start	end	text
0	6300	I'm putting it in the GitHub repo there. I've got the lab files, I've got the software you need,
6300	9260	and I do want to explain this because I know people are already clicking and cloning and
9260	14540	stuff like that. What you're going to need, there's three components to the labs that we're
14540	20400	going to do. One, you're going to need some software. I did it this way because with the
20400	26880	work from home and COVID-19 stuff, I've done at least 20 workshops in the last couple of months,
26880	31080	and I've started realizing that people's home internet isn't always reliable and stuff like
31080	35540	that. So the attempt with this, and I've had a couple people say they didn't like it, but I
35540	40140	think it saves a lot of us who didn't get a chance to download a 20 gig VM before the workshop,
40140	47260	is that rather than doing a virtual machine for you, what you have here is four pieces of software
47260	51860	you need that run off of Windows. So obviously you can get a VM if you want and install those,
51860	56440	but any Windows 10 machine should work. You need the database browser for SQLite,
56440	61740	Notepad++. Obviously you could use Atom or anything else, but that's the one I recommend.
61740	67600	You need a hex editor such as HXD hex editor, and then you do need Registry Explorer. The one
67600	74660	I'm using in the lab is version 1.5.2 or 20. And then there's three labs we're going to work on.
74660	79260	I don't know if we'll get through all of them or not, but I've got the workthroughs and actually
79260	85400	the answers. So if we only get through one or two of those labs, you've got everything you need.
85400	92220	The third component that's not on the screen here is that what I did is I had a virtual machine with
93120	100360	everything throughout the scenario that we're going to talk about. And with that, I then used
100360	106440	Cape to extract the key artifacts that we're going to look for throughout the workshop. And so rather
106440	110780	than getting a whole virtual machine with a couple of interesting things I wanted you to look at,
110780	116320	I just extracted those interesting things. So there's a zip file that's called... let's see if
116320	125280	I can find it on my screen here. It is evidence and then it's a dash, desktop dash, and some
125280	130960	random numbers dot zip. That will need a password of infected all lowercase. I recommend you not
130960	135900	use Windows Explorer to extract it. It generally has issues realizing that it's encrypted or has
135940	141760	a password. Don't worry, there is no malware. I just wanted to password protect it and I knew I'd
141760	146920	forget what it was called. So all my workshops I just use infected as the password. What you're
146920	152020	going to have in there is those key artifacts from a Windows 10 machine where an incident happened
152020	158180	and we'll kind of walk through that scenario and what that looked like. Okay, so I'll move on here.
158820	163580	My name is Michael Wiley, Director of Cybersecurity Services at Richie Mae Technology Solutions. I'm
163580	169960	an avid certification collector. It's just one after another. I love to learn. I've been in
169960	174300	the industry for a while and the more I learn, the more I realize I don't know and I need to
175060	181100	expand my knowledge. So some people ask why I've got certifications in such different areas. For
181100	187200	example, I've got some pen testing certs. Then I also have some architecture and design certifications,
187200	193040	your CCNAs, and then I also have a Windows Forensics certification. But I think that all
193040	198080	those complement my day-to-day job. And the more I learn about other fields, I realize how that can
198080	203060	help me in the tasks I do, even if I'm not a forensic examinator per se. I'm not for law
203060	207500	enforcement or anything like that. I've got my LinkedIn and Twitter information on the bottom
207500	211820	corner there. Please connect. That's probably the best way to get ahold of me after this.
212160	218220	I respond quicker, even quicker than email if you connect with me on LinkedIn. I also post a lot of
218220	224240	things I find relevant or interesting about the industry. Prior to my joining Richie Mae
224240	229100	Technology Solutions, I owned a boutique cyber security firm in Los Angeles. That's where I
229100	233500	really grew a lot of my security skills. Even though I'm a director now, I'm very hands-on,
233500	238220	and I think you'll see that a lot of my workshops and slides are quite technical in my opinion.
238760	243060	I get bored with paperwork, even though I have to do a lot of policy and procedure work these days.
243060	248660	I still like doing pen tests. I'm a recovering red teamer. I still like doing forensic
248660	255720	examinations. It's how I wake up in the morning, if you will. That's it about me. Let's get on to
256200	262140	a little bit about the company I work for. I did have my firm for a long time, and once I had a
262140	266980	kid, I realized I wanted to not work as many hundred-hour weeks, and I wanted to spend a
266980	271960	little more time with the family. So my firm merged with Richie Mae to form Richie Mae Technology
271960	277180	Solutions. We do a lot of cloud workflow integrations. I work with, specifically since
277180	281360	I'm near Hollywood, I work with a lot of the studios and the vendors that make the movies you
281360	286560	used to watch at AMC, and now you watch at home or on streaming platforms. So I do a lot of content
286560	291840	protection and workflow and stuff like that. I used to be one of 20, now I'm one of 40 worldwide
291840	298760	that can do security assessments on behalf of the major studios that make films. So the learning
298760	303600	objectives for this workshop, we're going to learn what file artifacts are available in cloud
303600	307700	solutions, cloud file storage solutions. We're going to see what kind of cloud file storage
307700	313240	user activities can be enumerated. We'll be introduced to application log capabilities,
313240	318920	examine the difference between providers, and so on and so forth. Now, one thing I do want to...
318920	323640	I want to give recognition where recognition is due. I worked in Instant the first time I started
323640	327500	getting into some of these cloud file storage solutions and trying to dig a little bit deeper
327500	336120	was I was working a case, I don't know, three years ago-ish. And it was a company where the COO
336120	341020	was a relative to the CEO. And that person left the company and there was suspicion that they
341020	347420	poached a lot of the clients. And they asked us to do a forensic examination on the hard drive and
347420	352500	figure out if information was sent, stolen. There was just a lot of odd behaviors about how that
352500	358080	person left the company. And so one of the things I found there was a cloud file storage solution,
358080	363640	and we were able to identify what files were uploaded, synced, things like that. And this
363640	367860	cloud file storage solution was not sanctioned by the company. So this was a personal account that
367860	373300	was installed on the Windows machine and was used to exfiltrate data, essentially. And so I got into
373300	378100	it in that forensic examination, and I got curious, did a little more research, and then I ended up
378100	381740	taking a SANS course as well. And they had a section on that that filled in a lot of the
381740	386640	gaps of my research that was missing. So, you know, there's a lot of people and their research
386640	390900	involved. So I do want to put their names on the screen and recognize them, including SANS Institute
391400	395780	and a lot of people that had research on sections of these tools, because there's a lot of
395780	402760	information throughout here, and they've helped fill in a lot of the gaps for me. So cloud file
402760	406100	storage overviews, you know, what exactly we're talking about when I say cloud file storage
406100	412020	solutions? Well, we're talking about your boxes, Dropbox, OneDrive, Amazon Drive, Google Drive,
412020	416600	ShareFile, iCloud, those kind of things when I talk about a cloud file storage solution.
416820	420680	Now, the reason they're becoming so popular is that there's this perceived benefit that you get
420680	425380	when you switch to one of these, reuse one of these over, let's say, a file sharing, an on-premise
425380	431280	file share. You get protections against disasters, and these are perceived because obviously everyone's
431280	436920	had their outage, but these providers can do a lot better job than system administrators, in my
436920	442420	opinion, from every organization to keep their data available. So when there's a pandemic, and everyone's
442420	446700	got to work from home, you know, overnight, essentially, you still have access to those files.
447120	452260	Disperse teams, they can have access to these files, rather than having a VPN in. You've got
452260	456180	decrease in maintenance, so system admins don't have to update the underlying operating system,
456180	461260	they don't have to patch Adobe, they don't have to do all that maintenance on the file share.
461280	467120	If anyone's ever worked with DFS, I mean, that's why cloud file storage solutions are
467120	471900	becoming more popular, in my opinion. They've got that high availability, they're scalable. So rather
471900	478340	than adding hard drives to RAID, or adding more servers to a cluster, you just literally say,
478340	482720	Google, here's an extra 10 bucks a month, now give me an extra terabyte. So it's very easy to
483280	488820	scale that. You've got ease of management. So you've just got GUIs and web interfaces, you can
488820	495000	provision new users through web portals, as well as single sign on, etc. It's very easy for user
495640	499780	management. And then we may see two different solutions that I'll kind of talk about a little
499780	505020	bit later. And one is that you may have a business authorized or business sanctioned cloud file
505020	510100	storing solution. So maybe it's an enterprise Office 365 account, and they give you OneDrive,
510100	515260	or you have a business version of Dropbox. But then we also run into scenarios where I often
515260	520920	see these different providers out there on Windows machines, or even Mac machines, where they
520920	524240	were not sanctioned by the company. And maybe someone thought they were doing the company a
524240	528920	favor because they had to move files from one machine to another. I vividly remember coming
528920	536180	in trying to help architect a more secure solution for a plastic surgery firm in Beverly Hills.
536180	541260	And the company ended up, they only had a couple people, but they were doing plastic surgery on
541260	547180	famous people. And they wanted to have isolated air gap networks. And I thought, great. And they
547180	550220	said, so this is kind of what we did. We want a better solution because we've got one computer
550220	554840	here for internet access. And then we have another computer over here and that has medical files.
554840	558560	And everyone's got two computers and they're swiveling back and forth. We call it swivel net.
558920	562240	So you do one job or another, so there's got to be a better way. And I was like, well,
562240	567240	this actually sounds fairly secure, but let me look into it. And as I dug into it, I realized,
567240	571700	yes, they were two different computers, but they had personal Dropbox accounts on both computers
571700	575840	and they were syncing the files back and forth because they needed to, obviously they downloaded
575840	580380	stuff from, let's say an EMR and they needed to move it into the, I don't want to say production
580380	585540	network, but the medical network. And there was that bridge that was gap there. And so that was
585540	590260	not a commercial version. That was a Gmail or Yahoo or an AOL account that the employees set up
590260	595400	because they thought they were making their job more efficient, but there was no control over that.
595400	600100	So this came from Spiceworks. I apologize. I don't have the source there. I'll try and post
600100	605800	that later on. But it's a Spiceworks study. You can Google it. Cloud file storage solutions,
605800	609640	Spiceworks, market research, and you'll find this. But I tried to extrapolate some of the
609640	614520	interesting things that I saw here, obviously from a couple of perspectives. One, so you know
614520	618000	what's more prevalent, but two, depending on which side of the fence you are on, if you're
618000	622800	offensive security, you can see what you're most likely to see, right? And obviously Microsoft
622800	628180	OneDrive, they've baked that into Windows 10 and they make it very easy for you to use OneDrive.
628240	634440	And so we're seeing that organizations more and more are using OneDrive solutions, right? Followed
634440	638160	by Google Drive. I believe that's because of G Suite and that's kind of bundled in there. And
638160	643080	then Dropbox is the largest independent source that you may see out there in the enterprise.
643280	647780	And then followed by Box has a very small market share, except for large enterprises.
647840	651600	We see a lot of that within different studios and post-production houses.
651600	655260	They've done some work with the MPA and I think that's why we see that.
655660	661060	And then Citrix ShareFile, not very popular, but I see a lot in the financial sector. So Richie
661060	665080	May really focuses on two verticals. We're in the media entertainment space and we're in the
665080	670260	financial space. We've got clients in all different industries, but those are really our niches.
670320	674900	And so I see a lot of Citrix ShareFile. I thought it was going to be more than whatever it says
674900	680340	there, about five to 10%. But since I see it so much, I have the research and I included it in
680340	684780	this workshop. So here's the two different scenarios you might run across. You may see that
684780	689240	on the left side there of my screen, I've got that corporate environment. Maybe they've got
689860	695640	CASB solution involved. There's a firewall. It's a sanctioned cloud file storage solution there.
695640	699740	On the right hand side there, we've got some that they may even still have that sanctioned cloud
699740	705200	file storage solution like OneDrive, but then the end user may use their personal G drive or
706080	711380	Dropbox account because they wanted to get the certain data on and off of that computer system.
