bit more security on top of that, and you want to know what's going on, CASB solutions will do that.

384
00:36:46,860 --> 00:36:49,040
I don't use CASB a lot.

385
00:36:49,040 --> 00:36:52,260
However, I have used things like managed methods, we're a partner with them.

386
00:36:52,260 --> 00:36:59,360
And I went through some of their documentation, and I saw that they have a back end relationship with one of the AV vendors.

387
00:36:59,500 --> 00:37:02,440
And by adding CASB on top, it's scanning that.

388
00:37:02,860 --> 00:37:07,920
I would say if you're looking for other things too, Microsoft is building more and more built in.

389
00:37:07,920 --> 00:37:12,860
So they've got their kind of CASB solution built into Office 365.

390
00:37:13,220 --> 00:37:17,580
But if you want a third party, that's where it's going to help you scan for stuff.

391
00:37:17,580 --> 00:37:23,380
So again, I'm going to go back to the tool I know, not saying they're the best, but I just know managed methods.

392
00:37:23,380 --> 00:37:35,100
I build out a lot of regex queries for things like social security numbers, for things that look like or password, username, stuff like that.

393
00:37:35,100 --> 00:37:40,600
So it's doing antivirus scanning on top of what already Office 365 is doing.

394
00:37:40,600 --> 00:37:50,460
And then it's also letting me do custom queries for things like PCI, HIPAA, and just stuff that shouldn't be stored in OneDrive, like usernames and passwords and stuff like that.

395
00:37:53,370 --> 00:38:03,810
Yeah, I, you know, within my limited experience, I have similar experiences, the cloud vendors are getting really good at defending their own environment.

396
00:38:03,810 --> 00:38:04,550
It makes sense, right?

397
00:38:04,550 --> 00:38:11,350
I mean, they don't want to be hosting and especially if they have that shared cloud responsibility model, they've got a lot of that on their side.

398
00:38:11,350 --> 00:38:18,790
And they don't want you having things that are doing evil, or someone says, Oh, I got it from a Google Drive link or something like that.

399
00:38:18,790 --> 00:38:26,650
So they have got, I'm sure some pressure to make sure that they're keeping their customer safe and not spreading malware either.

400
00:38:27,110 --> 00:38:31,430
But, you know, when they did open my zip file, I was shocked because it had a password.

401
00:38:31,710 --> 00:38:37,570
When they started scanning my PCAPs and identifying malware in those, I was even more shocked, but good for them.

402
00:38:38,430 --> 00:38:42,930
This was the case, I don't know why this isn't in my slides, I must have missed this.

403
00:38:42,930 --> 00:38:51,010
But basically, this is the scenario that they built out for this workshop when it was the first time I did it was a four or five hour workshop.

404
00:38:51,250 --> 00:38:59,270
So you're working the case of the Mike Wiley LLC case, this is going to be more of a defensive incident response forensics type of case.

405
00:38:59,270 --> 00:39:01,990
But again, these concepts can be used for both sides.

406
00:39:02,570 --> 00:39:05,810
So you've got Bob McLee, who is a senior manager of operations.

407
00:39:06,270 --> 00:39:12,010
The Mike Wiley LLC firm is a boutique real estate investment firm in Los Angeles.

408
00:39:12,190 --> 00:39:18,810
Bob is a senior manager who abruptly left the firm on 4-17-2020 in the morning.

409
00:39:19,190 --> 00:39:24,790
Days prior to Bob leaving, he stepped down from all committee positions, so all board positions he was on.

410
00:39:24,930 --> 00:39:33,990
On Friday afternoon, Bob updated his LinkedIn profile to co-owner of a competing real estate investment firm called REMAX also.

411
00:39:34,630 --> 00:39:39,030
Within hours of Bob's departure, key clients gave contract cancellation notices.

412
00:39:39,030 --> 00:39:45,250
The Mike Wiley LLC management believes that Bob may have violated his non-compete and non-solicit clause.

413
00:39:45,290 --> 00:39:55,570
The Mike Wiley LLC hires a forensic incident response consulting firm to get evidence of any violations of non-solicit, so you're part of that consulting firm.

414
00:39:55,570 --> 00:40:05,210
The company did not have an approved cloud file storage solution, and some users would share files using personal accounts for business reasons.

415
00:40:05,590 --> 00:40:14,050
According to HR, Bob's personal email address is bob.maclee.re at gmail.com.

416
00:40:14,050 --> 00:40:21,850
So you've got that basic information about the incident, and as you work through that, you could start seeing what kind of files.

417
00:40:21,850 --> 00:40:26,590
Is there anything putting on your defender's hat, your incident response or forensics hat?

418
00:40:26,590 --> 00:40:32,210
Was there anything that that user looked at, touched, synced, that kind of thing?

419
00:40:32,210 --> 00:40:39,850
And so I'm guiding you through in the lab, going across that, trying to see what are some of those things that you can uncover using some of this.

420
00:40:39,850 --> 00:40:46,950
And so what I did, just for a little background, is I had the web browser opened up with all four platforms.

421
00:40:46,950 --> 00:40:53,090
I had OneDrive, Google Drive, Box, Dropbox, actually in Citrix, I had five platforms.

422
00:40:53,390 --> 00:40:56,530
Then I also had two virtual machines.

423
00:40:56,530 --> 00:41:03,950
I had a primary one, which is the information that you have, which I extracted out as the incident responder.

424
00:41:03,950 --> 00:41:07,370
I then also had a second VM that you don't have access to.

425
00:41:07,410 --> 00:41:08,810
So there's three different possibilities.

426
00:41:08,810 --> 00:41:15,890
There could be stuff on the web, there could be stuff on the VM you have, or a third-party VM, which is probably their personal home machine.

427
00:41:15,990 --> 00:41:21,110
So there's possibly three different cases where files could be added, removed, deleted, that kind of stuff.

428
00:41:21,110 --> 00:41:29,450
And so as we walk through, you could answer all the questions within OneDrive, but what I try to do is have you answer certain questions with OneDrive.

429
00:41:29,470 --> 00:41:34,190
Then later on, we're going to go to Dropbox, and you're going to answer some questions through that.

430
00:41:34,190 --> 00:41:36,970
And then we're going to go to Google Drive, and you'll answer more questions.

431
00:41:36,970 --> 00:41:45,570
So you could answer all of these questions and get all this information from one solution, but every time I added a file, I added it to all five different solutions.

432
00:41:45,990 --> 00:41:47,590
Citrix, Box, Dropbox.

433
00:41:47,590 --> 00:41:57,010
And so I wanted those same actions to happen across the board, but I wanted you to answer them, again, using the different tools and know where to find them with the different solutions.

434
00:41:57,010 --> 00:42:00,990
So hopefully that makes a little more sense of what we're doing and why we're doing it.

435
00:42:02,030 --> 00:42:09,250
And again, if you missed it, we are looking at the OneDrive lab file where we've got the walkthroughs.

436
00:42:10,510 --> 00:42:13,510
Any comments or questions on YouTube?

437
00:42:13,510 --> 00:42:14,390
Anyone stuck?

438
00:42:14,390 --> 00:42:15,690
Anyone done?

439
00:42:17,590 --> 00:42:30,070
I do have a question, which is not related to the lab, but your opinion on adoption of CASB in relation to layered protection for cloud assets?

440
00:42:31,670 --> 00:42:33,170
Good question.

441
00:42:34,750 --> 00:42:36,610
I think it's got its purpose.

442
00:42:36,610 --> 00:42:40,050
I think there's different use cases.

443
00:42:40,050 --> 00:42:45,210
So let me go into one where I think it's definitely useful, and then I'll go into another one where it's not.

444
00:42:45,210 --> 00:42:54,610
So we work with, as I mentioned, a lot of studios and post-production houses that receive the raw footage of the movies that are in the theater.

445
00:42:54,610 --> 00:43:13,850
And the challenge that we have is with a lot of studios, they've got what's... they're very concerned about the data getting leaked, especially after you look at Larson Studio was compromised by a hacker or hacking group, and the contents of Orange is the New Black was held for ransom.

446
00:43:14,330 --> 00:43:17,190
I think it was like $97,000 or $60,000.

447
00:43:17,190 --> 00:43:18,710
I can't remember the exact amount.

448
00:43:18,990 --> 00:43:25,390
And then basically signed a contract and give us this money in Bitcoin, and we won't release it to Pirate Bay.

449
00:43:25,390 --> 00:43:27,010
They ended up releasing it anyways.

450
00:43:27,650 --> 00:43:36,410
So the studios have gotten very strict on that, and they've got a 96-page document called the MPA Content Security Best Practices, and it's got everything.

451
00:43:36,410 --> 00:43:39,810
I mean, you should have a security guard walking around 24-7.

452
00:43:39,890 --> 00:43:43,030
How do you handle their keys?

453
00:43:43,030 --> 00:43:45,330
You have to have an inventory of every master key.

454
00:43:45,390 --> 00:43:52,850
When you're editing any content, it should be in a locked room with unique keys to get in, like a combo lock.

455
00:43:52,950 --> 00:43:59,350
And that logging on that lock has to be for 12 months, and you have to have a CCTV camera at your employees.

456
00:43:59,370 --> 00:44:02,130
And when your employees enter and exit the room, you have to search them.

457
00:44:02,130 --> 00:44:04,270
They can't have personal items in the room.

458
00:44:04,270 --> 00:44:06,070
If they do, it has to be a clear bag.

459
00:44:06,070 --> 00:44:09,570
It just goes on and on that most people can't really do that.

460
00:44:10,170 --> 00:44:21,490
So one thing, though, is that the point of that is that the studios are very strict about, you have to take our content, such care of our content, and how you work on our content while it's in your environment, Mr.

461
00:44:21,490 --> 00:44:23,810
Post-Production House or VFX House.

462
00:44:24,550 --> 00:44:33,410
Now, a lot of times, though, and I won't name which studios, but a lot of studios will still send the raw content of Batman or whatever it is.

463
00:44:33,410 --> 00:44:41,370
I just used Batman as an example, but they'll send the link for that to download the raw footage of this blockbuster movie.

464
00:44:41,490 --> 00:44:46,330
And they'll send that via email with the URL and username and password to download that.

465
00:44:46,330 --> 00:44:52,950
Sometimes they'll also send it over FTP, not the password, but they'll send the actual content over FTP.

466
00:44:53,190 --> 00:45:09,350
So I kind of feel like that's saying to the studio, to the vendor sometimes, it's like, hey, we're going to give you a gun, but you need to be so careful with it, you need to take a safety class, you need to buy a lock, you need to have a safe, you need to be in a room that's got bulletproof walls and all this stuff.

467
00:45:09,430 --> 00:45:13,730
But here you go, and they give you an unloaded gun without the safety on.