711380	716980	And USB drives are just not as popular these days. So you may see that that bypasses CASB
716980	722520	solutions. A lot of the CASB solutions I've looked at are limited as far as they're not in line. And
722520	728220	so there's certain instances where you may install or use these cloud file storage solutions, whether
728220	732600	it's you install the agent or you go through the web browser and that expensive CASB solution that
732600	738880	you've got as your one of your layers of security may not even see that data leave or come in and
738880	744060	out of the network. Okay, so what kind of gems are we talking about here that we might be able to see?
744200	748760	If we're again, I'm trying to phrase this as two different sides. You've got this workshop I think
748760	753200	can go well for incident responders and forensic people. They can see what artifacts are left
753200	758280	behind. But I also think that as offensive security, there's also something you can gain
758280	764200	here and seeing that looking at this post exploitation, seeing what kind of data
764200	770140	might be stored and what things you can extrapolate from these agents or artifacts left behind, you
770140	774060	may be able to get a lot of interesting things during a pen test or red team engagement.
774360	778660	So many organizations are now using these tools as a file server replacement. So you might find
778660	785420	customer data, financials, employee data, whatever you'd see on a file share, you may see
785420	791440	there. I mean, all kinds of confidential stuff. The apps, if they install the application,
791440	796500	whether it's business sanctioned, or a personal install of the desired application, you might see
796500	802260	cached files. So whether that file exists still in the file system, maybe they downloaded something
802260	807340	and deleted it, that cached copy because it was opened up may still be there may be remnants there
807340	812420	that you can now pull out. So someone downloaded customer data, they realized they shouldn't have
812420	816160	it, they go ahead and delete it, that cache copy still there. And if you're on a pen test, you can
816160	821680	just go grab that cache copy and recreate all the data. You might see local files, even for cloud
821680	825820	files, most of the cloud file storage solutions we're going to look at, even though you don't see
825820	832540	the you're not going to touch the cloud files, you know, maybe they've disconnected or they
832540	837920	are not syncing anymore, we still can look at the databases and we can see all the files they
837920	842400	have access to in the cloud, even if it's not on the local file system. So we might not be
842400	847120	able to get those files, but now we know they're sitting there. We can get usage of different files,
847120	851020	we can say, wow, they're really, you know, there's a lot of work going into this one file, this
851020	855340	customer file, this might be something I want to look at. You may also get to be able to see traces
855340	860100	of deleted files. So even if they do delete it and maybe we'll see it in the cache, maybe we won't,
860100	865120	but even if they didn't open it up on the local file system, we may be able to get remnants of
865120	871260	that file. So I would kind of went over this already, it's either going to be company issued
871260	877820	or you might have a free account. Depending on which side you're on, again, defense or offense,
877820	881700	if you're on the defense and you're trying to find some of this stuff from incident response
881700	885620	perspective or forensics, you might look at this and say, well, if it's a free account,
885620	889820	we don't get access to the logs. But if it's a business account, we might actually get access to
890580	894780	some more advanced logging. But again, it's depending on where you sit, your background
894780	899860	and how you're going to use this. With the business or enterprise accounts, you know,
899860	904880	for Google, you've got G Suite. For Microsoft, you have Office 365. For Box, it's called Box
904880	910660	for Business or Box Enterprise. And then Dropbox, they call it Dropbox Pro. On the free side,
910660	916660	you can actually get some decent size storage there. For Google Drive, you can get free 15 gigs.
916660	921280	Can you imagine the amount of stuff that people can exfiltrate from your environment with 15 gigs?
921280	927360	With OneDrive Basic, you only get five gigs. Dropbox is the smallest, two gigs. And then
928300	932200	Box Starter, it's 100 gigs. The reason I don't have Citrix share file on here is that
932800	936760	it's only trial. There is no free version. It's an enterprise grade tool.
937620	943540	It's behind a paywall or trial wall that you have to go and get that. So you can use it obviously
943540	948180	for a while, but it's not something I'm generally going to see as an unauthorized or free version,
948180	954700	just because it's on the enterprise side. Okay, so let's now dive into Microsoft OneDrive.
956300	963080	So a little bit about it. It's baked into Windows 8 and plus. Windows 10, it's built into it. It's
963080	969040	almost like a virus, right? It's there. However, it's sitting there, but a lot of the artifacts
969040	973620	and directories, registry keys are not there until you actually authenticate. So once you
974120	978880	authenticate, it then becomes enabled and directories such as the AppData, local Microsoft
978880	984200	OneDrive directory is then created. So obviously, if that folder is not there, you can assume that
984200	990740	they have not been using OneDrive on that system. There's a lot of differences between the personal
990740	997680	and the paid version of OneDrive. So for example, the personal OneDrive log files, you're going to
997680	1002620	see them within AppData, local Microsoft OneDrive logs. And then if it's a personal account, you'll
1002620	1010600	see personal directory. If it is a business Office 365 account, you're going to see business one
1010600	1014680	is the first account that's synced. And if you sync more accounts, you'll see business two,
1014680	1022280	business three, business four, and so on. Now, from my research, there's no logging on the
1022280	1027660	web side of it for personal accounts. However, with business, you have Office 365 unified audit
1027660	1032400	logs that provide a lot more information. And by default, those are set at 90 days.
1032440	1037740	From an incident that my team is working on currently with a massive breach, I can tell you
1037740	1043060	that 90 days is probably not long enough. So there is some stuff there, but it does get rolled over
1043060	1050400	pretty quickly. Okay. And if you look at the logging capabilities, obviously on the right-hand
1050400	1054960	side, you've got the business version there with the unified audit logs. But the personal version,
1054960	1060180	you're probably, if you want to start looking at behavior or what's happened on that endpoint,
1060180	1065540	you're going to have to look at more of the logs that are stored locally on the file system.
1066340	1073100	Okay, so this grid here is really meant just to show the different locations and what those
1073100	1080220	locations are, whether it's a file or a directory. For example, OneDrive, if you see a OneDrive
1080220	1084540	directory, it's a personal, that's where all their personal files are stored. If you see OneDrive dash
1084540	1089000	the company name, that's going to tell you two things. One, the company name, and they're using
1089000	1093860	Office 365. So you know immediately there's more logging capability, probably up to 90 days
1093860	1099920	somewhere on the cloud. Then there's other things like the root, or we've already talked about the
1099920	1104660	root log directories and how it's either personal or business one. There's an interesting file
1104660	1110020	called SyncDiagnostics.log, and that provides you with metadata for both local and cloud files. So
1110020	1114640	even if they've decided not to sync, or they have yet to sync a file from the cloud, you get access
1114640	1118800	to the name of that file in the SyncDiagnostics log, potentially, and we'll talk about that in
1118840	1125360	a second. There's a .dat file, and so the way it's going to work is if whether it's a personal
1125360	1131100	or business account, it's going to be their CID. So the customer ID number .dat, and so that's
1131100	1136260	going to differ for every system you look at. So one thing there, you get their CID number, or CID
1136260	1141340	string, and once you go into that, you're going to see a list of all the local and cloud files.
1141780	1148160	If you look at the CID.ini file, you're going to see the file store locations, the last sync time,
1148160	1154360	usage details of how they're using OneDrive, and if you look at the CID-profile-service-response.txt
1154360	1160340	file, that's going to give you only for a personal account. For business accounts, it does not exist
1160340	1165520	for my testing, but for personal accounts, it'll get you the name, email address, CID, email,
1165520	1169660	I guess I have email twice there, phone number, title, department, that kind of stuff. I think
1169660	1174260	it's interesting though, because what personal user, or if you sign up for OneDrive, it doesn't
1174260	1178840	ask for that information, like your phone number or your business title. However, that's listed
1178840	1184240	there. So I didn't even see a location when I went to OneDrive.com to go to my profile and actually
1184240	1188460	add a title and department and stuff, which is most of the time why you're going to see those
1188460	1194500	fields as null if you look at that text file. Then there's also an obfuscation string map text file.
1195160	1201800	That one's a little bit interesting, and I'll kind of show you how that works a little bit later. I
1201800	1207060	types of those sync diagnostic log files, and I haven't done extensive testing on this. However,
1207060	1214140	I do have a theory based off my limited testing. So during my testing, I had Office 365 OneDrive,
1214140	1218860	and I had... so it's a business version, right? And I didn't want to go buy 10 different versions
1218860	1223820	to test this, but I got what I'm going to call the summary version of the sync diagnostics file.
1223820	1228880	And I'll show you the two versions. Now, when I set up a free personal account, and I had two
1228880	1234300	virtual machines in my lab environment, the first virtual machine got what I'm calling the detailed
1234300	1241260	sync diagnostics file. It was much more verbose. Then I synced a second virtual machine to basically
1241260	1245680	see how that would work, and I opened up the sync diagnostic file on the second VM, and I got what
1245680	1252100	I'm calling the summary version. So my theory is that it's possibly the first machine you sync
1252100	1257900	with OneDrive, it gets the detailed version, and everyone after that, like the secondary machines
1258840	1265360	within the sync cluster, if you will, those get the detailed version. It's more of statistical data.
1266000	1271200	So let's look at the two different versions. So with the detailed sync diagnostics log file,
1271200	1276880	I can see things here like files and folders that are added. And the weird part, though,
1276880	1282420	is you'll see mount point followed by what looks like a GWID, or a CID followed by some kind of
1282420	1288160	unique character. And then it'll have a backslash, and then it'll have three words like far, jump,
1288160	1296280	sue, sea, bat, egg, car, reg, tax, rat, tad, up. So there are three words grouped together.
1296680	1300020	And when I first looked at that, I thought, what the heck is this? Obviously, there's some kind of
1300020	1304740	pattern going on, you know, three different words in the capitalization, but where is this coming
1304740	1310960	from? I don't have any files called far, jump, saw, or sue, or sea, bat, egg. That's not a folder
1311520	1317360	that I added. I'll show you how that works in a second, but we'll come back to that. On the right
1317360	1321520	hand side there, I've got the summary diagnostics file, which is the other version where you get
1321520	1327800	more of stuff like this, where you get sync progress, you get the last sync time in Unix
1327800	1334640	epoch, you get the number of files uploaded, downloaded, files, folders created, you get
1334640	1340080	basically more of summary type data. Now, going back to that detailed version, what I eventually
1340080	1347420	figured out is that those names, those three word names like sea, bat, egg, or far, jump, sue,
1347420	1353520	those things map back to the obfuscation string map. So I don't really have a knowledge of why
1353520	1357580	Microsoft did this, but I do find it interesting that if you go to the sync diagnostics,
1357580	1364340	you're not going to see the actual file names, you're seeing those obfuscated strings. It's not
1364340	1369900	terribly difficult to de-obfuscate them, it's just time consuming. And I'm sure someone's written a
1369900	1375580	parser for this, but you have to open up that string obfuscation map text file, and there you
1376280	1380960	can then map back those files. And we can see on the left side, I have sea, bat, egg, which is
1380960	1385800	equivalent to my desktop. So basically, the sync diagnostics folder is saying that my desktop was
1385800	1391920	synced. That folder was added to the sync. Okay, and here's just, again, another example,
1391960	1397160	a little bit bigger, where you could see that those different names, like joke, yak, log,
1397160	1405040	equates to my C directory. Or coy, you, quill, that's going to be myly, which is probably my
1405040	1412560	user's directory. Okay, the CID.dat file, it's a little hard to read. If you open it up in the
1412560	1417800	editor, you will kind of see the file names. However, searching, I wasn't able to do this.
1417800	1422400	And I do think it's because, obviously, those dots that are between each character, and I'm
1422400	1427320	pretty sure there's a way to search more human readable. But when I search for travel, or
1427320	1433800	itinerary, or PDF, it was not found because of those dots. So you can parse through that manually,
1433800	1438100	but a better version is probably, or a better way to do that is probably using something like
1438100	1446560	strings, or B strings. So here I use strings against that CID.dat file on the personal version.