468
00:45:13,870 --> 00:45:29,950
And so in those situations, we've recommended, even though it's not part of the MPA best practices for our vendors, to basically, for their protection, is if you get handed a loaded gun, a CASB solution may be able to identify those links that come in,

469
00:45:29,950 --> 00:45:32,650
and then track everything about it.

470
00:45:32,650 --> 00:45:36,450
And it'll basically see if the... it'll almost alert.

471
00:45:36,450 --> 00:45:46,430
So when those links come in and possibly username and password from the studio, in an insecure matter, it is then tracked and logged and any type of action around that email is then alerted.

472
00:45:46,430 --> 00:45:55,350
Because we can't control the studio is going to hand a loaded gun to our clients, but we can control then how we're monitoring, logging, and preventing that from going out.

473
00:45:55,350 --> 00:45:58,090
So the CASB solution lets us keep track of that.

474
00:45:58,090 --> 00:46:03,030
And if it's ever forwarded to a personal account or anyone outside the company, we get alerted to that.

475
00:46:03,030 --> 00:46:07,070
Some CASB solutions will actually allow you to break links.

476
00:46:07,070 --> 00:46:12,290
So if someone puts a file up in Dropbox, or they try and share it , it'll break that link.

477
00:46:12,330 --> 00:46:22,610
So in those cases of detecting and sometimes preventing, but mostly detecting data leaving or being shared or forward and stuff like that, we absolutely recommended that to the client.

478
00:46:22,890 --> 00:46:31,430
Now, other cases, we have a CPA firm that's one of our clients, and they didn't really have a need for that.

479
00:46:31,430 --> 00:46:36,470
We got CASB involved originally, but we found out really, they just didn't want anyone to share anything outside the company.

480
00:46:36,470 --> 00:46:37,790
There was no use case for that.

481
00:46:37,790 --> 00:46:39,470
So we just disabled sharing.

482
00:46:39,470 --> 00:46:41,930
And in that case, we didn't really need CASB.

483
00:46:41,930 --> 00:46:45,810
So you kind of have to look at what functions you're worried about.

484
00:46:45,810 --> 00:46:47,130
Do you want the antivirus scanning?

485
00:46:47,130 --> 00:46:49,890
Do you want the regex queries?

486
00:46:49,890 --> 00:46:53,130
Do you want to be able to be alerted on certain events?

487
00:46:53,130 --> 00:46:56,250
I think a lot of it, you can actually do now with OneDrive.

488
00:46:56,250 --> 00:47:00,190
If you integrate that with a tool like Sumo Logic, you could do a lot of alerting on that.

489
00:47:00,190 --> 00:47:03,630
But again, every use case is different and depending on what you're storing there.

490
00:47:03,630 --> 00:47:08,030
So it's a long winded answer, but there's a lot of depends, but there's some really useful features.

491
00:47:08,030 --> 00:47:11,670
In other cases, a lot of businesses, I say, no, it's not right for you.

492
00:47:13,970 --> 00:47:14,830
Got it.

493
00:47:14,830 --> 00:47:22,570
And then another question, is there any form of encryption adopted by OneDrive that minimizes the risk of disclosure?

494
00:47:22,570 --> 00:47:26,910
I'm making reference to access the local files in plain file.

495
00:47:27,090 --> 00:47:27,890
Got it.

496
00:47:27,890 --> 00:47:30,170
So not that I'm aware of.

497
00:47:30,170 --> 00:47:32,590
No, I think they're obviously in transit.

498
00:47:32,770 --> 00:47:37,890
OneDrive, Google Drive, all that stuff is traversing over SSL TLS.

499
00:47:37,890 --> 00:47:40,990
And so it's essentially encrypted in transit.

500
00:47:40,990 --> 00:47:44,990
And then I'm assuming it's encrypted also when it's sitting there in the cloud.

501
00:47:45,430 --> 00:47:48,130
But on the local file system, no.

502
00:47:48,130 --> 00:47:51,110
I mean, once it's sitting there, it's sitting there.

503
00:47:52,690 --> 00:48:01,190
Couple caveats though, is that a lot of those caching or those shell files, where it's only the file name, but it's not actually downloaded.

504
00:48:01,610 --> 00:48:03,270
I've had issues with that.

505
00:48:03,270 --> 00:48:14,770
And I could see where that could almost benefit you from security standpoint, is that if you try and copy all the files in OneDrive onto a thumb drive or something else, it has to download each one and then move it over.

506
00:48:14,770 --> 00:48:19,950
And if it doesn't have connectivity or you're signed out or anything like that, it will error out.

507
00:48:19,950 --> 00:48:21,630
It won't actually copy those files over.

508
00:48:21,630 --> 00:48:24,670
It's really just a shell or a shortcut that points to that file.

509
00:48:24,670 --> 00:48:29,610
So not really encryption, but that's, I mean, that's one security measure.

510
00:48:29,610 --> 00:48:33,170
I guess it wasn't meant as a security measure, but it helps you out.

511
00:48:34,070 --> 00:48:42,490
And then every solution we're going to look at today, all of them, all this local stuff, like the caches, the logs, everything is in clear text.

512
00:48:42,490 --> 00:48:46,310
So you have access to all the databases from all these tools.

513
00:48:46,390 --> 00:48:57,870
OneDrive doesn't use databases, it uses the registry, but Google Drive, Box, Dropbox, Citrix ShareFile, they all use SQLite databases, and all of them are in clear text.

514
00:48:57,870 --> 00:49:01,570
So you don't even need a password, you just open them up and you get access to all this stuff.

515
00:49:02,210 --> 00:49:09,190
With the caveat of Dropbox, and Dropbox is the only one that actually encrypts their databases and some other stuff at rest.

516
00:49:09,190 --> 00:49:17,970
So the files are not, but at least the database and the metadata, you won't be able to get into that unless you do some further exploits.

517
00:49:20,190 --> 00:49:24,810
Okay, so let me do a quick walkthrough on this, and then we'll move on to the next piece.

518
00:49:24,810 --> 00:49:32,310
So the first one, it says to go ahead and navigate over to the cid-profileserviceresponse.txt file and open it with Notepad++.

519
00:49:32,990 --> 00:49:42,150
So some of this, I might have an issue with my walkthrough because my VM that I normally use for this, I haven't touched it in a while, and I forgot the password.

520
00:49:42,150 --> 00:49:46,450
So I had to like last night, all of a sudden move all these artifacts over and try and get it reset up.

521
00:49:46,450 --> 00:49:48,170
So if it's a little bumpy, I apologize.

522
00:49:48,870 --> 00:50:01,130
So you've got, if you extract that zip file that I've got with the evidence, basically, you're going to see a folder structure of C, essentially, if you were on the file system, you'd click on the C drive.

523
00:50:01,350 --> 00:50:06,490
And then you're not going to see everything, but you're going to see the things that I extracted with CAPE within 10 seconds.

524
00:50:06,490 --> 00:50:17,550
So an incident happened, you know, Bob McLee called us in, or not Bob McLee, but the Mike Wiley LLC about Bob McLee, and said, we think there's an issue, please, you know, figure out what happened.

525
00:50:17,550 --> 00:50:28,770
So what I did is I grabbed CAPE, a tool, and I basically then, I've got a custom CAPE target that extracts all stuff related to cloud storage solutions.

526
00:50:28,790 --> 00:50:31,950
I said, collect it from this hard drive, the C drive.

527
00:50:31,950 --> 00:50:35,790
And within 10 seconds, it created the zip file for me, or for us.

528
00:50:35,790 --> 00:50:41,250
And it gives us all relevant information to these Google, or not Google Drive, but these cloud file storage solutions.

529
00:50:41,350 --> 00:50:47,470
So we're going to go over to users, Bob, for Bob McLee, we're going to go to app data, local, Microsoft.

530
00:50:47,490 --> 00:50:50,310
And so you can see, this is most of the data we're going to look at today.

531
00:50:50,310 --> 00:50:58,730
But we're going from Microsoft, there was no business account.

532
00:50:58,730 --> 00:51:01,790
So this was not a paid subscription, this is a personal account.

533
00:51:01,790 --> 00:51:11,170
So immediately, we notate that for our incident, we go into personal, and then we should see that CID dash profile service response.

534
00:51:11,170 --> 00:51:14,430
So what's Bob's Microsoft OneDrive CID?

535
00:51:14,430 --> 00:51:15,990
Well, it's right here.

536
00:51:16,670 --> 00:51:20,930
Okay, so we've copied that we now know that CID in case we see it elsewhere.

537
00:51:21,190 --> 00:51:26,890
The next question asks us, examine this file and look for the principal name.

538
00:51:26,890 --> 00:51:28,750
So we want to double click on this.

539
00:51:29,530 --> 00:51:32,130
And we just make this larger for you.

540
00:51:33,350 --> 00:51:38,030
Word wrap, edit, and format.

541
00:51:41,610 --> 00:51:48,150
Okay, and so we could see here, obviously, that they're using OneDrive principal name, Bob McLee, so we have the right computer.

542
00:51:49,050 --> 00:51:52,870
We could see their CID again, right here, we see their email address.

543
00:51:52,870 --> 00:51:57,450
So it was bob.mcleegmail, this matches what HR told us is their personal email address.

544
00:51:57,450 --> 00:52:01,250
And then we don't see a phone number, job title, as in most cases, we won't.

545
00:52:01,730 --> 00:52:08,690
Okay, the next question is, what is the device ID of the system you're investigating, right?

546
00:52:08,690 --> 00:52:17,210
So we want to see, we didn't do the acquisition, all we did was given the zip file, and we want to know, well, which system is this in case we have to go to court.

547
00:52:17,970 --> 00:52:23,610
Okay, so I want to go ahead and go over to OneDrive logs, and then personal.

548
00:52:23,650 --> 00:52:28,670
So I'm going to close this, and go back to OneDrive, logs, personal.

549
00:52:29,330 --> 00:52:34,370
And then within here, I'm going to go ahead and look for the sync diagnostics file.

550
00:52:34,430 --> 00:52:35,690
So I got this one.

551
00:52:35,790 --> 00:52:37,650
Let me see if I have notepad++.

552
00:52:37,650 --> 00:52:38,170
Perfect.

553
00:52:39,910 --> 00:52:41,430
This is going to be a little easier.

554
00:52:46,320 --> 00:52:50,880
Okay, and so within here, we can see the question was, what's the device ID?

555
00:53:01,090 --> 00:53:02,730
So my device ID.

556
00:53:02,950 --> 00:53:06,170
So we see we copy that, and that's got a unique device ID.

557
00:53:09,380 --> 00:53:11,140
Get on my zoom here.

558
00:53:15,030 --> 00:53:19,410
Okay, and then the next question is, how many files folders are synced?

559
00:53:19,410 --> 00:53:22,890
So we can just look through here for files.

560
00:53:22,890 --> 00:53:24,710
13 files were synced.

561
00:53:24,710 --> 00:53:28,090
Let's see if I can just make this view a little better for you.

562
00:53:28,890 --> 00:53:30,310
Zoom in.