1446560	1450740	And I was able to extract things there that are human readable, like documents, personal,
1450740	1457520	vault, pictures, camera roll. Those other things up there, as far as like E94, 23, blah, blah, blah,
1457520	1462760	explanation point, explanation point 104, I don't know what those are. And they come back to haunt
1462760	1467520	us in the business version as well. I'm not sure if those are like the CID, and then some
1468100	1473960	inode ID. I'm still doing some research into that piece. Now on the business version, though, if we
1473960	1481240	look at the CID.dat file, it's not as easy. We don't see as clear things, even if we pull it out
1481240	1485120	in strings. However, when I started looking through this, I saw what looked again like
1485120	1491560	quids, or maybe hashes there. And so I'm thinking more along the lines of their MD5 hashes. But when
1491560	1497260	I tried to search that in the string obfuscation text file, it doesn't pull things up properly.
1497260	1501460	We can see that that hash or that string is mapped somewhere, but it doesn't really tell us
1501460	1507820	what it is. It says something like 23-paged CT equals one. I don't really know what that maps
1507820	1514680	back to. So on the business versions, we didn't really get a full list of files and folders that
1514680	1522500	were added. With the CID.ini, we could see things there like the location or the URL for their OneDrive
1522500	1528380	or their Google Drive, sorry, not Google Drive, their OneDrive or their share file, I'm sorry,
1528380	1534500	share sync. And then with the last refresh time, it's in Unix Epoch, we can see the last time they
1534500	1538620	actually synced if they've got the up-to-date versions. You could see even there, I've got
1538620	1542340	all the different libraries that are shared with me, and we could see even the amount of
1542340	1549680	bytes transferred. Now that CID.dash profile service response, that one will give us, as I
1549680	1554560	mentioned, only for the personal version of Office 365, I'm sorry, personal version of OneDrive,
1554560	1558660	you've got things like the display names. We could see Michael Wiley or Mike Wiley there.
1558660	1563740	We could see the ID or the CID of my user. We can see the email address that I have registered
1563740	1569120	there. So it was a Gmail account. We could see a business phone number, which again, I don't know
1569120	1574180	why is there, and every time I've looked is null. Same thing with job title, mobile phone, office
1574180	1581500	location, that kind of stuff. I did try and compare the registry keys. So in my lab environment,
1581500	1588620	I went ahead and installed or activated OneDrive for business, and I recorded all the different
1588620	1593520	registry keys that I saw. Then I did that for the personal version, which is that middle column
1593520	1598360	there, to see which registry keys were added. You can see there's a lot less. And then I tried
1598360	1603880	to do essentially a merge of those and see which were common, so that way we can identify which
1603880	1608240	registry keys were not common. And so the only two keys in the personal version that are different
1608240	1614640	are isUpgradeAvailable and VaultShortcutPath. Otherwise, everything in the personal registry
1614640	1620380	keys, they're also going to be for the business keys. Hey, one interesting registry key that we
1620380	1625380	can find is that if we do a reg query or we use in the lab environment, I'm going to give you
1625780	1630720	a dump of the registry. So you can't obviously do a live query like I'm doing here on the screen,
1630720	1637660	but with the business version of OneDrive or Office 365, what happens is if you go
1637660	1643340	into HKeyCurrentUser, Software, Sync Engines, Providers, OneDrive. When we go into there,
1643340	1650080	you're going to see potentially multiple different keys there. And what looks like a
1650080	1657880	bunch of random characters like B736EE blah, blah, blah, plus one. And then you see C4F29 blah,
1657880	1665160	and so on and so forth. So those are actually what I think is the CID for users that have shared
1666000	1670140	folders with the user you're looking at. So you can go in here again, depending on your
1670140	1674460	perspective, if it's offensive or defensive, but you can now see that they have access to other
1674460	1680000	users files. Or if you're doing incident response or forensics, you can see that they might have
1680000	1685340	data that's mapped there that doesn't belong to them. Now, if you do another reg query below that
1685340	1693620	on one of those CIDs, so the B7 blah, blah, blah, if you go ahead and do a reg query on that string,
1693620	1696400	what's going to happen is you're going to see more keys under there, and you're going to see
1696400	1701340	the actual name, what they're calling the mount point of what's shared to them. So now I can see
1701340	1706720	there's a projects documents directory that they don't own, but someone shared with them and they
1706720	1711160	added to their OneDrive. And then obviously, you can also see the URL namespace. So you can
1711160	1716000	actually see the URL to get that. So if you are on their machine, you could possibly pop in that
1716000	1720380	URL into their browser. And if it's cached, you might be able to actually get that as well.
1721100	1726000	One thing to note with these tests, though, if someone shares something with the user,
1726000	1730260	it doesn't automatically mean you're going to see it when you do the reg query. They do have to
1730260	1736600	press add to your OneDrive in order for that to now show up in the registry. So once they press
1736600	1742100	add on the web browser version of OneDrive, if they click add this shared folder, for in this
1742100	1746080	case, I did test on a personal account, when you do the reg query, you're going to be able to see
1746080	1750400	that there. And so the difference between the business version here and the personal version
1750400	1755660	of OneDrive is that with the personal version, there is no CID of the user that shared it.
1755660	1760640	Instead, you're just going to see the name of the shared folder. If you dive into that a little
1760640	1765500	deeper with another reg query, we can actually see the CID of the user that shared it with them.
1765500	1771220	Possibly if you've compromised multiple machines with an organization, you can look at that the CID,
1771220	1775300	or if you're on the defensive side, you can take a look at that and say, well, I know Bob or Betty
1775300	1782260	or Joe or whoever shared this with that person. One other thing just to know about a lot of these
1782260	1788100	tools, I'm just going to focus here on OneDrive for a second, is that with Microsoft OneDrive
1788100	1793840	space saver, it basically allows you to not sync everything. And I remember back in the day,
1793840	1799200	Dropbox was the first cloud file storage solution that I used. And when I would sync that, I had
1799200	1806620	multiple directories and subdirectories. The challenge I had was that I couldn't get enough
1806620	1811580	space off of my machine. I had terabytes of data, and I would try and say, don't sync this folder,
1811580	1817640	but I really wanted a subfolder within that. So it was challenging to tell Dropbox which
1817640	1822740	folders to sync, which folders not to sync, get what I wanted, and also not fill up my hard drive.
1823380	1829140	So Microsoft OneDrive, their solution to that is called space saver. And what that'll do is that
1829140	1835100	it doesn't download everything. It'll essentially get you a cached copy of the file name, and you'll
1835100	1839980	see there that it's got a little cloud that's empty, and it basically means that it's cloud only.
1840000	1845940	However, you can double click on that file, and it will then be cached locally, which will have a
1845940	1851540	green check mark. Now, that'll eventually go away. I don't have documentation on how long it stays
1851540	1856480	cached locally, but if you want it to stay always locally so you could access it when you're on an
1856480	1860780	airplane or train or you don't have internet access, you could right click and say always
1860780	1867660	keep on this device. So now what we're going to do is we're going to dive into the OneDrive lab.
1867660	1873340	I do have a scenario for you that I don't think I properly put into the slides here.
1873400	1878460	So what I'm going to have you do is go to the GitHub repo, make sure you've got, again, those
1878460	1885860	four tools that you're going to use, the database browser, Notepad++, so on, so forth, and I want
1885860	1891540	those two tools installed. And then I want you to go ahead and extract the evidence-desktop-q50
1891540	1898460	blah blah blah dot zip file, which has all the artifacts for the lab. And then I want you to
1900620	1905820	start just looking at those files and seeing that it looks like basically a C drive, but it's only
1906000	1911940	a couple megs in size. What I'm going to do while you get that going, and if there's
1911940	1915400	any questions, obviously post them there on YouTube in the comments, and those will be
1915400	1922320	relayed to me so I can answer those questions. I'm going to go ahead and get the scenario
1922320	1925860	built up. I'm going to put that on the screen so you have the scenario in front of you so you could
1925860	1931100	see what we're doing. Obviously, there could be many different scenarios, but I tried to make this
1931740	1936440	fake scenario up, do it in the lab, and then I collected those artifacts for you to kind of dig
1936440	1940940	into. So what you're going to want to do is open up, and I'm going to do here on my screen,
1941920	1948120	there's three Word docs that are lab files. And the first one we're going to do here is OneDrive,
1948120	1954780	so it should be examining cloud file storage incidents dash lab dash OneDrive. So I'm going
1954780	1963520	to make this bigger on my screen for you. Expand that, zoom in, and this tells you here to navigate
1963520	1970360	to the CID dash profile services, and there's a question you're going to answer. So you basically
1970360	1975820	have to answer, what's Bob's Microsoft OneDrive CID? There's another question here, examine this
1975820	1980540	file, get the user principal name. So these are questions that you're going to go ahead and answer
1980540	1985440	and walk you through. Now, I will tell you, if you're stuck, or you've never done this before,
1985440	1989700	and you need some help, what I have is all the way at the bottom, if you keep scrolling down,
1989700	1996340	there should be a detailed walkthrough. So it'll give you the question again, exactly as you saw
1996340	2001180	it before. And it'll give you then, or the steps, the question, and then it'll also give you the
2001180	2006140	answer. And a lot of times here at the answer, what I also do is I give a screenshot. So if you
2006140	2011240	want to walk through this, and you've got less experience, and you're saying, it's all too new
2011240	2015540	to me, well, then just kind of walk through this, and you should be able to see the same exact things
2015540	2020420	on your system. So I'm going to go silent for a little while on mute here. So you have a little
2020420	2024960	bit of time to walk through these labs. When you're done, if you could start commenting and
2024960	2030140	let us know on YouTube, that way I can get an idea of when the first 10 or 15 people are done,
2030140	2035140	and we can kind of move on from there. So as I mentioned, go ahead and open this lab file,
2035140	2038300	get started on that. I'm going to put on my screen in just a second here,
2038300	2042160	the scenario, and I'll start talking about that scenario. Apologize, I didn't have that teed up
2042160	2053920	for you. Hey, Michael, a quick question in the chat around cloud file storage security.
2054480	2060620	Do you have any recommendation for, you know, scanning files for any malicious links or
2060620	2065760	malicious files themselves? Any tools, something along those lines?
2066440	2075120	Yeah, so a lot of the tools or the different solutions nowadays, they have AV built in.
2075120	2082300	I don't know a lot of details about what they are. I can tell you that they are getting really good.