563
00:53:33,670 --> 00:53:34,490
There we go.

564
00:53:34,490 --> 00:53:35,630
That's much better.

565
00:53:36,070 --> 00:53:44,030
Okay, so files, there's 13 folders, there's three, so we can see that they're not really a big user, but there might be some interesting files and folders we want to look at.

566
00:53:44,030 --> 00:53:47,150
But essentially, there's 13 files that we're looking for.

567
00:53:49,800 --> 00:54:01,920
Okay, and then we want to look for... next step is to navigate over to personal, and we want to open up the obfuscation string map.

568
00:54:01,920 --> 00:54:04,580
So I'm going to close this or just minimize that.

569
00:54:05,100 --> 00:54:06,300
Go back here.

570
00:54:07,440 --> 00:54:10,480
Obfuscation string map, we'll open that up as well.

571
00:54:10,480 --> 00:54:18,560
And so now we can see, even if we don't know everything, we can start getting on the right hand side here, I can see different files and folders.

572
00:54:18,560 --> 00:54:23,000
So I see that C drive, users, Bob, metadata, app data.

573
00:54:23,840 --> 00:54:27,020
Scroll down, we can look for anything that's interesting here.

574
00:54:27,140 --> 00:54:30,900
Okay, we've got Bob again, desktop, users.

575
00:54:33,320 --> 00:54:38,520
Okay, keep scrolling down, we could see email address, I see there's some type of possibly PowerPoint, some mail.

576
00:54:42,740 --> 00:54:45,160
Okay, client.

577
00:54:45,560 --> 00:54:48,000
So there might be a client's folder we're looking for.

578
00:54:48,000 --> 00:54:53,620
But you could just start parsing through this and start seeing different possible file names or things that are interesting.

579
00:54:53,620 --> 00:54:59,900
Imagine if you see like password, or, you know, here's some messages or messaging possibly.

580
00:55:00,620 --> 00:55:02,200
You know, you can just parse through that.

581
00:55:02,200 --> 00:55:07,880
At the very, at the very least, even if you don't go into other things, you can start looking for interesting file names and folders there.

582
00:55:08,840 --> 00:55:21,060
Okay, but then it says we are looking for, we found something that was 123, me, you, they, who, what, where, and so we want to match that up.

583
00:55:21,060 --> 00:55:24,900
So I can just search here and see my searching.

584
00:55:26,460 --> 00:55:32,040
It's hard using a Mac and then a Windows VM, the control keys are not matching up.

585
00:55:32,040 --> 00:55:32,920
There we go.

586
00:55:32,920 --> 00:55:35,340
Okay, so 123.

587
00:55:39,050 --> 00:55:39,530
And

588
00:55:43,490 --> 00:55:46,410
of course, it's not working.

589
00:55:46,410 --> 00:55:47,450
Let me see.

590
00:55:53,580 --> 00:55:55,380
Go to the top again.

591
00:55:59,130 --> 00:56:00,890
Oh, I see.

592
00:56:01,470 --> 00:56:03,170
I was giving you a sample.

593
00:56:03,170 --> 00:56:05,710
I was wondering why the heck is the 123 not there.

594
00:56:05,710 --> 00:56:12,030
But really, we were trying to figure out what the C drive slash user slash Bob was going to equate to.

595
00:56:12,030 --> 00:56:14,050
And so I give the example which didn't exist.

596
00:56:14,050 --> 00:56:21,850
But essentially, what I'm looking for here is, if I'm trying to find my logs, I'm gonna open up a new tab.

597
00:56:29,700 --> 00:56:33,120
Okay, so if I'm looking for the C drive, it would look something like this.

598
00:56:34,100 --> 00:56:35,640
And then users.

599
00:56:35,800 --> 00:56:39,120
So I look down here for users, it's gonna be this one.

600
00:56:42,320 --> 00:56:45,500
Okay, and then Bob, go back here.

601
00:56:46,340 --> 00:56:47,760
It's gonna be this.

602
00:56:49,980 --> 00:56:50,780
Copy.

603
00:56:51,940 --> 00:57:02,740
Basically, so if we're looking in log files, we're looking for something like this, if we want to see things that were placed in C users, Bob's directory, right, this is essentially the path we're gonna be looking for in the log files.

604
00:57:04,360 --> 00:57:12,440
Okay, then the next step here is that we are going to navigate over to the CID.dat file.

605
00:57:19,600 --> 00:57:20,880
Okay, personal.

606
00:57:21,720 --> 00:57:26,140
And then this is our CID.dat file, I recommend opening up with a hex editor.

607
00:57:27,620 --> 00:57:30,020
This one's probably expired.

608
00:57:30,020 --> 00:57:36,640
I'm just going to use a different tool than you have here because I haven't installed HXD on this one.

609
00:57:36,660 --> 00:57:40,500
But if we look through here on the right hand side, this should be the ASCII.

610
00:57:40,540 --> 00:57:45,400
If I scroll down, we can look for things like, did I tell you exactly what to look for?

611
00:57:45,600 --> 00:57:46,800
Personal vault.

612
00:57:48,040 --> 00:57:51,060
So we start looking for that, I'm just gonna scroll slower.

613
00:57:56,620 --> 00:58:00,440
Okay, there it is, I see personal vault right here.

614
00:58:01,400 --> 00:58:08,420
Okay, and then we're looking for, look at the question again, we're scrolling down looking for the next folder name that we see.

615
00:58:08,420 --> 00:58:17,930
So I'm going to keep scrolling slower, scroll, scroll, scroll, nothing there.

616
00:58:18,170 --> 00:58:21,770
You can see why I might want to use strings here, because this is just a little bit messy.

617
00:58:25,960 --> 00:58:29,720
Okay, and now I see something else here, another folder called operations.

618
00:58:31,040 --> 00:58:32,840
Right, so there's another folder called operations.

619
00:58:32,840 --> 00:58:33,900
And you can keep parsing this.

620
00:58:33,900 --> 00:58:39,640
But again, if you use strings, I didn't want to give too many tools, but strings is going to make it a lot easier to parse that out.

621
00:58:44,460 --> 00:58:51,540
Okay, the next thing I have here is we're going to open up the CID.ini file.

622
00:58:51,540 --> 00:58:57,400
So I'll go back over here, CID.ini, I'll open it in notepad++.

623
00:58:58,380 --> 00:59:04,240
And we're going to go ahead and look for the local file path where things are stored.

624
00:59:04,740 --> 00:59:08,920
So I'm looking for the library, if I scroll over to the right here, whoops.

625
00:59:10,840 --> 00:59:14,160
We can see this is where things are stored for Bob.

626
00:59:14,160 --> 00:59:20,080
So anything that's synced with OneDrive, it's going to be stored in this location there, C users Bob OneDrive, which is what we'd expect.

627
00:59:20,080 --> 00:59:21,140
That's the default.

628
00:59:22,500 --> 00:59:25,580
Okay, now we want to run Registry Explorer.

629
00:59:25,600 --> 00:59:30,600
And we are going to load the registry hive.

630
00:59:30,600 --> 00:59:35,220
So I am going to go, hopefully, I remember where I put it.

631
00:59:35,340 --> 00:59:37,340
I think I put it in my downloads.

632
00:59:42,490 --> 00:59:43,950
Another tab here.

633
00:59:46,770 --> 00:59:47,570
Downloads.

634
00:59:50,030 --> 00:59:50,870
I did.

635
00:59:50,870 --> 00:59:56,350
Okay, so my installer software, just like you do, and I want to open up Registry Explorer.

636
00:59:59,130 --> 01:00:01,950
And you might get an error when you open this up.

637
01:00:01,950 --> 01:00:03,250
We'll see if I get it.

638
01:00:21,490 --> 01:00:24,170
Nope, I must have changed the settings.

639
01:00:24,170 --> 01:00:32,730
But if you do get an error about Windows protecting your PC, you just click on more, and then you run anyways, to try and bypass that.

640
01:00:33,450 --> 01:00:36,370
Okay, so the next step is that we want to load a registry hive.

641
01:00:36,370 --> 01:00:39,790
So I'm going to click on file, load hive.

642
01:00:41,930 --> 01:00:45,190
Once that's loaded, I'm going to go to our evidence.

643
01:00:45,230 --> 01:00:48,770
So I have extracted my evidence, I believe, in my downloads folder.

644
01:00:48,850 --> 01:00:50,470
And then I have my evidence here.

645
01:00:51,330 --> 01:00:53,530
Click on that, click on the C drive.

646
01:00:53,530 --> 01:00:57,070
Within the C drive, under the users, we go to Bob.

647
01:00:57,110 --> 01:00:59,770
And within Bob, we should see NTUser.dat.

648
01:00:59,770 --> 01:01:04,350
When I click on NTUser.dat, it's going to open up the registry hive.

649
01:01:04,350 --> 01:01:09,790
But if you don't know how the registry works, it's generally going to be dirty.

650
01:01:09,790 --> 01:01:12,650
Things are going to be in these log files until you reboot.

651
01:01:12,650 --> 01:01:15,870
That's why a lot of times when you make registry changes, they say reboot afterwards.

652
01:01:16,110 --> 01:01:19,550
So these log files are the transaction logs that are not written yet.

653
01:01:19,550 --> 01:01:20,990
And we want those to be written.

654
01:01:20,990 --> 01:01:25,830
So when we open this, we're going to get an error probably that says, hey, it's a dirty hive.

655
01:01:25,990 --> 01:01:28,070
If we get that, we should.

656
01:01:28,070 --> 01:01:29,350
We're going to click yes.

657
01:01:29,770 --> 01:01:37,270
And then it's going to say that we have to pick essentially which transaction logs we want to replay.

658
01:01:37,350 --> 01:01:38,790
So I'm going to click OK.

659
01:01:39,310 --> 01:01:43,510
I'm going to select both the .log1 and .log2 file.

660
01:01:43,610 --> 01:01:47,750
I want both of these transaction logs to be replayed to the registry hive.

661
01:01:47,810 --> 01:01:48,950
So I click open.

662
01:01:50,530 --> 01:01:51,370
Click OK.

663
01:01:54,290 --> 01:01:54,590
OK.

664
01:01:54,590 --> 01:01:56,890
And it's going to say, where do you want this to be saved to?

665
01:01:57,990 --> 01:02:00,010
I'm just going to throw it back in my evidence folder.

666
01:02:00,010 --> 01:02:01,510
So I'm going to go back to downloads.

667
01:02:04,290 --> 01:02:06,370
C drive, users, Bob.

668
01:02:06,390 --> 01:02:07,550
And I'll just dump it right here.

669
01:02:07,550 --> 01:02:08,670
It doesn't really matter where.

670
01:02:09,410 --> 01:02:11,790
And it says, great, it's been updated.

671
01:02:12,570 --> 01:02:14,030
And the sequence numbers match.

672
01:02:14,030 --> 01:02:14,910
So that's a good thing.

673
01:02:14,910 --> 01:02:17,470
Do you want us to load the updated hive?

674
01:02:17,510 --> 01:02:18,190
Absolutely.

675
01:02:18,190 --> 01:02:18,970
Thank you.

676
01:02:19,050 --> 01:02:19,710
Yes.

677
01:02:19,710 --> 01:02:21,510
And it says, do you want to load the dirty hive?

678
01:02:21,510 --> 01:02:21,750
No.

679
01:02:21,750 --> 01:02:23,030
Why would I want the dirty one?

680
01:02:23,030 --> 01:02:24,430
So bye-bye.

681
01:02:25,190 --> 01:02:25,790
OK.

682
01:02:26,090 --> 01:02:27,750
And now we're able to parse this out.

683
01:02:27,750 --> 01:02:34,810
So now that we've loaded this up, what we want to do is I want you to go to software, Microsoft, OneDrive, accounts, and then personal.

684
01:02:34,890 --> 01:02:36,490
So I'm going to expand this.

685
01:02:37,330 --> 01:02:38,830
This is going to be a problem.

686
01:02:38,870 --> 01:02:47,150
Every time I have this in my VM, for some reason within the VM, it gets all messed up with the font here.

687
01:02:47,150 --> 01:02:48,830
Let me see if there's an easier way.

688
01:02:48,830 --> 01:02:49,970
Or I'll probably have to zoom in.

689
01:02:49,970 --> 01:02:51,050
So give me a second.

690
01:02:51,970 --> 01:02:54,310
And if I don't go blind before then.

691
01:02:56,450 --> 01:02:57,250
Microsoft.

692
01:03:05,250 --> 01:03:07,190
So hard to see this.

693
01:03:07,950 --> 01:03:08,910
OneDrive.

694
01:03:13,020 --> 01:03:14,600
And accounts.

695
01:03:17,250 --> 01:03:18,210
Personal.

696
01:03:22,610 --> 01:03:23,110
OK.

697
01:03:23,170 --> 01:03:24,810
Now let's see if I can...

698
01:03:29,210 --> 01:03:30,390
There we go.

699
01:03:31,930 --> 01:03:33,490
So I know it's small.

700
01:03:33,490 --> 01:03:36,070
For some reason, it gets all messed up in here.

701
01:03:36,070 --> 01:03:38,910
But let's see if I can go even a little bigger for you.

702
01:03:40,410 --> 01:03:41,010
OK.

703
01:03:41,010 --> 01:03:43,890
So I basically just browse to the registry location.

704
01:03:44,230 --> 01:03:46,810
And then... one second.

705
01:03:46,810 --> 01:03:50,490
Let me scroll down on the instructions so I make sure I give you the right steps.

706
01:03:51,270 --> 01:03:51,610
OK.

707
01:03:51,610 --> 01:03:57,710
And so some of the things that you want to answer here are... oh, no.

708
01:03:59,630 --> 01:04:00,250
Hang on.

709
01:04:00,250 --> 01:04:00,730
Sorry.

710
01:04:00,730 --> 01:04:02,030
Let's go back.

711
01:04:02,030 --> 01:04:03,190
Increase this.

712
01:04:05,350 --> 01:04:10,070
Well, I may not show a bunch of these demos with the registry if this is going to happen every time.

713
01:04:10,070 --> 01:04:13,310
But we can see the user email in here.

714
01:04:13,850 --> 01:04:19,050
So we see that it's bob.mclee.re.gmail.com.

715
01:04:19,110 --> 01:04:20,710
We can look at the CID.

716
01:04:20,710 --> 01:04:22,870
So we can see the CID of the user down here.

717
01:04:22,870 --> 01:04:28,790
We can see the default file store, which is C, Users, Bob, OneDrive.

718
01:04:28,790 --> 01:04:30,730
We can see the last sign-in time.

719
01:04:30,990 --> 01:04:32,110
Where is it?

720
01:04:32,590 --> 01:04:37,310
Last sign-in time, 15.87.12.89.85.

721
01:04:37,310 --> 01:04:42,890
We do need to convert this from Unix Epoch time to standard time.

722
01:04:42,890 --> 01:04:49,310
So you can do that by just copying and pasting this in Google or looking for a Unix Epoch converter.

723
01:04:49,310 --> 01:04:52,050
And you can just sort that out and it'll give you the exact time.

724
01:04:52,050 --> 01:04:57,390
But almost everything we're going to look at today, almost everything, is in Unix Epoch time.

725
01:04:57,750 --> 01:05:00,010
We can see the first time that the device was synced.

726
01:05:00,010 --> 01:05:08,050
So if we go to client first sign-in time down here, this tells me when they first started syncing with OneDrive.

727
01:05:08,050 --> 01:05:11,030
So we can get a lot of useful information just by analyzing that.

728
01:05:12,230 --> 01:05:13,950
Hopefully, there's no more registry things.

729
01:05:13,950 --> 01:05:16,730
Let me see if there's anything else because that's going to be a pain to do.

730
01:05:18,550 --> 01:05:21,770
Okay, and then we can also look at... there's one more that I'll just show you.

731
01:05:21,770 --> 01:05:29,070
The registry piece here is that, aside from personal, what other directories are shared or synced with this user that they don't own?

732
01:05:29,750 --> 01:05:33,130
I'm going to get to it first and then I'll zoom in here for you.

733
01:05:33,370 --> 01:05:39,830
Actually, let's see if I can tell the slide here.

734
01:05:39,830 --> 01:05:43,490
So we want to go to Software, Sync Engines, Providers.

735
01:05:43,490 --> 01:05:44,850
Okay,

736
01:05:48,620 --> 01:05:57,560
Software, Sync Engines, Providers, OneDrive.

737
01:05:58,020 --> 01:06:03,320
And so just looking here under this OneDrive directory, we can see that Finance, Operations, and Personal.

738
01:06:03,320 --> 01:06:04,980
So I said what else besides personal?

739
01:06:04,980 --> 01:06:09,960
So there's a Finance and Operations directory that were shared with this user.

740
01:06:09,960 --> 01:06:11,140
So they don't own that.

741
01:06:11,140 --> 01:06:13,120
However, they have access to it.

742
01:06:13,120 --> 01:06:16,200
And therefore, we may be able to get access to those files as well.

743
01:06:20,540 --> 01:06:24,300
And I think that wraps up that lab.

744
01:06:24,300 --> 01:06:25,560
There's one more question.

745
01:06:25,680 --> 01:06:33,180
Clicking into the personal, another shared folder keys, registry hives, what data value do you see in the CIDs?

746
01:06:33,180 --> 01:06:35,100
So I will show you that one again.

747
01:06:36,820 --> 01:06:41,440
So if I do click on, let's say personal, because we know personal belongs to this user.

748
01:06:42,040 --> 01:06:53,160
If I go up here, try and get this down, we can see the CID of the user that owns personal here starts with 87 and ends in B0, Bravo 0.

749
01:06:53,240 --> 01:07:01,280
Now, if I go click on operations, let's go back up here and see that the CID is different.

750
01:07:01,560 --> 01:07:06,460
So that CID, basically, this is a folder that is owned by someone else.

751
01:07:07,120 --> 01:07:07,920
Cool.

752
01:07:07,960 --> 01:07:10,060
That wraps up the walkthrough for that lab.

753
01:07:10,060 --> 01:07:11,640
So let's move on now to Google Drive.

754
01:07:11,640 --> 01:07:13,620
Google Drive behaves a little bit differently.

755
01:07:13,620 --> 01:07:18,620
Microsoft obviously is baked in, so they have the ability to use a lot of the registry as if it was a database.

756
01:07:19,180 --> 01:07:22,660
I guess it kind of is a database, but they have access to that, right?

757
01:07:22,660 --> 01:07:25,600
Where some of these other solutions have to build this to make it portable.

758
01:07:26,540 --> 01:07:33,660
So with Google Drive, you've got... I keep calling it Google Drive, but the personal version is really called Backup and Sync.

759
01:07:34,100 --> 01:07:35,940
But I'm just going to keep calling it Google Drive.

760
01:07:35,940 --> 01:07:37,180
I'm old school like that.

761
01:07:37,220 --> 01:07:40,880
If you're talking about the business version, it's called Drive File Stream.

762
01:07:40,880 --> 01:07:42,880
It's part of the G Suite offerings.

763
01:07:43,600 --> 01:07:49,920
They're backed by SQLite databases rather than just text files and registry keys like we saw with OneDrive.

764
01:07:50,480 --> 01:07:54,760
So the Drive File Stream, it creates... it's a little bit different.

765
01:07:54,760 --> 01:08:00,280
It's similar to Citrix share file in that it creates a virtual FAT32 volume and mounts it.

766
01:08:00,280 --> 01:08:07,000
So you're going to actually have like a G Drive sitting there that looks like a mounted file or file system.

767
01:08:07,800 --> 01:08:09,920
Sync to Google formatted files will create a shell.

768
01:08:09,920 --> 01:08:15,580
So what's interesting is that even if they're syncing, you don't actually get the Google file locally.

769
01:08:15,580 --> 01:08:23,780
So if you create a Google Sheets or a Google document within Google Drive web browser, it syncs.

770
01:08:23,780 --> 01:08:26,220
It's supposed to be syncing locally to your file system.

771
01:08:26,220 --> 01:08:37,800
What happens is that it creates a shell file and that shell file will have, if you open it up in a text editor or a hex editor, you'll see the URL, the document ID, and the email address of that user.

772
01:08:37,800 --> 01:08:38,660
So it's kind of interesting.

773
01:08:38,660 --> 01:08:41,220
It's not the actual file, it just redirects you to that.

774
01:08:42,040 --> 01:08:52,860
Some interesting locations and databases and files that you may find when you are examining the system is that you've got the sync underscore config DB file.

775
01:08:53,280 --> 01:08:58,460
It'll give you the user's info like their preferences, initial application sync time, and stuff like that.

776
01:08:58,460 --> 01:09:06,720
The cloud underscore graph database will give you metadata for both local, cloud, and shared files and folders with that user.

777
01:09:07,300 --> 01:09:16,500
The sync underscore log dot log file will give you added, deleted, modified, renamed files for that user.

778
01:09:17,100 --> 01:09:23,220
The snapshot dot DB database will give you local file metadata, so things that are just locally.

779
01:09:23,360 --> 01:09:29,620
And if the user is using G Suite, the content underscore cache will give you local file caches.

780
01:09:29,620 --> 01:09:38,840
I think this also worked partially with Google Drive personal version, but there was slight differences there.

781
01:09:39,080 --> 01:09:42,140
Also, we'll see the metadata underscore SQLite DB.

782
01:09:42,320 --> 01:09:47,620
That will give offline files, cloud files, deleted files, and other metadata.

783
01:09:48,100 --> 01:10:02,960
So if we dive a little deeper and look at the sync config database, which is located inside of AppData local Google Drive, it's got a bunch of different tables, but the one of interest is the data table.