2082800	2086900	I haven't done a full test where I've gotten, let's say like 1500 malware samples,
2086900	2090620	uploaded them all to see what happens. But I can tell you from experience, both
2091220	2098920	Google Drive as well as OneDrive has eaten up my malware samples that I have placed there for
2098920	2106820	different lab environments. Even when I have encrypted and password protected zip files with
2106820	2113460	malware built into them, both Google Drive and OneDrive have opened them up and used the password
2113460	2117940	infected to look inside of them. I was kind of blown away the first time I saw it. And they're
2117940	2122540	constantly improving it. They don't provide a lot of detail to that. So I used to keep a lot of my
2122540	2130900	malware in like Google Drive. And even more so, I now sometimes have PCAP files, so network traffic
2130900	2136240	that I have collected. And well, an incident happened. So let's say a user downloads a copy
2136240	2142020	of WannaCry. I captured that network traffic. Within that PCAP, there's a lot of stuff. There's
2142020	2148200	ping, there's all kinds of stuff in there. But there is an object, right? So they downloaded
2148200	2154760	that file. And if it's over a clear text protocol, all those bits and bytes and everything are
2154760	2161740	sitting in there. Nowadays, OneDrive will actually flag that. My PowerPoint slides for my incident
2161740	2168180	response workshop for Wireshark, I can no longer share my PowerPoints. And it won't even let me
2168180	2173180	download it to my computer. I actually have to go to OneDrive, confirm that I realized that they
2173180	2179060	have found a virus within a PCAP file, and then confirm that I guarantee I'm serious, I do want
2179060	2182840	to download that, and it'll let me download it. But they will not let it sync, and they will not
2182840	2188300	let me share it. So a lot of the tools, I can't speak on all of them and what their engines are
2188300	2193220	like, but I can tell you they're getting pretty good at finding stuff, even opening zip files with,
2193220	2198000	I'm guessing they're using common passwords, like infected, you know, password. And they're
2198000	2202900	trying to open up your zip files and scan those as well. If you do want a little bit more security
2202900	2208000	on top of that, and you want to know what's going on, CASB solutions will do that. I don't use CASB
2208260	2212900	a lot. However, I have used things like managed methods, we're a partner with them. And I went
2212900	2218060	through some of their documentation, and I saw that they have a back end relationship with one
2218060	2223580	of the AV vendors. And by adding CASB on top, it's scanning that. I would say if you're looking
2223580	2228740	for other things too, Microsoft is building more and more built in. So they've got their
2228740	2236360	kind of CASB solution built into Office 365. But if you want a third party, that's where it's going
2236360	2240620	to help you scan for stuff. So again, I'm going to go back to the tool I know, not saying they're
2240620	2247640	the best, but I just know managed methods. I build out a lot of regex queries for things like
2247640	2255200	social security numbers, for things that look like or password, username, stuff like that. So
2255200	2261800	it's doing antivirus scanning on top of what already Office 365 is doing. And then it's also
2261800	2267580	letting me do custom queries for things like PCI, HIPAA, and just stuff that shouldn't be stored in
2267580	2276110	OneDrive, like usernames and passwords and stuff like that. Yeah, I, you know, within my limited
2276110	2282770	experience, I have similar experiences, the cloud vendors are getting really good at defending their
2282770	2287410	own environment. It makes sense, right? I mean, they don't want to be hosting and especially if
2287410	2291530	they have that shared cloud responsibility model, they've got a lot of that on their side. And they
2291530	2297610	don't want you having things that are doing evil, or someone says, Oh, I got it from a Google Drive
2297610	2302570	link or something like that. So they have got, I'm sure some pressure to make sure that they're
2302570	2308750	keeping their customer safe and not spreading malware either. But, you know, when they did
2308750	2313910	open my zip file, I was shocked because it had a password. When they started scanning my PCAPs
2313910	2319570	and identifying malware in those, I was even more shocked, but good for them. This was the case,
2319570	2324890	I don't know why this isn't in my slides, I must have missed this. But basically, this is the
2324890	2329790	scenario that they built out for this workshop when it was the first time I did it was a four
2329790	2335570	or five hour workshop. So you're working the case of the Mike Wiley LLC case, this is going to be
2335570	2340570	more of a defensive incident response forensics type of case. But again, these concepts can be
2340570	2347150	used for both sides. So you've got Bob McLee, who is a senior manager of operations. The Mike Wiley
2347150	2353710	LLC firm is a boutique real estate investment firm in Los Angeles. Bob is a senior manager
2353710	2360690	who abruptly left the firm on 4-17-2020 in the morning. Days prior to Bob leaving,
2360690	2366370	he stepped down from all committee positions, so all board positions he was on. On Friday afternoon,
2366370	2372430	Bob updated his LinkedIn profile to co-owner of a competing real estate investment firm called
2372430	2379030	REMAX also. Within hours of Bob's departure, key clients gave contract cancellation notices.
2379030	2384250	The Mike Wiley LLC management believes that Bob may have violated his non-compete and non-solicit
2384250	2391570	clause. The Mike Wiley LLC hires a forensic incident response consulting firm to get
2391570	2396110	evidence of any violations of non-solicit, so you're part of that consulting firm. The company
2396110	2402390	did not have an approved cloud file storage solution, and some users would share files using
2402390	2410510	personal accounts for business reasons. According to HR, Bob's personal email address is
2410510	2418010	bob.maclee.re at gmail.com. So you've got that basic information about the incident,
2418010	2422570	and as you work through that, you could start seeing what kind of files. Is there anything
2422570	2427690	putting on your defender's hat, your incident response or forensics hat? Was there anything
2427690	2433250	that that user looked at, touched, synced, that kind of thing? And so I'm guiding you through in
2433250	2438430	the lab, going across that, trying to see what are some of those things that you can uncover
2438430	2444410	using some of this. And so what I did, just for a little background, is I had the web browser
2444410	2451050	opened up with all four platforms. I had OneDrive, Google Drive, Box, Dropbox, actually in Citrix,
2451050	2458410	I had five platforms. Then I also had two virtual machines. I had a primary one, which is the
2458890	2465330	information that you have, which I extracted out as the incident responder. I then also had a
2465330	2469430	second VM that you don't have access to. So there's three different possibilities. There could be
2469430	2474110	stuff on the web, there could be stuff on the VM you have, or a third-party VM, which is probably
2474110	2479050	their personal home machine. So there's possibly three different cases where files
2479050	2483230	could be added, removed, deleted, that kind of stuff. And so as we walk through, you could answer
2483230	2488570	all the questions within OneDrive, but what I try to do is have you answer certain questions
2488570	2493210	with OneDrive. Then later on, we're going to go to Dropbox, and you're going to answer some
2493210	2496970	questions through that. And then we're going to go to Google Drive, and you'll answer more questions.
2496970	2501470	So you could answer all of these questions and get all this information from one solution,
2501470	2507590	but every time I added a file, I added it to all five different solutions. Citrix, Box, Dropbox.
2507590	2513410	And so I wanted those same actions to happen across the board, but I wanted you to answer
2513410	2517150	them, again, using the different tools and know where to find them with the different solutions. So
2517150	2520990	hopefully that makes a little more sense of what we're doing and why we're doing it.
2522030	2529250	And again, if you missed it, we are looking at the OneDrive lab file where we've got the walkthroughs.
2530510	2535690	Any comments or questions on YouTube? Anyone stuck? Anyone done?
2537590	2545350	I do have a question, which is not related to the lab, but your opinion on adoption of
2545350	2550070	CASB in relation to layered protection for cloud assets?
2551670	2560590	Good question. I think it's got its purpose. I think there's different use cases. So let me
2560590	2565210	go into one where I think it's definitely useful, and then I'll go into another one where it's not.
2565210	2571270	So we work with, as I mentioned, a lot of studios and post-production houses that receive
2571270	2577270	the raw footage of the movies that are in the theater. And the challenge that we have is with
2577410	2582850	a lot of studios, they've got what's... they're very concerned about the data getting leaked,
2582850	2589270	especially after you look at Larson Studio was compromised by a hacker or hacking group,
2589270	2595910	and the contents of Orange is the New Black was held for ransom. I think it was like $97,000
2595910	2602550	or $60,000. I can't remember the exact amount. And then basically signed a contract and give
2602550	2607010	us this money in Bitcoin, and we won't release it to Pirate Bay. They ended up releasing it anyways.
2607650	2612550	So the studios have gotten very strict on that, and they've got a 96-page document called the
2612550	2617690	MPA Content Security Best Practices, and it's got everything. I mean, you should have a security
2617690	2623970	guard walking around 24-7. How do you handle their keys? You have to have an inventory of
2623970	2629230	every master key. When you're editing any content, it should be in a locked room with unique
2630330	2636130	keys to get in, like a combo lock. And that logging on that lock has to be for 12 months,
2636130	2640550	and you have to have a CCTV camera at your employees. And when your employees enter and
2640550	2644810	exit the room, you have to search them. They can't have personal items in the room. If they do,
2644810	2649570	it has to be a clear bag. It just goes on and on that most people can't really do that.
2650170	2655710	So one thing, though, is that the point of that is that the studios are very strict about,
2655710	2659690	you have to take our content, such care of our content, and how you work on our content
2659690	2663810	while it's in your environment, Mr. Post-Production House or VFX House.
2664550	2669290	Now, a lot of times, though, and I won't name which studios, but a lot of studios will still
2669290	2675450	send the raw content of Batman or whatever it is. I just used Batman as an example, but they'll
2675450	2682110	send the link for that to download the raw footage of this blockbuster movie. And they'll send that
2682110	2687550	via email with the URL and username and password to download that. Sometimes they'll also send it
2687550	2694190	over FTP, not the password, but they'll send the actual content over FTP. So I kind of feel like
2694190	2699590	that's saying to the studio, to the vendor sometimes, it's like, hey, we're going to give
2699590	2703470	you a gun, but you need to be so careful with it, you need to take a safety class, you need to
2703470	2708570	buy a lock, you need to have a safe, you need to be in a room that's got bulletproof walls and all
2708570	2713730	this stuff. But here you go, and they give you an unloaded gun without the safety on.
2713870	2718870	And so in those situations, we've recommended, even though it's not part of the MPA best practices for
2718870	2726310	our vendors, to basically, for their protection, is if you get handed a loaded gun, a CASB solution
2726310	2733190	may be able to identify those links that come in, and then track everything about it. And it'll
2733190	2738670	basically see if the... it'll almost alert. So when those links come in and possibly username and
2738670	2744470	password from the studio, in an insecure matter, it is then tracked and logged and any type of
2744470	2748570	action around that email is then alerted. Because we can't control the studio is going to hand a
2748570	2754370	loaded gun to our clients, but we can control then how we're monitoring, logging, and preventing that
2754370	2759590	from going out. So the CASB solution lets us keep track of that. And if it's ever forwarded to a
2759590	2764810	personal account or anyone outside the company, we get alerted to that. Some CASB solutions will
2764810	2770690	actually allow you to break links. So if someone puts a file up in Dropbox, or they try and share
2770690	2776090	it, it'll break that link. So in those cases of detecting and sometimes preventing, but mostly
2776090	2781290	detecting data leaving or being shared or forward and stuff like that, we absolutely recommended
2781290	2788950	that to the client. Now, other cases, we have a CPA firm that's one of our clients, and they
2789870	2794270	didn't really have a need for that. We got CASB involved originally, but we found out really,
2794270	2797510	they just didn't want anyone to share anything outside the company. There was no use case for
2797510	2803310	that. So we just disabled sharing. And in that case, we didn't really need CASB. So you kind of
2803310	2807270	have to look at what functions you're worried about. Do you want the antivirus scanning? Do you
2807270	2814210	want the regex queries? Do you want to be able to be alerted on certain events? I think a lot of it,
2814210	2818490	you can actually do now with OneDrive. If you integrate that with a tool like Sumo Logic,
2818490	2822730	you could do a lot of alerting on that. But again, every use case is different and depending on what
2822730	2826430	you're storing there. So it's a long winded answer, but there's a lot of depends, but there's
2826430	2831670	some really useful features. In other cases, a lot of businesses, I say, no, it's not right for you.
2833970	2840250	Got it. And then another question, is there any form of encryption adopted by OneDrive that
2840250	2846250	minimizes the risk of disclosure? I'm making reference to access the local files in plain
2846250	2853470	file. Got it. So not that I'm aware of. No, I think they're obviously in transit. OneDrive,
2853470	2860390	Google Drive, all that stuff is traversing over SSL TLS. And so it's essentially encrypted in
2860390	2864990	transit. And then I'm assuming it's encrypted also when it's sitting there in the cloud.
2865430	2871110	But on the local file system, no. I mean, once it's sitting there, it's sitting there.
2872690	2878970	Couple caveats though, is that a lot of those caching or those shell files, where it's only
2878970	2883850	the file name, but it's not actually downloaded. I've had issues with that. And I could see where
2883850	2888210	that could almost benefit you from security standpoint, is that if you try and copy all
2888210	2893050	the files in OneDrive onto a thumb drive or something else, it has to download each one
2893050	2897990	and then move it over. And if it doesn't have connectivity or you're signed out or anything
2897990	2902550	like that, it will error out. It won't actually copy those files over. It's really just a shell
2902550	2907870	or a shortcut that points to that file. So not really encryption, but that's, I mean,
2907870	2913170	that's one security measure. I guess it wasn't meant as a security measure, but it helps you out.
2914070	2919530	And then every solution we're going to look at today, all of them, all this local stuff,
2919530	2924970	like the caches, the logs, everything is in clear text. So you have access to all the databases
2924970	2931430	from all these tools. OneDrive doesn't use databases, it uses the registry, but Google
2931430	2937550	Drive, Box, Dropbox, Citrix ShareFile, they all use SQLite databases, and all of them are in clear
2937550	2941570	text. So you don't even need a password, you just open them up and you get access to all this stuff.
2942210	2946910	With the caveat of Dropbox, and Dropbox is the only one that actually encrypts their databases
2946910	2954590	and some other stuff at rest. So the files are not, but at least the database and the metadata,
2954590	2957970	you won't be able to get into that unless you do some further exploits.