784
01:10:02,980 --> 01:10:11,120
And within the data table, we're going to see the highest application version, so we can see what version they're using, see if there's any known vulnerabilities or exploits.

785
01:10:11,300 --> 01:10:19,100
With the local sync route path, you get the path of the local file source or where those are sitting locally on their file system.

786
01:10:19,520 --> 01:10:22,180
We'll also get the user's Gmail account.

787
01:10:22,440 --> 01:10:24,460
So here's a screenshot of what that'll look like.

788
01:10:24,460 --> 01:10:31,460
We pivot over into the data table, and that's where we can see those different rows with interesting information.

789
01:10:31,460 --> 01:10:42,120
The Cloud Graph database, the main table that we're interested in is the Cloud Graph entry table.

790
01:10:42,120 --> 01:10:52,760
And that's going to give us stuff like every document in their Google Drive with the unique ID, the file name or folder of the object that's synced.

791
01:10:53,060 --> 01:10:59,860
The last time it was modified in Unix Epoch, I did not test on what triggers that modify time.

792
01:10:59,860 --> 01:11:08,560
So I do want to just warn you if you're an incident responder or forensics, you may want to do some testing to verify that is it a file open?

793
01:11:08,560 --> 01:11:10,460
Is it a edit?

794
01:11:10,460 --> 01:11:11,400
Is it a sync?

795
01:11:11,400 --> 01:11:13,020
What will trigger that modify time?

796
01:11:13,020 --> 01:11:14,800
I didn't go that far into detail.

797
01:11:15,060 --> 01:11:24,000
The ACL role will tell you whether or not the owner, so the person you're looking at on their system, if they own the file or if it's shared with them.

798
01:11:24,280 --> 01:11:33,620
We also, what's interesting is with Google Drive is that you'll see a doc type column, and the doc type column will give you what format the file is.

799
01:11:33,620 --> 01:11:36,020
And so it's a little bit limited, but it's interesting.

800
01:11:36,020 --> 01:11:42,180
If you see a zero, it means that the object you're looking at is a folder or a directory or equivalent to a directory.

801
01:11:42,880 --> 01:11:50,480
If you see a one, you'll see that it's a traditional file, like a Word doc, a PDF, something like that, a zip file.

802
01:11:50,660 --> 01:11:57,820
If you see two through 13, those are reserved for Google Files, but they go a little bit more detail since they own those files, obviously.

803
01:11:57,820 --> 01:12:00,500
If it's three, it's a Google formatted presentation.

804
01:12:00,500 --> 01:12:03,080
Sorry, a two is a Google formatted presentation.

805
01:12:03,320 --> 01:12:05,660
A four is a Google formatted spreadsheet.

806
01:12:06,320 --> 01:12:09,120
A six is a Google formatted document.

807
01:12:09,500 --> 01:12:13,320
Now, there's a removed column, and I couldn't get that to trigger.

808
01:12:13,320 --> 01:12:17,640
So when I deleted things, I moved to the trash, nothing really changed there.

809
01:12:17,980 --> 01:12:21,060
So I'm not sure what that's reserved for or why Google has that.

810
01:12:21,180 --> 01:12:24,180
We also get something that's really interesting is the file hash.

811
01:12:24,180 --> 01:12:33,040
So we get the file hash of the object, whether it's a Google spreadsheet, or it's a PDF, we're going to get the MD5 hash of that object.

812
01:12:33,900 --> 01:12:42,160
If we open it up in the database and DB browser for SQLite, we're going to be able to see things there, like I just talked about.

813
01:12:42,160 --> 01:12:46,600
Now, that doc ID is unique across Google Drive.

814
01:12:46,660 --> 01:12:51,880
And so you're going to be able to identify that if you didn't have the hash, you could find that in other databases as well.

815
01:12:51,880 --> 01:12:56,260
But we can even see there the different file names of all those files that are in the Google Drive.

816
01:12:58,600 --> 01:13:05,840
The sync underscore log dot log file, this one was a little bit hard to read, and we'll take a look at it.

817
01:13:05,840 --> 01:13:16,220
But it's, in my opinion, a little better if you use some type of parsing tool like bash, maybe use grep or awk, or you have a sim, you could even do a free tier of Sumo logic to parse this out.

818
01:13:16,600 --> 01:13:19,480
There are tons of different actions that are interesting.

819
01:13:19,480 --> 01:13:22,040
Everything is started with action dot.

820
01:13:22,040 --> 01:13:29,460
So you could do action dot wildcard, or if there's specific actions you were trying to narrow down to see, you know, is this user using Google Drive?

821
01:13:29,460 --> 01:13:31,100
Are they deleting files?

822
01:13:31,100 --> 01:13:31,720
What's going on?

823
01:13:31,720 --> 01:13:36,860
Whatever action you're interested in, you can parse for those, you can grep them, you can search for them, etc.

824
01:13:38,320 --> 01:13:41,840
And then not only that, but you can also see the direction that things happen.

825
01:13:41,840 --> 01:13:44,940
So was the action to delete, was that local?

826
01:13:44,940 --> 01:13:46,800
Or did they delete it within the cloud?

827
01:13:47,320 --> 01:13:48,860
Did they add a new file?

828
01:13:48,860 --> 01:13:50,840
Was that added on the local file system?

829
01:13:50,840 --> 01:13:54,160
Or did they add it by going to drive.google.com?

830
01:13:54,160 --> 01:14:00,980
So looking in that log file, you can actually look at the direction dot, it'll tell you if it was initiated within the cloud or locally.

831
01:14:01,160 --> 01:14:04,280
You also see shared equals and then true or false.

832
01:14:04,280 --> 01:14:07,060
And that tells you if it's if they're sharing enabled or not.

833
01:14:07,060 --> 01:14:13,920
And then another way that I found useful for parsing for file names is I grep for name equals you.

834
01:14:14,220 --> 01:14:17,620
And then you'll look, you'll be able to find all the different file names.

835
01:14:17,620 --> 01:14:23,680
And you could even then grep for certain things like pass or password, or username, whatever your use case is there.

836
01:14:23,980 --> 01:14:32,340
So just by for an example, I uploaded that file to Sumo Logic, and I did a log reduce so that you could see, it gives me a count.

837
01:14:32,340 --> 01:14:35,240
So I'm able to start to see, well, how many files were downloaded.

838
01:14:35,580 --> 01:14:44,420
And we could see there that 22 log files, or I guess entries in the log file match that telling me that there was a download action.

839
01:14:44,420 --> 01:14:47,940
So something happened from the cloud, and then it was synced locally.

840
01:14:49,480 --> 01:14:55,420
If we look at that snapshot.db database, that'll give us similar things we saw before.

841
01:14:55,420 --> 01:15:01,000
But the added value that we see here is that whether or not the file is shared with other users.

842
01:15:01,000 --> 01:15:04,320
And that's gonna be one of the new fields that we'll see here are the columns.

843
01:15:06,340 --> 01:15:16,600
Something that you may have to look at for both snapshot.db and cloud underscore graph.db is that in the cloud relations table, you'll be able to map out where things are located.

844
01:15:16,600 --> 01:15:21,140
So the database doesn't give you a clear understanding of where things are positioned.

845
01:15:21,140 --> 01:15:23,260
Do we have files and folders?

846
01:15:23,260 --> 01:15:26,440
Or do we have... what are those folders called?

847
01:15:26,440 --> 01:15:31,300
So you might have to look in both those databases in the cloud relations table.

848
01:15:31,300 --> 01:15:35,900
And within the cloud relations table, that gives you almost a key of where things are stored.

849
01:15:35,900 --> 01:15:40,080
And they're going to use those doc IDs and the parent doc IDs.

850
01:15:40,080 --> 01:15:48,960
And so you could see that on the right-hand side there, the one that starts with 1NGR blah, blah, blah, that's in the root.

851
01:15:48,960 --> 01:15:50,840
But then there's multiple files there.

852
01:15:50,840 --> 01:15:56,440
The row 2, 3, 4, 5, those are files that are sitting within that root folder.

853
01:15:57,820 --> 01:16:11,020
So this is essentially how you kind of map that back is if you're looking at, let's say, the cloud entry table, and you want to know, well, I see there's an object called finance, and I see a bunch of other files, but which files are sitting in the finance directory?

854
01:16:11,200 --> 01:16:17,000
Well, you would open up that cloud relations table, and then you could map those out and see, oh, okay, I get it.

855
01:16:17,000 --> 01:16:18,460
It's sitting in this directory.

856
01:16:20,260 --> 01:16:23,420
Okay, so this brings us up to a lab.

857
01:16:23,840 --> 01:16:30,460
I think what I'm going to go ahead and do is dive into some of the other ones since we've got about 40 minutes left.

858
01:16:30,460 --> 01:16:36,320
So I'm going to keep going with the slides, and then at the very end, I'll kind of hang around, and we can walk through some of those labs together.

859
01:16:36,940 --> 01:16:39,580
So as I mentioned, Dropbox is a bit different there.

860
01:16:39,840 --> 01:16:46,520
Dropbox uses encrypted SQLite databases, SQLite encrypted extension, SAE, since 2011.

861
01:16:46,520 --> 01:16:52,400
So very early on, they've been encrypting those SQLite databases, so we don't have as much visibility into them.

862
01:16:53,080 --> 01:16:58,820
Now, the bright side, though, is that the key for the encrypted database is stored in the registry.

863
01:16:58,820 --> 01:17:03,560
However, it's encrypted with Windows Data Protection API, or DPAPI, as I'll call it.

864
01:17:04,260 --> 01:17:11,860
You can either brute force the key, but good luck with that, or you can extract the DPAPI keys from memory.

865
01:17:12,000 --> 01:17:13,660
I was not able to do this.

866
01:17:13,660 --> 01:17:15,420
I tried this in the lab a couple of times.

867
01:17:15,420 --> 01:17:16,060
It didn't work.

868
01:17:16,060 --> 01:17:22,220
However, Francisco has a toolkit called DEC WinDBx Toolkit.

869
01:17:22,600 --> 01:17:28,600
I'll try and get you... hopefully, I've got the GitHub link on the next slide or two, but there's a toolkit.

870
01:17:28,600 --> 01:17:34,620
There's both Python, PowerShell, and executables that will pull that from memory.

871
01:17:34,760 --> 01:17:38,320
The version of Windows 10 I had in my lab environment, it would not work.

872
01:17:38,320 --> 01:17:43,320
So I don't know if that's because it was a lab environment, if it was the version of Windows.

873
01:17:43,320 --> 01:17:44,660
I didn't get it to work.

874
01:17:44,660 --> 01:17:51,260
However, there's plenty of talks out there that talk a little bit more about this.

875
01:17:51,260 --> 01:18:00,580
So you can go ahead and Google Dropbox DPAPI keys, and there's some great talks to talk about this and how they did their research.