2960190	2964810	Okay, so let me do a quick walkthrough on this, and then we'll move on to the next piece.
2964810	2970650	So the first one, it says to go ahead and navigate over to the cid-profileserviceresponse.txt file
2970650	2976190	and open it with Notepad++. So some of this, I might have an issue with my walkthrough because
2976190	2982150	my VM that I normally use for this, I haven't touched it in a while, and I forgot the password.
2982150	2986070	So I had to like last night, all of a sudden move all these artifacts over and try and get it reset
2986070	2992770	up. So if it's a little bumpy, I apologize. So you've got, if you extract that zip file
2993490	2997890	that I've got with the evidence, basically, you're going to see a folder structure of C,
2997890	3001130	essentially, if you were on the file system, you'd click on the C drive.
3001350	3004790	And then you're not going to see everything, but you're going to see the things that I extracted
3004790	3009650	with CAPE within 10 seconds. So an incident happened, you know, Bob McLee called us in,
3009650	3015050	or not Bob McLee, but the Mike Wiley LLC about Bob McLee, and said, we think there's an issue,
3015050	3021290	please, you know, figure out what happened. So what I did is I grabbed CAPE, a tool,
3021290	3027590	and I basically then, I've got a custom CAPE target that extracts all stuff related to cloud
3027590	3033290	storage solutions. I said, collect it from this hard drive, the C drive. And within 10 seconds,
3033290	3038670	it created the zip file for me, or for us. And it gives us all relevant information to these Google,
3038670	3043470	or not Google Drive, but these cloud file storage solutions. So we're going to go over to users,
3043470	3048410	Bob, for Bob McLee, we're going to go to app data, local, Microsoft. And so you can see,
3048410	3057570	this is most of the data we're going to look at today. But we're going from Microsoft,
3057570	3060870	there was no business account. So this was not a paid subscription,
3060870	3063730	this is a personal account. So immediately, we notate that for our incident,
3064330	3071170	we go into personal, and then we should see that CID dash profile service response.
3071170	3078170	So what's Bob's Microsoft OneDrive CID? Well, it's right here. Okay, so we've copied that we
3078170	3085490	now know that CID in case we see it elsewhere. The next question asks us, examine this file and
3085490	3091410	look for the principal name. So we want to double click on this. And we just make this larger for
3091410	3103950	you. Word wrap, edit, and format. Okay, and so we could see here, obviously, that they're using
3104790	3110810	OneDrive principal name, Bob McLee, so we have the right computer. We could see their CID again,
3110810	3116050	right here, we see their email address. So it was bob.mcleegmail, this matches what HR told us is
3116050	3120530	their personal email address. And then we don't see a phone number, job title, as in most cases,
3120530	3128470	we won't. Okay, the next question is, what is the device ID of the system you're investigating,
3128470	3134210	right? So we want to see, we didn't do the acquisition, all we did was given the zip file,
3134210	3138910	and we want to know, well, which system is this in case we have to go to court. Okay, so I want
3138910	3145370	to go ahead and go over to OneDrive logs, and then personal. So I'm going to close this, and go back
3145370	3152090	to OneDrive, logs, personal. And then within here, I'm going to go ahead and look for the sync
3153290	3160710	diagnostics file. So I got this one. Let me see if I have notepad++. Perfect. This is going to be a
3160710	3181450	little easier. Okay, and so within here, we can see the question was, what's the device ID? So
3181450	3191140	my device ID. So we see we copy that, and that's got a unique device ID. Get on my zoom here.
3195030	3200470	Okay, and then the next question is, how many files folders are synced? So we can just look
3200470	3206530	through here for files. 13 files were synced. Let's see if I can just make this view a little
3206530	3218410	better for you. Zoom in. There we go. That's much better. Okay, so files, there's 13 folders,
3218410	3222170	there's three, so we can see that they're not really a big user, but there might be some
3222170	3226190	interesting files and folders we want to look at. But essentially, there's 13 files that we're
3226190	3237160	looking for. Okay, and then we want to look for... next step is to navigate over to
3239300	3243500	personal, and we want to open up the obfuscation string map. So I'm going to close this or just
3243500	3250980	minimize that. Go back here. Obfuscation string map, we'll open that up as well. And so now we
3250980	3255420	can see, even if we don't know everything, we can start getting on the right hand side here,
3255420	3263000	I can see different files and folders. So I see that C drive, users, Bob, metadata, app data.
3263840	3268460	Scroll down, we can look for anything that's interesting here. Okay, we've got Bob again,
3268460	3276440	desktop, users. Okay, keep scrolling down, we could see email address, I see there's some type
3276440	3287360	of possibly PowerPoint, some mail. Okay, client. So there might be a client's folder we're looking
3287360	3292500	for. But you could just start parsing through this and start seeing different possible file
3292500	3297860	names or things that are interesting. Imagine if you see like password, or, you know, here's some
3297860	3303320	messages or messaging possibly. You know, you can just parse through that. At the very, at the
3303320	3306720	very least, even if you don't go into other things, you can start looking for interesting file names
3306720	3314760	and folders there. Okay, but then it says we are looking for, we found something that was
3316420	3322260	123, me, you, they, who, what, where, and so we want to match that up. So I can just search here
3322260	3331500	and see my searching. It's hard using a Mac and then a Windows VM, the control keys are not
3331500	3347450	matching up. There we go. Okay, so 123. And of course, it's not working. Let me see.
3353580	3364870	Go to the top again. Oh, I see. I was giving you a sample. I was wondering why the heck is the 123
3364870	3371150	not there. But really, we were trying to figure out what the C drive slash user slash Bob was
3371150	3375370	going to equate to. And so I give the example which didn't exist. But essentially, what I'm
3375370	3390460	looking for here is, if I'm trying to find my logs, I'm gonna open up a new tab. Okay, so if
3390460	3396620	I'm looking for the C drive, it would look something like this. And then users. So I look
3396620	3407000	down here for users, it's gonna be this one. Okay, and then Bob, go back here. It's gonna be
3407000	3414940	this. Copy. Basically, so if we're looking in log files, we're looking for something like this,
3414940	3419300	if we want to see things that were placed in C users, Bob's directory, right, this is
3419300	3425960	essentially the path we're gonna be looking for in the log files. Okay, then the next step here
3425960	3442700	is that we are going to navigate over to the CID.dat file. Okay, personal. And then this is
3442700	3450140	our CID.dat file, I recommend opening up with a hex editor. This one's probably expired. I'm
3450140	3452580	just going to use a different tool than you have here because I haven't installed
3455320	3459420	HXD on this one. But if we look through here on the right hand side, this should be
3459420	3464660	the ASCII. If I scroll down, we can look for things like, did I tell you exactly what to look
3464660	3471060	for? Personal vault. So we start looking for that, I'm just gonna scroll slower.
3476620	3484240	Okay, there it is, I see personal vault right here. Okay, and then we're looking for,
3484240	3488420	look at the question again, we're scrolling down looking for the next folder name that we see.
3488420	3498890	So I'm going to keep scrolling slower, scroll, scroll, scroll, nothing there. You can see why
3498890	3507120	I might want to use strings here, because this is just a little bit messy. Okay, and now I see
3507120	3512000	something else here, another folder called operations. Right, so there's another folder
3512000	3516280	called operations. And you can keep parsing this. But again, if you use strings, I didn't want to
3516280	3519640	give too many tools, but strings is going to make it a lot easier to parse that out.
3524460	3532380	Okay, the next thing I have here is we're going to open up the CID.ini file. So I'll go back over
3532380	3540860	here, CID.ini, I'll open it in notepad++. And we're going to go ahead and look for the
3541940	3547120	local file path where things are stored. So I'm looking for the library, if I scroll over to the
3547120	3555060	right here, whoops. We can see this is where things are stored for Bob. So anything that's
3555060	3559140	synced with OneDrive, it's going to be stored in this location there, C users Bob OneDrive,
3559140	3565580	which is what we'd expect. That's the default. Okay, now we want to run Registry Explorer.
3565600	3574900	And we are going to load the registry hive. So I am going to go, hopefully, I remember where I put
3574900	3591930	it. I think I put it in my downloads. Another tab here. Downloads. I did. Okay, so my installer
3591930	3600470	software, just like you do, and I want to open up Registry Explorer. And you might get an error
3600470	3624350	when you open this up. We'll see if I get it. Nope, I must have changed the settings. But if
3624350	3629830	you do get an error about Windows protecting your PC, you just click on more, and then you run
3629830	3636370	anyways, to try and bypass that. Okay, so the next step is that we want to load a registry hive.
3636370	3645190	So I'm going to click on file, load hive. Once that's loaded, I'm going to go to our evidence.
3645230	3649970	So I have extracted my evidence, I believe, in my downloads folder. And then I have my evidence
3649970	3657230	here. Click on that, click on the C drive. Within the C drive, under the users, we go to Bob. And
3657230	3663550	within Bob, we should see NTUser.dat. When I click on NTUser.dat, it's going to open up the
3663550	3669330	registry hive. But if you don't know how the registry works, it's generally going to be
3669330	3673410	dirty. Things are going to be in these log files until you reboot. That's why a lot of times when
3673410	3678110	you make registry changes, they say reboot afterwards. So these log files are the transaction
3678110	3682510	logs that are not written yet. And we want those to be written. So when we open this, we're going
3682510	3688310	to get an error probably that says, hey, it's a dirty hive. If we get that, we should. We're going
3688310	3695170	to click yes. And then it's going to say that we have to pick essentially which transaction
3695170	3703030	logs we want to replay. So I'm going to click OK. I'm going to select both the .log1 and .log2
3703030	3708950	file. I want both of these transaction logs to be replayed to the registry hive. So I click open.
3710530	3711370	Click OK.
3714290	3716890	OK. And it's going to say, where do you want this to be saved to?
3717990	3721510	I'm just going to throw it back in my evidence folder. So I'm going to go back to downloads.
3724290	3728670	C drive, users, Bob. And I'll just dump it right here. It doesn't really matter where.
3729410	3734910	And it says, great, it's been updated. And the sequence numbers match. So that's a good thing.
3734910	3740150	Do you want us to load the updated hive? Absolutely. Thank you. Yes. And it says,
3740150	3744430	do you want to load the dirty hive? No. Why would I want the dirty one? So bye-bye.
3745190	3750950	OK. And now we're able to parse this out. So now that we've loaded this up, what we want to do is
3750950	3755810	I want you to go to software, Microsoft, OneDrive, accounts, and then personal. So I'm going to expand
3755810	3763390	this. This is going to be a problem. Every time I have this in my VM, for some reason within the
3763390	3769050	VM, it gets all messed up with the font here. Let me see if there's an easier way. Or I'll
3769050	3777250	probably have to zoom in. So give me a second. And if I don't go blind before then. Microsoft.
3785250	3804810	So hard to see this. OneDrive. And accounts. Personal. OK. Now let's see if I can...
3809210	3816450	There we go. So I know it's small. For some reason, it gets all messed up in here. But
3816450	3822650	let's see if I can go even a little bigger for you. OK. So I basically just browse to the
3822650	3830490	registry location. And then... one second. Let me scroll down on the instructions so I make sure I give you the right steps.
3831270	3837710	OK. And so some of the things that you want to answer here are... oh, no.
3839630	3843190	Hang on. Sorry. Let's go back. Increase this.
3845350	3850070	Well, I may not show a bunch of these demos with the registry if this is going to happen every time.
3850070	3859050	But we can see the user email in here. So we see that it's bob.mclee.re.gmail.com.
3859110	3865470	We can look at the CID. So we can see the CID of the user down here. We can see the default file
3865470	3872110	store, which is C, Users, Bob, OneDrive. We can see the last sign-in time. Where is it?
3872590	3882890	Last sign-in time, 15.87.12.89.85. We do need to convert this from Unix Epoch time to standard time.
3882890	3889310	So you can do that by just copying and pasting this in Google or looking for a Unix Epoch converter.
3889310	3893090	And you can just sort that out and it'll give you the exact time. But almost everything we're going
3893090	3899230	to look at today, almost everything, is in Unix Epoch time. We can see the first time that the
3899230	3906130	device was synced. So if we go to client first sign-in time down here, this tells me when they
3906130	3911030	first started syncing with OneDrive. So we can get a lot of useful information just by analyzing that.
3912230	3915350	Hopefully, there's no more registry things. Let me see if there's anything else because that's
3915350	3921350	going to be a pain to do. Okay, and then we can also look at... there's one more that I'll just
3921350	3926750	show you. The registry piece here is that, aside from personal, what other directories are shared
3926750	3931910	or synced with this user that they don't own? I'm going to get to it first and then I'll zoom in
3931910	3942430	here for you. Actually, let's see if I can tell the slide here. So we want to go to Software, Sync
3942430	3959640	Engines, Providers. Okay, Software, Sync Engines, Providers, OneDrive. And so just looking here under
3959640	3964000	this OneDrive directory, we can see that Finance, Operations, and Personal. So I said what else
3964000	3969540	besides personal? So there's a Finance and Operations directory that were shared with this
3969540	3974360	user. So they don't own that. However, they have access to it. And therefore, we may be able to get
3974360	3985560	access to those files as well. And I think that wraps up that lab. There's one more question.
3985680	3992180	Clicking into the personal, another shared folder keys, registry hives, what data value do you see
3992180	3999420	in the CIDs? So I will show you that one again. So if I do click on, let's say personal, because we
3999420	4007860	know personal belongs to this user. If I go up here, try and get this down, we can see the CID
4007860	4015160	of the user that owns personal here starts with 87 and ends in B0, Bravo 0. Now, if I go click on
4015160	4023140	operations, let's go back up here and see that the CID is different. So that CID, basically, this is
4023300	4030060	a folder that is owned by someone else. Cool. That wraps up the walkthrough for that lab.
4030060	4033920	So let's move on now to Google Drive. Google Drive behaves a little bit differently. Microsoft
4033920	4038620	obviously is baked in, so they have the ability to use a lot of the registry as if it was a database.
4039180	4043280	I guess it kind of is a database, but they have access to that, right? Where some of these other
4043280	4050200	solutions have to build this to make it portable. So with Google Drive, you've got... I keep calling
4050200	4054960	it Google Drive, but the personal version is really called Backup and Sync. But I'm just going to
4054960	4058880	keep calling it Google Drive. I'm old school like that. If you're talking about the business version,
4058880	4065500	it's called Drive File Stream. It's part of the G Suite offerings. They're backed by SQLite
4065500	4069920	databases rather than just text files and registry keys like we saw with OneDrive.
4070480	4075860	So the Drive File Stream, it creates... it's a little bit different. It's similar to Citrix
4075860	4081020	share file in that it creates a virtual FAT32 volume and mounts it. So you're going to actually
4081020	4088240	have like a G Drive sitting there that looks like a mounted file or file system. Sync to Google
4088240	4092280	formatted files will create a shell. So what's interesting is that even if they're syncing,
4092280	4098160	you don't actually get the Google file locally. So if you create a Google Sheets or a Google
4098160	4105080	document within Google Drive web browser, it syncs. It's supposed to be syncing locally to
4105080	4110400	your file system. What happens is that it creates a shell file and that shell file will have,
4110400	4115560	if you open it up in a text editor or a hex editor, you'll see the URL, the document ID,
4115560	4119620	and the email address of that user. So it's kind of interesting. It's not the actual file,
4119620	4126020	it just redirects you to that. Some interesting locations and databases and files that you may
4126020	4132860	find when you are examining the system is that you've got the sync underscore config DB file.
4133280	4137300	It'll give you the user's info like their preferences, initial application sync time,
4137300	4143040	and stuff like that. The cloud underscore graph database will give you metadata for both local,
4143040	4151640	cloud, and shared files and folders with that user. The sync underscore log dot log file will
4151640	4159680	give you added, deleted, modified, renamed files for that user. The snapshot dot DB database will
4159680	4165620	give you local file metadata, so things that are just locally. And if the user is using G Suite,
4165620	4172900	the content underscore cache will give you local file caches. I think this also worked partially
4172900	4179980	with Google Drive personal version, but there was slight differences there. Also, we'll see
4179980	4186600	the metadata underscore SQLite DB. That will give offline files, cloud files, deleted files,
4186600	4192840	and other metadata. So if we dive a little deeper and look at the sync config database,
4193480	4200660	which is located inside of AppData local Google Drive, it's got a bunch of different tables,
4200660	4204920	but the one of interest is the data table. And within the data table, we're going to see
4205460	4209140	the highest application version, so we can see what version they're using, see if there's any
4209140	4215040	known vulnerabilities or exploits. With the local sync route path, you get the path of the
4215040	4220660	local file source or where those are sitting locally on their file system. We'll also get the
4220660	4226280	user's Gmail account. So here's a screenshot of what that'll look like. We pivot over into the
4226280	4231460	data table, and that's where we can see those different rows with interesting information.
4231460	4240500	The Cloud Graph database, the main table that we're interested in is the Cloud Graph
4240500	4247160	entry table. And that's going to give us stuff like every document in their Google Drive with
4247160	4254560	the unique ID, the file name or folder of the object that's synced. The last time it was modified
4254560	4261120	in Unix Epoch, I did not test on what triggers that modify time. So I do want to just warn you
4261120	4266000	if you're an incident responder or forensics, you may want to do some testing to verify that
4266580	4273420	is it a file open? Is it a edit? Is it a sync? What will trigger that modify time? I didn't go
4273420	4279500	that far into detail. The ACL role will tell you whether or not the owner, so the person you're
4279500	4285040	looking at on their system, if they own the file or if it's shared with them. We also, what's
4285040	4290740	interesting is with Google Drive is that you'll see a doc type column, and the doc type column
4290740	4296020	will give you what format the file is. And so it's a little bit limited, but it's interesting.
4296020	4300200	If you see a zero, it means that the object you're looking at is a folder or a directory
4300600	4307740	or equivalent to a directory. If you see a one, you'll see that it's a traditional file, like a
4307740	4313860	Word doc, a PDF, something like that, a zip file. If you see two through 13, those are reserved for
4313860	4317820	Google Files, but they go a little bit more detail since they own those files, obviously.
4317820	4322080	If it's three, it's a Google formatted presentation. Sorry, a two is a Google formatted
4322080	4329120	presentation. A four is a Google formatted spreadsheet. A six is a Google formatted document.
4329500	4334860	Now, there's a removed column, and I couldn't get that to trigger. So when I deleted things,
4334860	4339620	I moved to the trash, nothing really changed there. So I'm not sure what that's reserved for
4339620	4344180	or why Google has that. We also get something that's really interesting is the file hash.
4344180	4350760	So we get the file hash of the object, whether it's a Google spreadsheet, or it's a PDF,
4350760	4357200	we're going to get the MD5 hash of that object. If we open it up in the database and DB browser
4357200	4363160	for SQLite, we're going to be able to see things there, like I just talked about. Now, that doc ID
4363160	4369400	is unique across Google Drive. And so you're going to be able to identify that if you didn't have the
4369400	4373280	hash, you could find that in other databases as well. But we can even see there the different
4373280	4381760	file names of all those files that are in the Google Drive. The sync underscore log dot log
4381760	4387020	file, this one was a little bit hard to read, and we'll take a look at it. But it's, in my opinion,
4387160	4392720	a little better if you use some type of parsing tool like bash, maybe use grep or awk, or you have
4392880	4398180	a sim, you could even do a free tier of Sumo logic to parse this out. There are tons of different
4398180	4403040	actions that are interesting. Everything is started with action dot. So you could do action
4403040	4407700	dot wildcard, or if there's specific actions you were trying to narrow down to see, you know,
4407700	4412540	is this user using Google Drive? Are they deleting files? What's going on? Whatever action you're
4412540	4416860	interested in, you can parse for those, you can grep them, you can search for them, etc.
4418320	4422020	And then not only that, but you can also see the direction that things happen. So
4422020	4426800	was the action to delete, was that local? Or did they delete it within the cloud?
4427320	4431960	Did they add a new file? Was that added on the local file system? Or did they add it by going
4431960	4437780	to drive.google.com? So looking in that log file, you can actually look at the direction dot,
4437780	4442960	it'll tell you if it was initiated within the cloud or locally. You also see shared equals
4442960	4447060	and then true or false. And that tells you if it's if they're sharing enabled or not.
4447060	4453600	And then another way that I found useful for parsing for file names is I grep for name equals
4453600	4457940	you. And then you'll look, you'll be able to find all the different file names. And you could
4457940	4462840	even then grep for certain things like pass or password, or username, whatever your use case
4462840	4469480	is there. So just by for an example, I uploaded that file to Sumo Logic, and I did a log reduce
4469480	4474580	so that you could see, it gives me a count. So I'm able to start to see, well, how many files
4474580	4481920	were downloaded. And we could see there that 22 log files, or I guess entries in the log file
4481920	4486020	match that telling me that there was a download action. So something happened from the cloud,
4486020	4492920	and then it was synced locally. If we look at that snapshot.db database, that'll give us
4493660	4498520	similar things we saw before. But the added value that we see here is that whether or not
4499080	4503240	the file is shared with other users. And that's gonna be one of the new fields that we'll see
4503240	4509680	here are the columns. Something that you may have to look at for both snapshot.db and cloud
4509680	4516020	underscore graph.db is that in the cloud relations table, you'll be able to map out where things are
4516020	4521140	located. So the database doesn't give you a clear understanding of where things are positioned.
4521140	4526760	Do we have files and folders? Or do we have... what are those folders called? So you
4526760	4532180	might have to look in both those databases in the cloud relations table. And within the cloud
4532180	4536560	relations table, that gives you almost a key of where things are stored. And they're going to use
4536560	4543440	those doc IDs and the parent doc IDs. And so you could see that on the right-hand side there,
4543440	4549740	the one that starts with 1NGR blah, blah, blah, that's in the root. But then there's multiple
4549740	4556440	files there. The row 2, 3, 4, 5, those are files that are sitting within that root folder.
4557820	4562800	So this is essentially how you kind of map that back is if you're looking at, let's say,
4562800	4567320	the cloud entry table, and you want to know, well, I see there's an object called finance,
4567320	4571020	and I see a bunch of other files, but which files are sitting in the finance directory?
4571200	4576060	Well, you would open up that cloud relations table, and then you could map those out and see,
4576060	4583420	oh, okay, I get it. It's sitting in this directory. Okay, so this brings us up to a lab.
4583840	4589220	I think what I'm going to go ahead and do is dive into some of the other ones since we've got about
4589220	4593220	40 minutes left. So I'm going to keep going with the slides, and then at the very end,
4593220	4596320	I'll kind of hang around, and we can walk through some of those labs together.
4596940	4602780	So as I mentioned, Dropbox is a bit different there. Dropbox uses encrypted SQLite databases,
4603420	4609020	SQLite encrypted extension, SAE, since 2011. So very early on, they've been encrypting those
4609020	4614400	SQLite databases, so we don't have as much visibility into them. Now, the bright side,
4614400	4619200	though, is that the key for the encrypted database is stored in the registry. However,
4619200	4625360	it's encrypted with Windows Data Protection API, or DPAPI, as I'll call it. You can either brute
4625360	4631860	force the key, but good luck with that, or you can extract the DPAPI keys from memory.