876
01:18:00,960 --> 01:18:09,640
The one thing we will be able to see, though, even though the databases are encrypted, is that we'll see the .dropbox.cache, and that contains miscellaneous temporary cache files.

877
01:18:09,640 --> 01:18:17,040
So sometimes, even if there's files that are deleted by other users, we'll be able to see those deleted files within that cache location.

878
01:18:18,100 --> 01:18:35,060
Also, with a lot of these different Dropbox, is that when you delete files within the cloud, what happens is that if you're even on the web interface or on another system, when you delete that file, it syncs that delete.

879
01:18:35,060 --> 01:18:52,260
But unlike the cloud versions or the web interfaces where there's that temporary trash location that may be purged automatically between 30 or 120 days, when you delete that on the local file system, what generally happens is that file goes into the trash can.

880
01:18:52,520 --> 01:18:59,380
So often, if you go into the trash can on the local file, you'll end up finding things that were deleted from the cloud, and those do not get deleted automatically.

881
01:18:59,440 --> 01:19:05,960
It's going to take the user running CCleaner or right-clicking on their trash can or recycle bin and emptying those.

882
01:19:07,880 --> 01:19:14,660
So the other piece here, and this is the talk that I got some of this information from, was Nicholas and Florian.

883
01:19:14,660 --> 01:19:19,280
They did a talk called A Critical Analysis of Dropbox Software Security.

884
01:19:19,300 --> 01:19:29,360
It was at hack.lu in 2012, and they posted about it in their blog, and they talk about where these keys are located and how they extracted this out.

885
01:19:29,360 --> 01:19:32,180
But these are the file locations where those keys are stored.

886
01:19:33,560 --> 01:19:42,000
Okay, and I did post here, if you want to check out the dbx decryption toolkit, it did not work for me, but if you get it working, let me know.

887
01:19:42,000 --> 01:19:44,560
LinkedIn, Twitter, I'd love to hear how you got it working.

888
01:19:44,960 --> 01:19:52,840
So they have that toolkit located there, and you've got PS1 files, you've got Python files that essentially will extract that out.

889
01:19:54,640 --> 01:20:06,540
Okay, and then I just list out here a bunch of different directories and paths, but most of these we don't get a lot of information from because the .dbx and the .db databases, they are encrypted.

890
01:20:06,540 --> 01:20:14,060
So even the ones like home.db, where it looks like it might not be encrypted, I could not get any useful information out of those locations.

891
01:20:15,740 --> 01:20:17,260
Okay, with Box.

892
01:20:17,260 --> 01:20:19,820
So Box is very similar to Google Drive.

893
01:20:20,020 --> 01:20:27,880
We have a bunch of different files and locations, and then log files, as well as database files.

894
01:20:28,140 --> 01:20:42,000
The other cool thing, probably my favorite location within Box, is that there's the appdata local box cache directory, and that stores complete files that were opened both locally and are possibly even cached.

895
01:20:42,000 --> 01:20:49,540
So we will be able to see not the file name, but we'll actually be able to recover files, whether or not they've been deleted from Box.

896
01:20:51,140 --> 01:21:05,500
Okay, we also have some log files, which give us detailed activity of both the file activity, but then there's also a Box UI log file that tells us when the user logged in, what kind of network connection they had, if they lost internet connectivity.

897
01:21:05,500 --> 01:21:09,620
I mean, it's almost like stalking the user with the UI application.

898
01:21:09,620 --> 01:21:11,940
So there's a lot of detailed information there.

899
01:21:12,500 --> 01:21:24,620
We also have the boxstream.log, and that's going to give activity around metadata, paths, log locations, log files, free space on the file system, all kinds of juicy information there.

900
01:21:25,500 --> 01:21:31,900
And then we also have the syncrootfolder.txt, it just tells you where the default file store is located.

901
01:21:32,000 --> 01:21:40,320
And then there's a couple databases that will give you local files, cloud files, cached files, usernames, passwords, or not passwords, email addresses, and that kind of stuff.

902
01:21:41,160 --> 01:21:56,300
So if we looked at the boxstream.log, there's keywords that you might want to parse out with grep or awk, things like add file, add folder, on delete file, on delete folder, open, so you can get those different activities, and it'll tell you which files.

903
01:21:56,300 --> 01:22:04,100
So there on the screen, we can see a file was added, the date and time, the file was called the Mike Wiley 2020 strategic plan.rtf.

904
01:22:06,980 --> 01:22:14,620
Then also, we could see other things here about, you know, where things are cached, where the database is located, mount points, stuff like that.

905
01:22:15,660 --> 01:22:18,500
So as I mentioned, my favorite one is that cache directory.

906
01:22:18,500 --> 01:22:25,680
If you look at the cache directory, you'll see either what's a grid or a hash for the file, but it's not the actual file name.

907
01:22:25,700 --> 01:22:34,700
The cool thing, though, is that if you open up any of those files in a hex editor, you can look at the magic byte or magic bit in the beginning, and we can see it's an rtf file.

908
01:22:34,700 --> 01:22:43,640
So then we could just rename that file to example.rtf, and then we can open it up in a respective software application.

909
01:22:44,640 --> 01:22:47,980
The box UI, this is just a sample of what you might see.

910
01:22:47,980 --> 01:22:56,960
You could see when the user logged out, when they logged back in, hard drive space, network connectivity, all kinds of stuff built in there.

911
01:22:58,220 --> 01:23:12,140
And then within that box dash, and then the date, or version number, sorry, we're going to see those different files like test.txt, content created at, you know, different times, again, obviously, in Unix epoch time.

912
01:23:13,940 --> 01:23:28,640
Okay, and then we'll see the different box databases with interesting things, very similar to Dropbox, but this time we get SHA hashes, we can see when things were created, they were updated, again, take that with a grain of salt, I don't know which actions trigger those updated,

913
01:23:28,640 --> 01:23:34,080
if it's local, if it's cloud, if it's a combination, so you just don't want to rely on those dates unless you're sure.

914
01:23:35,240 --> 01:23:53,880
So here again, you can see those different, the local IDs, native item type, whether or not it's a file or folder, we can see the parent item ID, so we can map out what's sitting in what location, file names, inode ID, that inode ID is going to become important later for mapping things out to file names.

915
01:23:55,500 --> 01:24:13,760
Streams fs.db, there we get things like the file name of the item that's in that cache, so we could actually now, if we open streams fs.db, we can find out all those random file names that were sitting in that cache location, we can actually see the true file name to see if that's relevant or not.

916
01:24:16,220 --> 01:24:28,500
Okay, and then if we want to map that out, so if we want to see here, we've got the, that, that streams fs.db, and we go in the cache file table, we don't see the file name, but we do get to see that inode ID.

917
01:24:28,500 --> 01:24:32,480
So we're going to have to take that inode ID, open up the syncdb database.

918
01:24:32,560 --> 01:24:44,080
And from there, we can map the inode ID and we can see, oh, okay, so this A1, B4, blah, blah, blah, glitter hash, that is the business plan document that we want to recreate.

919
01:24:45,560 --> 01:24:56,040
And if we open that up again, in a hex editor, or even a text pad, or notepad, we can see that the, we've got the magic byte of PK, which tells us it's a .x.

920
01:24:56,040 --> 01:24:59,280
So we can now rename that file business plan.

921
01:24:59,500 --> 01:25:02,300
.x, and we can then open it up in Microsoft Word.

922
01:25:02,440 --> 01:25:12,420
So I went ahead and did that, I renamed the file, give it the proper file extension, opened it up this time in WordPad, and we can actually see that business plan for startup business.

923
01:25:12,740 --> 01:25:16,820
And that file had been deleted from, from Box.

924
01:25:16,820 --> 01:25:20,120
So it was no longer sitting in Box, but the cache was still sitting there.

925
01:25:22,220 --> 01:25:26,020
Okay, just map out some more of those things and what those locations are for.

926
01:25:26,800 --> 01:25:36,480
So again, I'm going to keep going, and then we'll come back to the lab afterwards, rather than one by one, because I do want to make sure in the next 25 minutes or so that we do hit the rest of the content here.

927
01:25:36,480 --> 01:25:38,680
And I've got about 20-ish slides left.

928
01:25:40,080 --> 01:25:44,200
So with Citrix ShareFile, very similar to Google Drive and Box.

929
01:25:44,560 --> 01:25:52,680
The interesting thing about this is that the application, to download it, you had to go through that paywall, or at least a trial registration for businesses only.

930
01:25:52,680 --> 01:25:57,220
However, I was able to use a Gmail account and they let me just get in, but there's no free version.

931
01:25:57,780 --> 01:26:05,520
Similar to Google File Stream, once you install ShareFile, it creates a virtual volume in FAT32.

932
01:26:05,820 --> 01:26:07,460
It mounts as the S drive.

933
01:26:07,900 --> 01:26:10,700
All their databases are unencrypted in SQLite format.

934
01:26:11,220 --> 01:26:17,980
So they have a list of all the remote files and folders in the remote DB.

935
01:26:18,700 --> 01:26:26,480
If you want to see all the files that, and I like how they break it out, if you want to look at all local files that are sitting there in the file system, it's localitem.db.

936
01:26:26,480 --> 01:26:30,140
So you've got two different databases, whether it's local, or they're sitting in the cloud.

937
01:26:30,140 --> 01:26:36,740
And again, these are things that maybe have never been synced with the end user system, but you can find out what they have access to.

938
01:26:37,340 --> 01:26:41,260
And then there's a Citrix files underscore, and then a date.log.

939
01:26:41,260 --> 01:26:45,780
And that gives a detailed activity of what things have synced, what files they have access to, and stuff like that.

940
01:26:45,780 --> 01:26:51,820
And then similar to Box, there's a part cache directory, where you can gain access to all those cached files.

941
01:26:54,240 --> 01:26:59,000
Okay, and don't want to go too much into, again, all the different columns and folders, but it's very similar.

942
01:26:59,000 --> 01:27:06,200
We get a lot of unique IDs, and we can map out where things are sitting, what parent directory they're in, and we even have a unique ID.

943
01:27:06,560 --> 01:27:14,020
Similar to Box and Google Drive, you have the hash as well, so you get that fingerprint of the file.

944
01:27:14,800 --> 01:27:21,520
All right, but they actually have in these remote and the local item database, they have a lot of columns in there, as far as permissions and stuff.

945
01:27:21,520 --> 01:27:26,480
I didn't have time to map out what all those permissions meant, whether they were shared, read, write, that kind of stuff.

946
01:27:26,480 --> 01:27:33,740
But you get a plethora of information, including even the file size of the different files within Citrix ShareFile.

947
01:27:35,100 --> 01:27:36,600
Local items, very similar.

948
01:27:36,600 --> 01:27:39,100
You get the hashes, URLs this time, though.

949
01:27:39,100 --> 01:27:43,480
What I thought was interesting with this one, though, is that there was a URL within the local item database.