4632000	4636900	I was not able to do this. I tried this in the lab a couple of times. It didn't work. However,
4636900	4644660	Francisco has a toolkit called DEC WinDBx Toolkit. I'll try and get you... hopefully,
4644660	4649040	I've got the GitHub link on the next slide or two, but there's a toolkit. There's both
4649560	4655780	Python, PowerShell, and executables that will pull that from memory. The version of Windows 10
4655780	4659900	I had in my lab environment, it would not work. So I don't know if that's because it was
4660240	4665220	a lab environment, if it was the version of Windows. I didn't get it to work. However,
4666280	4672080	there's plenty of talks out there that talk a little bit more about this. So you can go ahead
4672080	4679560	and Google Dropbox DPAPI keys, and there's some great talks to talk about this and how they did
4679560	4684280	their research. The one thing we will be able to see, though, even though the databases are
4684280	4689240	encrypted, is that we'll see the .dropbox.cache, and that contains miscellaneous temporary cache
4689240	4694300	files. So sometimes, even if there's files that are deleted by other users, we'll be able to see
4694300	4702060	those deleted files within that cache location. Also, with a lot of these different Dropbox,
4702700	4710460	is that when you delete files within the cloud, what happens is that if you're even on the web
4710460	4716240	interface or on another system, when you delete that file, it syncs that delete. But unlike the
4716240	4721900	cloud versions or the web interfaces where there's that temporary trash location that may be purged
4721900	4729140	automatically between 30 or 120 days, when you delete that on the local file system, what
4729140	4734240	generally happens is that file goes into the trash can. So often, if you go into the trash can
4734240	4737840	on the local file, you'll end up finding things that were deleted from the cloud, and those do
4737840	4742480	not get deleted automatically. It's going to take the user running CCleaner or right-clicking on
4742480	4749820	their trash can or recycle bin and emptying those. So the other piece here, and this is
4750340	4755680	the talk that I got some of this information from, was Nicholas and Florian. They did a talk called
4755680	4762860	A Critical Analysis of Dropbox Software Security. It was at hack.lu in 2012,
4763440	4767020	and they posted about it in their blog, and they talk about where these keys are located
4767020	4772180	and how they extracted this out. But these are the file locations where those keys are stored.
4773560	4779400	Okay, and I did post here, if you want to check out the dbx decryption toolkit, it did not work
4779400	4783840	for me, but if you get it working, let me know. LinkedIn, Twitter, I'd love to hear how you got it
4783840	4789840	working. So they have that toolkit located there, and you've got PS1 files, you've got Python files
4790480	4796860	that essentially will extract that out. Okay, and then I just list out here a bunch of different
4796860	4800520	directories and paths, but most of these we don't get a lot of information from because
4800520	4808260	the .dbx and the .db databases, they are encrypted. So even the ones like home.db,
4808260	4812880	where it looks like it might not be encrypted, I could not get any useful information out of
4812880	4822780	those locations. Okay, with Box. So Box is very similar to Google Drive. We have a bunch of
4822780	4829020	different files and locations, and then log files, as well as database files. The other cool thing,
4829020	4835480	probably my favorite location within Box, is that there's the appdata local box cache directory,
4835480	4842000	and that stores complete files that were opened both locally and are possibly even cached.
4842000	4845920	So we will be able to see not the file name, but we'll actually be able to recover
4846540	4849540	files, whether or not they've been deleted from Box.
4851140	4857240	Okay, we also have some log files, which give us detailed activity of both the file activity,
4857240	4861920	but then there's also a Box UI log file that tells us when the user logged in,
4861920	4865500	what kind of network connection they had, if they lost internet connectivity.
4865500	4870520	I mean, it's almost like stalking the user with the UI application. So there's a lot of
4870520	4876800	detailed information there. We also have the boxstream.log, and that's going to give activity
4876800	4883480	around metadata, paths, log locations, log files, free space on the file system, all kinds of juicy
4883480	4889880	information there. And then we also have the syncrootfolder.txt, it just tells you where the
4890540	4895040	default file store is located. And then there's a couple databases that will give you local files,
4895040	4899680	cloud files, cached files, usernames, passwords, or not passwords, email addresses, and that kind
4899680	4906640	of stuff. So if we looked at the boxstream.log, there's keywords that you might want to parse
4906640	4913560	out with grep or awk, things like add file, add folder, on delete file, on delete folder, open,
4913560	4917060	so you can get those different activities, and it'll tell you which files. So there on the screen,
4917060	4922060	we can see a file was added, the date and time, the file was called the Mike Wiley 2020 strategic
4922060	4930620	plan.rtf. Then also, we could see other things here about, you know, where things are cached,
4931360	4936960	where the database is located, mount points, stuff like that. So as I mentioned, my favorite
4936960	4942080	one is that cache directory. If you look at the cache directory, you'll see either what's a grid
4942080	4946980	or a hash for the file, but it's not the actual file name. The cool thing, though, is that if you
4946980	4952820	open up any of those files in a hex editor, you can look at the magic byte or magic bit in the
4952820	4958920	beginning, and we can see it's an rtf file. So then we could just rename that file to example.rtf,
4958920	4967080	and then we can open it up in a respective software application. The box UI, this is just a
4967080	4972420	sample of what you might see. You could see when the user logged out, when they logged back in,
4972420	4976960	hard drive space, network connectivity, all kinds of stuff built in there.
4978220	4984520	And then within that box dash, and then the date, or version number, sorry, we're going to see those
4984520	4990660	different files like test.txt, content created at, you know, different times, again, obviously,
4990660	4998880	in Unix epoch time. Okay, and then we'll see the different box databases with interesting things,
4998880	5004080	very similar to Dropbox, but this time we get SHA hashes, we can see when things were created,
5004080	5008000	they were updated, again, take that with a grain of salt, I don't know which actions trigger those
5008000	5012540	updated, if it's local, if it's cloud, if it's a combination, so you just don't want to rely on
5012540	5018400	those dates unless you're sure. So here again, you can see those different, the local IDs,
5018400	5024280	native item type, whether or not it's a file or folder, we can see the parent item ID, so we can
5024280	5030360	map out what's sitting in what location, file names, inode ID, that inode ID is going to become
5030360	5038980	important later for mapping things out to file names. Streams fs.db, there we get things like
5038980	5045900	the file name of the item that's in that cache, so we could actually now, if we open streams fs.db,
5045900	5050260	we can find out all those random file names that were sitting in that cache location,
5050260	5053760	we can actually see the true file name to see if that's relevant or not.
5056220	5060740	Okay, and then if we want to map that out, so if we want to see here, we've got the,
5060740	5066440	that, that streams fs.db, and we go in the cache file table, we don't see the file name,
5066440	5070520	but we do get to see that inode ID. So we're going to have to take that inode ID,
5070520	5076420	open up the syncdb database. And from there, we can map the inode ID and we can see, oh, okay,
5076420	5083220	so this A1, B4, blah, blah, blah, glitter hash, that is the business plan document that we want
5083220	5090340	to recreate. And if we open that up again, in a hex editor, or even a text pad, or notepad,
5090340	5096580	we can see that the, we've got the magic byte of PK, which tells us it's a .x. So we can now
5096580	5103260	rename that file business plan. .x, and we can then open it up in Microsoft Word. So I went ahead
5103260	5107280	and did that, I renamed the file, give it the proper file extension, opened it up this time
5107280	5114220	in WordPad, and we can actually see that business plan for startup business. And that file had been
5114220	5120120	deleted from, from Box. So it was no longer sitting in Box, but the cache was still sitting there.
5122220	5127920	Okay, just map out some more of those things and what those locations are for. So again,
5127920	5131400	I'm going to keep going, and then we'll come back to the lab afterwards, rather than one by one,
5131400	5135900	because I do want to make sure in the next 25 minutes or so that we do hit the rest of the
5135900	5142460	content here. And I've got about 20-ish slides left. So with Citrix ShareFile, very similar to
5142460	5148140	Google Drive and Box. The interesting thing about this is that the application, to download it,
5148140	5152680	you had to go through that paywall, or at least a trial registration for businesses only.
5152680	5156300	However, I was able to use a Gmail account and they let me just get in, but there's no free
5156300	5163980	version. Similar to Google File Stream, once you install ShareFile, it creates a virtual volume
5163980	5170700	in FAT32. It mounts as the S drive. All their databases are unencrypted in SQLite format.
5171220	5177980	So they have a list of all the remote files and folders in the remote DB.
5178700	5181540	If you want to see all the files that, and I like how they break it out,
5181540	5185000	if you want to look at all local files that are sitting there in the file system,
5185000	5188800	it's localitem.db. So you've got two different databases, whether it's local,
5188800	5192580	or they're sitting in the cloud. And again, these are things that maybe have never been synced
5193140	5196740	with the end user system, but you can find out what they have access to.
5197340	5202040	And then there's a Citrix files underscore, and then a date.log. And that gives a detailed
5202040	5205780	activity of what things have synced, what files they have access to, and stuff like that.
5205780	5210280	And then similar to Box, there's a part cache directory, where you can gain access to all
5210280	5217120	those cached files. Okay, and don't want to go too much into, again, all the different columns
5217120	5221900	and folders, but it's very similar. We get a lot of unique IDs, and we can map out where things
5221900	5228840	are sitting, what parent directory they're in, and we even have a unique ID. Similar to Box and
5228840	5234020	Google Drive, you have the hash as well, so you get that fingerprint of the file.
5234800	5238300	All right, but they actually have in these remote and the local item database,
5238300	5241520	they have a lot of columns in there, as far as permissions and stuff.
5241520	5245360	I didn't have time to map out what all those permissions meant, whether they were shared,
5245360	5249320	read, write, that kind of stuff. But you get a plethora of information, including even the file
5249320	5256900	size of the different files within Citrix ShareFile. Local items, very similar. You get the
5256900	5261040	hashes, URLs this time, though. What I thought was interesting with this one, though, is that there
5261040	5267420	was a URL within the local item database. It gave a, what I believe to be an instance ID,
5268180	5274420	.sf-api.com, and then some directories and an item ID. I tried to visit those with a browser,
5274420	5280200	and I got nothing. But I do have a feeling, though, that you're able to work with their API,
5280200	5287040	you could probably then, by using this, gain access to some of their files using that API.
5288580	5292600	Okay, and then the directory entry, this really just gives us a parent structure or a structure
5292600	5298500	of where things are. If you look at that Citrix ShareFile underscore date, and then the date.log,
5298500	5302480	these are some things that I've identified as words you might want to parse out for using grep
5302480	5310400	or awk. Upload file, file system notifier, local, win, FSP, delete item, download, upload,
5310400	5314340	read callback, those are all interesting actions when I did those in my lab environment
5314340	5320120	that triggered these log files. So similar to Box, where they had that cache directory,
5320120	5326640	if we go into the part cache, you've got these long gwids or hashes, and within those directories,
5326640	5332420	you're then going to see 0.part. Almost identical to Box, though, if you open that with a
5332420	5338000	hex editor, you're able to see it's an RTF file or a .docx file, sorry. And you just rename the
5338000	5343360	file extension. So 0.docx. And I was able to recover the entire document that way as well.
5344160	5350460	So a couple more things before we dive back into a lab or two. Some other areas that you might be
5350460	5355320	interested in, okay, well, maybe they didn't download the application. So I'm looking at a
5355320	5359960	system that I've either compromised as a offensive security professional or from defensive, I am
5359960	5365880	analyzing this Windows system and trying to figure out what they did or maybe exfiltrated data.
5366500	5372340	Well, sometimes you can use, obviously, these cloud file storing solutions without installing
5372340	5377400	the application. And so if so, there may be evidence of that happening if you go ahead and
5377400	5381640	look in their history, their browsing history. And if we look at their browser history, we can
5381640	5387820	find things like for Google Docs or Google Drive, you're going to see docs.google.com. And we could
5387820	5393340	see whether or not they were viewing or editing spreadsheets, presentations, documents, what type
5393340	5398920	of file they were editing. So we don't get insight to which file, the name of the file, but we will
5398920	5406160	be able to see if they view or edited any types of files in Google Drive. If they go to the root
5406160	5411340	of Google Drive, it's different. So if they're actually editing, it's docs.google.com. If they're
5411340	5418000	just viewing their drive and the folders in them without viewing a specific object, it's drive.google.com
5418000	5424540	slash drive slash my drive. You can also, if they browse to any subdirectories that are in their
5424540	5430860	Google Drive, so the finance or personal folder, their browsing history, you'll see drive.google.com
5430860	5436440	slash drive dash folders. And then if they want to, if they delete something and they look in
5436440	5441040	their trash, you're going to see drive.google.com slash drive slash trash, which meant they have
5441040	5447140	visited their trash can recently. Similarly, if they look at the root directory in Box, you're going to see
5447140	5453000	app.box.com slash folder and the root directory. So once they log in and they just look at all their
5453000	5461000	files and folders, it's zero. Now, if they view in personal version, though, of Box, I'm sorry, of
5461000	5466420	OneDrive, if they're in OneDrive, you're going to see onedrive.live.com slash question mark ID
5466420	5470600	equals root, which means they're in the root. And then you're also going to be able to identify
5470600	5475020	their CID. So if they say, no, it wasn't me that logged in, someone else was on my machine,
5475020	5479880	you can actually map that CID back to see how much activity they're doing on the web versus
5479880	5485340	maybe when you looked at the registry keys and you saw that they had synced OneDrive locally,
5485340	5490300	that's how you can see that that same user was logged in the browser doing stuff in OneDrive
5490300	5496480	as was installed on the application. Dropbox will just give you the root, you'll see slash home.