950
01:27:43,820 --> 01:27:52,200
It gave a, what I believe to be an instance ID, .sf-api.com, and then some directories and an item ID.

951
01:27:52,200 --> 01:27:56,200
I tried to visit those with a browser, and I got nothing.

952
01:27:56,320 --> 01:28:07,040
But I do have a feeling, though, that you're able to work with their API, you could probably then, by using this, gain access to some of their files using that API.

953
01:28:08,580 --> 01:28:13,760
Okay, and then the directory entry, this really just gives us a parent structure or a structure of where things are.

954
01:28:13,880 --> 01:28:23,360
If you look at that Citrix ShareFile underscore date, and then the date.log, these are some things that I've identified as words you might want to parse out for using grep or awk.

955
01:28:23,600 --> 01:28:36,440
Upload file, file system notifier, local, win, FSP, delete item, download, upload, read callback, those are all interesting actions when I did those in my lab environment that triggered these log files.

956
01:28:37,020 --> 01:28:48,720
So similar to Box, where they had that cache directory, if we go into the part cache, you've got these long gwids or hashes, and within those directories, you're then going to see 0.part.

957
01:28:49,640 --> 01:28:56,760
Almost identical to Box, though, if you open that with a hex editor, you're able to see it's an RTF file or a .docx file, sorry.

958
01:28:57,100 --> 01:28:58,760
And you just rename the file extension.

959
01:28:58,760 --> 01:29:00,020
So 0.docx.

960
01:29:00,020 --> 01:29:03,360
And I was able to recover the entire document that way as well.

961
01:29:04,160 --> 01:29:08,440
So a couple more things before we dive back into a lab or two.

962
01:29:08,920 --> 01:29:14,340
Some other areas that you might be interested in, okay, well, maybe they didn't download the application.

963
01:29:14,340 --> 01:29:25,880
So I'm looking at a system that I've either compromised as a offensive security professional or from defensive, I am analyzing this Windows system and trying to figure out what they did or maybe exfiltrated data.

964
01:29:26,500 --> 01:29:33,480
Well, sometimes you can use, obviously, these cloud file storing solutions without installing the application.

965
01:29:33,640 --> 01:29:39,760
And so if so, there may be evidence of that happening if you go ahead and look in their history, their browsing history.

966
01:29:39,980 --> 01:29:47,160
And if we look at their browser history, we can find things like for Google Docs or Google Drive, you're going to see docs.google.com.

967
01:29:47,160 --> 01:29:54,380
And we could see whether or not they were viewing or editing spreadsheets, presentations, documents, what type of file they were editing.

968
01:29:54,380 --> 01:30:02,800
So we don't get insight to which file, the name of the file, but we will be able to see if they view or edited any types of files in Google Drive.

969
01:30:04,700 --> 01:30:07,720
If they go to the root of Google Drive, it's different.

970
01:30:07,720 --> 01:30:10,720
So if they're actually editing, it's docs.google.com.

971
01:30:10,740 --> 01:30:20,520
If they're just viewing their drive and the folders in them without viewing a specific object, it's drive.google.com slash drive slash my drive.

972
01:30:20,940 --> 01:30:32,840
You can also, if they browse to any subdirectories that are in their Google Drive, so the finance or personal folder, their browsing history, you'll see drive.google.com slash drive dash folders.

973
01:30:33,940 --> 01:30:42,940
And then if they want to, if they delete something and they look in their trash, you're going to see drive.google.com slash drive slash trash, which meant they have visited their trash can recently.

974
01:30:43,560 --> 01:30:50,660
Similarly, if they look at the root directory in Box, you're going to see app.box.com slash folder and the root directory.

975
01:30:50,660 --> 01:30:55,020
So once they log in and they just look at all their files and folders, it's zero.

976
01:30:56,160 --> 01:31:08,800
Now, if they view in personal version, though, of Box, I'm sorry, of OneDrive, if they're in OneDrive, you're going to see onedrive.live.com slash question mark ID equals root, which means they're in the root.

977
01:31:08,800 --> 01:31:11,440
And then you're also going to be able to identify their CID.

978
01:31:11,440 --> 01:31:25,340
So if they say, no, it wasn't me that logged in, someone else was on my machine, you can actually map that CID back to see how much activity they're doing on the web versus maybe when you looked at the registry keys and you saw that they had synced OneDrive locally,

979
01:31:25,340 --> 01:31:32,420
that's how you can see that that same user was logged in the browser doing stuff in OneDrive as was installed on the application.

980
01:31:33,400 --> 01:31:36,480
Dropbox will just give you the root, you'll see slash home.

981
01:31:36,480 --> 01:31:47,040
If they go to any other documents or view it with their emulator of like, okay, you can view a Word doc or a PDF or something like that, you're going to see dropbox.com slash SCL.

982
01:31:47,040 --> 01:31:50,200
And that tells you that they have viewed things within the web browser.

983
01:31:51,020 --> 01:31:56,760
And if they want to go view or they view any contents and other folders, you're just going to see dropbox.com slash home.

984
01:31:56,760 --> 01:31:58,620
And then you will see the folder name.

985
01:31:58,620 --> 01:32:03,600
So you actually get to see finance operations or whatever the folder name is that they were looking at.

986
01:32:04,640 --> 01:32:10,700
So the data that I gave you for the lab environment that we're going to go back to in just a second here, I've got two slides left.

987
01:32:11,960 --> 01:32:17,880
The way I extracted that, and it was a new way of doing it for this lab, since we're all virtual, and I didn't want to hand out large VMs.

988
01:32:18,120 --> 01:32:20,700
I used a tool called CAPE.

989
01:32:20,740 --> 01:32:24,540
And I built a target, which basically says, what do you want to extract?

990
01:32:25,280 --> 01:32:31,520
Now, I copied some of the stuff that was in the original target that I looked at where they had some things for OneDrive, and I mimicked that.

991
01:32:31,520 --> 01:32:40,140
And I built it out for Dropbox, OneDrive, Box, Citrix share file, and I can't remember which one I missed there, Google Drive.

992
01:32:40,140 --> 01:32:47,260
But all five different ones that we've talked about today, the target that I built there, I built that out to extract that.

993
01:32:47,260 --> 01:32:49,500
And it does so within about 10 seconds.

994
01:32:49,660 --> 01:32:54,000
So if you run CAPE from the command line, you can see, I lied, it was 12 seconds.

995
01:32:54,000 --> 01:33:03,040
It's going to pull up all the registry keys, and all those cached files, and anything else that is identified with one of those cloud file storage solutions.

996
01:33:03,040 --> 01:33:05,880
Now, if they have tons of data, it might be a little bit longer.

997
01:33:05,880 --> 01:33:22,300
But the point is, within 12 seconds, whether I'm on an offensive or defensive engagement , I'm able to exfiltrate, or not exfiltrate, but grab all of that useful information that shows me any type of evidence that they are using those files, and possibly even the cached files that I can recreate.

998
01:33:23,380 --> 01:33:25,360
So that brings us into the lab.

999
01:33:25,360 --> 01:33:29,520
I think the second lab that we skipped over is going to go ahead and be Google Drive.

1000
01:33:29,520 --> 01:33:34,240
If you've got to take off, I know it's, you know, I'm here in Los Angeles, it's already 5pm.

1001
01:33:34,240 --> 01:33:38,640
But if you're on the East Coast, it's probably a bit later, or maybe somewhere else around the world.

1002
01:33:38,700 --> 01:33:45,460
I encourage you to connect with me on Twitter, and LinkedIn, that's the best way to get a hold of me, and chat in the future.

1003
01:33:45,660 --> 01:33:54,960
For those of you who are staying around for the next 20 minutes or so, we're going to go ahead, I'll give you about 10 minutes to try the Google Drive lab.

1004
01:33:55,200 --> 01:33:59,340
And after you try the Google Drive lab, then I'll do a quick walkthrough.

1005
01:33:59,360 --> 01:34:03,600
So on my screen here, I'm just going to pull up the ones you see which one we're looking at.

1006
01:34:05,160 --> 01:34:11,480
So it's going to be examining cloud file storage incidents lab, Google Drive, again, just like the other one, you've got the lab instructions.

1007
01:34:11,640 --> 01:34:15,280
And then if you scroll all the way down, you'll be able to see the detailed walkthrough.

1008
01:34:27,430 --> 01:34:30,850
Okay, I'll go ahead and do the walkthrough here.

1009
01:34:31,750 --> 01:34:35,750
So the first instruction says to run DB browser for SQLite.

1010
01:34:35,750 --> 01:34:42,490
And it's located, in this case, it says C program, DB browser SQLite, but we've got to install that.

1011
01:34:42,490 --> 01:34:50,830
So let me go down to my installs and get that going.

1012
01:35:02,910 --> 01:35:15,230
Okay, and then once this loads here and finishes up, we're going to browse to Google Drive, or it's in AppData, local Google Drive, and then user default.

1013
01:35:15,390 --> 01:35:17,690
And we're looking for the sync config database.

1014
01:35:17,690 --> 01:35:21,190
Okay, so I'm going to just run DB browser for SQLite.

1015
01:35:24,420 --> 01:35:26,020
Pin this.

1016
01:35:26,820 --> 01:35:27,700
Perfect.

1017
01:35:27,700 --> 01:35:34,520
Okay, so we're open database.

1018
01:35:34,520 --> 01:35:43,300
I'm going to go to my downloads, evidence, and C drive, users.

1019
01:35:43,720 --> 01:35:45,440
Oops, sorry.

1020
01:35:45,740 --> 01:35:49,000
Windows, system 32.

1021
01:35:49,660 --> 01:35:51,040
No, I am all messed up here.

1022
01:35:51,040 --> 01:35:51,900
I apologize.

1023
01:35:51,900 --> 01:36:03,260
C, users, Bob, AppData, local, Google, Drive, user defaults.

1024
01:36:03,260 --> 01:36:06,020
And then within here, that's where I'm looking for the sync config.

1025
01:36:06,240 --> 01:36:12,280
So I've got that database, I open it up and expand this out a little bit.

1026
01:36:15,070 --> 01:36:22,570
Okay, and then we go down the instructions here, we're going to look for, click on the browse data tab.

1027
01:36:22,590 --> 01:36:28,890
So if we click over here, browse data, we get a better view of everything that's going on.

1028
01:36:29,290 --> 01:36:30,770
Expand this out a little bit.

1029
01:36:35,080 --> 01:36:35,780
Okay.

1030
01:36:36,400 --> 01:36:39,980
And so the first question is, what is the data value for the following?

1031
01:36:39,980 --> 01:36:44,540
So we're looking for the highest application version, local sync route path and user email.

1032
01:36:44,620 --> 01:36:50,660
So we can see here, this is the version of Google Drive that was installed on the machine that we're looking at.

1033
01:36:50,660 --> 01:36:56,420
So again, we can look for vulnerabilities, we can match it up to the system, whatever the use case is.