5496480	5500560	If they go to any other documents or view it with their emulator of like,
5500560	5503960	okay, you can view a Word doc or a PDF or something like that, you're going to see
5503960	5510200	dropbox.com slash SCL. And that tells you that they have viewed things within the web browser.
5511020	5514720	And if they want to go view or they view any contents and other folders, you're just going
5514720	5519440	to see dropbox.com slash home. And then you will see the folder name. So you actually get to see
5519440	5523600	finance operations or whatever the folder name is that they were looking at.
5524640	5527900	So the data that I gave you for the lab environment that we're going to go back to
5527900	5534160	in just a second here, I've got two slides left. The way I extracted that, and it was a new way of
5534160	5538620	doing it for this lab, since we're all virtual, and I didn't want to hand out large VMs. I used
5538740	5544540	a tool called CAPE. And I built a target, which basically says, what do you want to extract?
5545280	5549280	Now, I copied some of the stuff that was in the original target that I looked at where they had
5549280	5556100	some things for OneDrive, and I mimicked that. And I built it out for Dropbox, OneDrive, Box,
5556660	5560140	Citrix share file, and I can't remember which one I missed there, Google Drive.
5560140	5565220	But all five different ones that we've talked about today, the target that I built there,
5565220	5569500	I built that out to extract that. And it does so within about 10 seconds.
5569660	5574560	So if you run CAPE from the command line, you can see, I lied, it was 12 seconds. It's going to
5574560	5581100	pull up all the registry keys, and all those cached files, and anything else that is identified
5581100	5585280	with one of those cloud file storage solutions. Now, if they have tons of data, it might be a
5585280	5590000	little bit longer. But the point is, within 12 seconds, whether I'm on an offensive or defensive
5590700	5596680	engagement, I'm able to exfiltrate, or not exfiltrate, but grab all of that useful information
5596680	5600520	that shows me any type of evidence that they are using those files, and possibly even the
5600520	5606460	cached files that I can recreate. So that brings us into the lab. I think the second lab that we
5606460	5611560	skipped over is going to go ahead and be Google Drive. If you've got to take off, I know it's,
5611560	5615280	you know, I'm here in Los Angeles, it's already 5pm. But if you're on the East Coast,
5615280	5618640	it's probably a bit later, or maybe somewhere else around the world.
5618700	5623680	I encourage you to connect with me on Twitter, and LinkedIn, that's the best way to get a hold of me,
5623680	5629160	and chat in the future. For those of you who are staying around for the next 20 minutes or so,
5629160	5636160	we're going to go ahead, I'll give you about 10 minutes to try the Google Drive lab. And after
5636160	5641080	you try the Google Drive lab, then I'll do a quick walkthrough. So on my screen here, I'm just going
5641080	5646720	to pull up the ones you see which one we're looking at. So it's going to be examining cloud
5646720	5650980	file storage incidents lab, Google Drive, again, just like the other one, you've got the lab
5650980	5655280	instructions. And then if you scroll all the way down, you'll be able to see the detailed walkthrough.
5667430	5673590	Okay, I'll go ahead and do the walkthrough here. So the first instruction says to run
5673590	5681330	DB browser for SQLite. And it's located, in this case, it says C program, DB browser SQLite,
5681330	5690830	but we've got to install that. So let me go down to my installs and get that going.
5702910	5711010	Okay, and then once this loads here and finishes up, we're going to browse to Google Drive, or it's
5711010	5716830	in AppData, local Google Drive, and then user default. And we're looking for the sync config
5716830	5732200	database. Okay, so I'm going to just run DB browser for SQLite. Pin this. Perfect. Okay, so we're
5732200	5745440	open database. I'm going to go to my downloads, evidence, and C drive, users. Oops, sorry.
5745740	5758140	Windows, system 32. No, I am all messed up here. I apologize. C, users, Bob, AppData, local,
5758940	5766020	Google, Drive, user defaults. And then within here, that's where I'm looking for the sync config.
5766240	5772280	So I've got that database, I open it up and expand this out a little bit.
5775070	5780490	Okay, and then we go down the instructions here, we're going to look for, click on the browse
5781290	5788890	data tab. So if we click over here, browse data, we get a better view of everything that's going on.
5789290	5799300	Expand this out a little bit. Okay. And so the first question is, what is the data value for
5799300	5803580	the following? So we're looking for the highest application version, local sync route path and
5803580	5809360	user email. So we can see here, this is the version of Google Drive that was installed
5809360	5813000	on the machine that we're looking at. So again, we can look for vulnerabilities, we can
5813720	5818760	match it up to the system, whatever the use case is. And then local sync route path.
5825260	5831280	Oops, I messed that up. Local sync route path, here we see it is cusers, Bob, Google Drive.
5831280	5837260	And then for email, we see it's bob.mckley.re.gmail.com. It's the same one that the HR had in
5837260	5845400	their file. Step two is we're going to browse to Cloud Graph. So I'm going to go open a new database
5846940	5854220	and within Drive, it's user defaults, Cloud Graph, cloudgraph.db.
5855800	5857960	And I don't want to save changes.
5860060	5865180	Now on this one, I'm going to have to change the table here. And so it tells me to go to the
5865180	5872660	Cloud Graph entry table. So click on that one. And then from here, we want to know what's the
5872660	5879260	file name for doc type six. So I'm looking for doc type six here, I see one that's this one.
5879260	5885000	So it's a remember from, what was it, three to 12 or 13. Those are Google formatted documents.
5885600	5889320	And I'm gonna expand this file name to see what this file was called.
5890840	5894960	Ways to tell your boss you're leaving. That sounds suspicious, something you might want
5894960	5901180	to look into a little bit more. Okay, and then let me look down for
5906600	5913440	here. And then we want to look at what type that was. Obviously, we can go back to the slides and
5913440	5919180	see that that was a Google formatted doc. And we want to look at the modified date for a file
5919900	5927960	of where the file type was six. So I can scroll over modified date, right this date, though,
5927960	5936660	we're gonna want to copy this. And let me go ahead and do this. I'm just going to open up Google here.
5943440	5951680	And I convert this, we could see the exact time. I'm going to paste in the time that we got.
5952480	5959540	And it's going to tell us both are my local time as well as UTC or GMT. If we're looking at GMT,
5959540	5966340	it was Friday, April 17 2020 601 25am. And that's something that we're going to want to go ahead and
5966340	5972880	look at. And so even if we look at local time, though, for me, it was at 1101pm. So if this is
5973020	5977680	a work machine, why are they the file name was tell your how to tell your boss you're leaving.
5977680	5981420	And I believe this was the night before I believe on the 17th the morning of
5982600	5988200	Bob McClee put in notice. So at 11pm was looking for ways to find bosses leaving.
5990540	6001510	Okay, then we've got on the scroll down my tutorials.
6007470	6013390	Catch up. Okay. And then after we converted that our next step or question is further examine the
6013390	6019570	file. examination of file name column and database uncovers additional documents of interest,
6019570	6027350	for example, Doc ID one, or one MP, blah, blah, blah. One was the document last modified. So
6028270	6034650	I'm looking over here, there's one that we want to look at one MP. So I'm looking here one and
6039080	6043000	this one here. And it says resignation letter ready dot
6043000	6048880	RTF. And so we want to look here at the modified time and copy this again.
6049880	6052880	I'm going to go back over to Google.
6054820	6056240	pop this in
6057740	6066840	convert and it looks like Friday, April 17 617 am. So oops, something scrolling way down.
6067040	6072000	So it looks like the morning of right putting resignation around maybe eight or 9am when
6072000	6077320	everyone came in the morning of on the work machine, this this document was modified.
6077860	6081640	Or at least Yeah, last modified. So we don't know what it originally had. But obviously,
6081640	6087080	it says it's ready to go. And we saw the resignation letter come in on the 17th in the morning.
6088500	6089940	Go back.
6092000	6098040	Next step is to what is the hash for the file file name client list. So if we look for the
6098040	6106420	file here called client list in row 12 can scroll over and now we get the file hash here.
6106420	6110180	And this might be important because we may see changes along the way. Maybe we look at the
6110180	6115220	cached version and it's different than this. And maybe we want to verify this, this is the client
6115220	6120580	list that he stole or that we have in our file server. So we might want to copy that hash down.
6123140	6126500	Okay, next piece is that we are going to open up the sync log.
6126500	6137060	So I'll minimize this, we'll go over here. And go to my downloads, go to the evidence we've
6137060	6152340	collected, click in there, see, and users, Bob, app data, local, Google, drive, and then user
6152600	6161960	default. And then within here, we should see the we're looking for sync log. This one open up and
6161960	6170920	expand that a little bigger for you. And within here, again, ideally, you do something like
6170920	6177360	Sumo logic or some other tool to parse this out. We want to look at where did the file originate
6177360	6184640	from. And, and we're looking for specific things like resignation letter. So I want to see when
6184640	6197960	things were synced and changed here. So let me do a search and find and I'm going to search for
6198600	6210480	resignation letter. Okay, and then here, we see that close this out.
6211540	6218040	Right, so we get the date and the time all the way on the far left there was the 16 2235, at least
6218040	6226120	local time. Over here, we see receive change directions upload. So the user on this system
6226120	6232640	that the work machine, the file was changed. And then this, the changes were synced or uploaded to
6232640	6240500	the cloud and matches the file name. And look at this resignation draft, we saw resignation
6240500	6245200	letter ready. So this might have been changed around that time. Originally, it was in draft
6245200	6253500	format, and the user changed that. And sometimes we also get hashes here as well. Okay, but it was
6253540	6259360	a local system. So it was the direction was upload, they made that change locally, it got synced up.
6260500	6270060	Next question is, we want to find all for all instances of this. And again,
6270060	6276480	some other parsing tools better. But if I go here to search, and I type find again,
6276480	6281960	and I do find all in open document, this is going to give us a list. And I don't know how to make
6281960	6289440	this bigger for you. But we can see here all the different times that resignation letter was
6290780	6294960	was in here. But basically, what I would do in a much better way with some other tools,
6294960	6300840	I'm looking here for the name resignation letter draft, draft, draft,
6302600	6307840	draft, and I want to kind of find down here where it's changed from draft. So I see ready down here,
6307840	6311420	I don't want to spend all the time doing this. But I'm going to look for the line item where it
6311420	6316840	says draft, and then the next one says ready. And that's going to tell us when that change was made,
6316840	6322460	where they renamed the file, and now it's ready. Okay, and then
6325520	6333160	next step, we go back to SQL Lite. And we look for an inode ID for an office lease. I know we're
6333160	6338300	pretty much out of time there. So I know all the other steps are in the detailed walkthrough. If
6338300	6341960	you want any of that, I did want to give a couple of minutes for questions before I've got to leave
6341960	6346800	and be respectful of everyone's time. So again, there's a couple more steps to that lab, but you
6346800	6352000	can look through those we didn't get to the box lab. But you can absolutely go through those and
6352000	6356020	hit me up on LinkedIn if you have any questions around that. So I'm going to switch back to my
6356500	6360640	slides and see one more time. If there's any questions, I also want to give a big shout out
6360640	6367260	and thanks to all the people at the cloud village, the ones that you heard vocally, but then there's
6367260	6373100	tons of people on the back end who have made this possible and obviously for free. So big
6373100	6375000	thanks to them and thank you for having me here.