1034
01:36:56,540 --> 01:36:58,760
And then local sync route path.

1035
01:37:05,260 --> 01:37:07,420
Oops, I messed that up.

1036
01:37:07,420 --> 01:37:11,280
Local sync route path, here we see it is cusers, Bob, Google Drive.

1037
01:37:11,280 --> 01:37:15,680
And then for email, we see it's bob.mckley.re.gmail.com.

1038
01:37:15,680 --> 01:37:18,140
It's the same one that the HR had in their file.

1039
01:37:18,800 --> 01:37:22,900
Step two is we're going to browse to Cloud Graph.

1040
01:37:22,900 --> 01:37:34,220
So I'm going to go open a new database and within Drive, it's user defaults, Cloud Graph, cloudgraph.db.

1041
01:37:35,800 --> 01:37:37,960
And I don't want to save changes.

1042
01:37:40,060 --> 01:37:43,840
Now on this one, I'm going to have to change the table here.

1043
01:37:43,840 --> 01:37:46,780
And so it tells me to go to the Cloud Graph entry table.

1044
01:37:46,880 --> 01:37:48,960
So click on that one.

1045
01:37:48,960 --> 01:37:54,620
And then from here, we want to know what's the file name for doc type six.

1046
01:37:54,620 --> 01:37:59,260
So I'm looking for doc type six here, I see one that's this one.

1047
01:37:59,260 --> 01:38:03,000
So it's a remember from, what was it, three to 12 or 13.

1048
01:38:03,000 --> 01:38:05,000
Those are Google formatted documents.

1049
01:38:05,600 --> 01:38:09,320
And I'm gonna expand this file name to see what this file was called.

1050
01:38:10,840 --> 01:38:13,140
Ways to tell your boss you're leaving.

1051
01:38:13,380 --> 01:38:16,260
That sounds suspicious, something you might want to look into a little bit more.

1052
01:38:17,940 --> 01:38:21,180
Okay, and then let me look down for

1053
01:38:26,600 --> 01:38:27,320
here.

1054
01:38:28,380 --> 01:38:32,180
And then we want to look at what type that was.

1055
01:38:32,180 --> 01:38:35,580
Obviously, we can go back to the slides and see that that was a Google formatted doc.

1056
01:38:36,740 --> 01:38:42,880
And we want to look at the modified date for a file of where the file type was six.

1057
01:38:43,060 --> 01:38:50,040
So I can scroll over modified date, right this date, though, we're gonna want to copy this.

1058
01:38:50,760 --> 01:38:54,420
And let me go ahead and do this.

1059
01:38:54,600 --> 01:38:56,660
I'm just going to open up Google here.

1060
01:39:03,440 --> 01:39:06,940
And I convert this, we could see the exact time.

1061
01:39:08,400 --> 01:39:11,680
I'm going to paste in the time that we got.

1062
01:39:12,480 --> 01:39:17,620
And it's going to tell us both are my local time as well as UTC or GMT.

1063
01:39:18,260 --> 01:39:23,680
If we're looking at GMT, it was Friday, April 17 2020 601 25am.

1064
01:39:24,040 --> 01:39:26,860
And that's something that we're going to want to go ahead and look at.

1065
01:39:26,860 --> 01:39:32,120
And so even if we look at local time, though, for me, it was at 1101pm.

1066
01:39:32,200 --> 01:39:37,680
So if this is a work machine, why are they the file name was tell your how to tell your boss you're leaving.

1067
01:39:37,680 --> 01:39:44,880
And I believe this was the night before I believe on the 17th the morning of Bob McClee put in notice.

1068
01:39:44,880 --> 01:39:48,200
So at 11pm was looking for ways to find bosses leaving.

1069
01:39:50,540 --> 01:40:01,510
Okay, then we've got on the scroll down my tutorials.

1070
01:40:07,470 --> 01:40:08,730
Catch up.

1071
01:40:08,730 --> 01:40:09,210
Okay.

1072
01:40:09,210 --> 01:40:13,930
And then after we converted that our next step or question is further examine the file.

1073
01:40:15,130 --> 01:40:24,770
examination of file name column and database uncovers additional documents of interest, for example, Doc ID one, or one MP, blah, blah, blah.

1074
01:40:25,170 --> 01:40:27,170
One was the document last modified.

1075
01:40:27,170 --> 01:40:33,050
So I'm looking over here, there's one that we want to look at one MP.

1076
01:40:33,050 --> 01:40:34,650
So I'm looking here one and

1077
01:40:39,080 --> 01:40:40,020
this one here.

1078
01:40:40,060 --> 01:40:43,860
And it says resignation letter ready dot RTF.

1079
01:40:43,860 --> 01:40:48,880
And so we want to look here at the modified time and copy this again.

1080
01:40:49,880 --> 01:40:52,880
I'm going to go back over to Google.

1081
01:40:54,820 --> 01:41:03,880
pop this in convert and it looks like Friday, April 17 617 am.

1082
01:41:03,920 --> 01:41:06,840
So oops, something scrolling way down.

1083
01:41:07,040 --> 01:41:17,320
So it looks like the morning of right putting resignation around maybe eight or 9am when everyone came in the morning of on the work machine, this this document was modified.

1084
01:41:17,860 --> 01:41:19,980
Or at least Yeah, last modified.

1085
01:41:19,980 --> 01:41:21,320
So we don't know what it originally had.

1086
01:41:21,320 --> 01:41:22,940
But obviously, it says it's ready to go.

1087
01:41:22,940 --> 01:41:27,080
And we saw the resignation letter come in on the 17th in the morning.

1088
01:41:28,500 --> 01:41:29,940
Go back.

1089
01:41:32,000 --> 01:41:36,900
Next step is to what is the hash for the file file name client list.

1090
01:41:36,900 --> 01:41:46,420
So if we look for the file here called client list in row 12 can scroll over and now we get the file hash here.

1091
01:41:46,420 --> 01:41:49,280
And this might be important because we may see changes along the way.

1092
01:41:49,280 --> 01:41:52,400
Maybe we look at the cached version and it's different than this.

1093
01:41:52,800 --> 01:41:58,800
And maybe we want to verify this, this is the client list that he stole or that we have in our file server.

1094
01:41:58,800 --> 01:42:00,580
So we might want to copy that hash down.

1095
01:42:03,140 --> 01:42:06,500
Okay, next piece is that we are going to open up the sync log.

1096
01:42:06,500 --> 01:42:11,420
So I'll minimize this, we'll go over here.

1097
01:42:11,840 --> 01:42:33,080
And go to my downloads, go to the evidence we've collected, click in there, see, and users, Bob, app data, local, Google, drive, and then user default.

1098
01:42:33,420 --> 01:42:39,380
And then within here, we should see the we're looking for sync log.

1099
01:42:40,420 --> 01:42:47,900
This one open up and expand that a little bigger for you.

1100
01:42:48,380 --> 01:42:54,180
And within here, again, ideally, you do something like Sumo logic or some other tool to parse this out.

1101
01:42:54,220 --> 01:42:58,180
We want to look at where did the file originate from.

1102
01:42:58,580 --> 01:43:03,380
And, and we're looking for specific things like resignation letter.

1103
01:43:03,380 --> 01:43:06,100
So I want to see when things were synced and changed here.

1104
01:43:06,100 --> 01:43:20,360
So let me do a search and find and I'm going to search for resignation letter.

1105
01:43:23,700 --> 01:43:30,480
Okay, and then here, we see that close this out.

1106
01:43:31,540 --> 01:43:39,300
Right, so we get the date and the time all the way on the far left there was the 16 2235, at least local time.

1107
01:43:40,620 --> 01:43:44,680
Over here, we see receive change directions upload.

1108
01:43:44,680 --> 01:43:49,920
So the user on this system that the work machine, the file was changed.

1109
01:43:49,920 --> 01:43:57,940
And then this, the changes were synced or uploaded to the cloud and matches the file name.

1110
01:43:57,940 --> 01:44:01,640
And look at this resignation draft, we saw resignation letter ready.

1111
01:44:01,640 --> 01:44:04,280
So this might have been changed around that time.

1112
01:44:04,280 --> 01:44:07,460
Originally, it was in draft format, and the user changed that.

1113
01:44:09,860 --> 01:44:12,940
And sometimes we also get hashes here as well.

1114
01:44:12,980 --> 01:44:14,700
Okay, but it was a local system.

1115
01:44:14,940 --> 01:44:19,360
So it was the direction was upload, they made that change locally, it got synced up.

1116
01:44:20,500 --> 01:44:29,540
Next question is, we want to find all for all instances of this.

1117
01:44:29,540 --> 01:44:31,500
And again, some other parsing tools better.

1118
01:44:31,500 --> 01:44:41,280
But if I go here to search, and I type find again, and I do find all in open document, this is going to give us a list.

1119
01:44:41,280 --> 01:44:43,420
And I don't know how to make this bigger for you.

1120
01:44:44,260 --> 01:44:51,580
But we can see here all the different times that resignation letter was was in here.

1121
01:44:51,580 --> 01:45:05,960
But basically, what I would do in a much better way with some other tools, I'm looking here for the name resignation letter draft, draft, draft, draft, and I want to kind of find down here where it's changed from draft.

1122
01:45:05,960 --> 01:45:09,440
So I see ready down here, I don't want to spend all the time doing this.

1123
01:45:09,440 --> 01:45:14,700
But I'm going to look for the line item where it says draft, and then the next one says ready.

1124
01:45:14,700 --> 01:45:19,660
And that's going to tell us when that change was made, where they renamed the file, and now it's ready.

1125
01:45:21,100 --> 01:45:22,460
Okay, and then

1126
01:45:25,520 --> 01:45:28,400
next step, we go back to SQL Lite.

1127
01:45:28,620 --> 01:45:32,400
And we look for an inode ID for an office lease.

1128
01:45:32,520 --> 01:45:34,600
I know we're pretty much out of time there.

1129
01:45:34,600 --> 01:45:38,220
So I know all the other steps are in the detailed walkthrough.

1130
01:45:38,220 --> 01:45:43,720
If you want any of that, I did want to give a couple of minutes for questions before I've got to leave and be respectful of everyone's time.

1131
01:45:43,720 --> 01:45:49,420
So again, there's a couple more steps to that lab, but you can look through those we didn't get to the box lab.

1132
01:45:49,920 --> 01:45:54,400
But you can absolutely go through those and hit me up on LinkedIn if you have any questions around that.

1133
01:45:54,400 --> 01:45:57,860
So I'm going to switch back to my slides and see one more time.

1134
01:45:57,860 --> 01:46:12,460
If there's any questions, I also want to give a big shout out and thanks to all the people at the cloud village, the ones that you heard vocally, but then there's tons of people on the back end who have made this possible and obviously for free.

1135
01:46:12,460 --> 01:46:15,000
So big thanks to them and thank you for having me here.