tool names 1 vision 2 pasco 3 galleta
Download
Skip this Video
Download Presentation
Tool Names: 1. VISION 2. PASCO 3. GALLETA

Loading in 2 Seconds...

play fullscreen
1 / 38

Tool Names: 1. VISION 2. PASCO 3. GALLETA - PowerPoint PPT Presentation


  • 121 Views
  • Uploaded on

Tool Names: 1. VISION 2. PASCO 3. GALLETA. Tool 1 VISION. Overview. Tool Description Where You Can Find it Applicability to Forensics Tool Use/Screen Views Observations Lessons Learned. Technical Description: VISION. This Tool provides the following:

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha
Download Presentation

PowerPoint Slideshow about ' Tool Names: 1. VISION 2. PASCO 3. GALLETA' - merrill-bean


An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
overview
Overview
  • Tool Description
  • Where You Can Find it
  • Applicability to Forensics
  • Tool Use/Screen Views
  • Observations
  • Lessons Learned

UTSA IS 6353 Incident Response

technical description vision
Technical Description: VISION
  • This Tool provides the following:
    • Shows all of the open TCP and UDP ports on a machine.
    • Displays the service that is active on each port.
    • Maps the ports to their respective applications.
    • Large amount of supplementary information that is useful for determining host status by displaying detailed system information, applications running, as well as processes and ports in use

UTSA IS 6353 Incident Response

where to find the tools
Where to Find the Tools
  • www.foundstone.com
  • Featured in the free tools.
  • Information about Vision provided at www.foundstone.com/resources/proddesc/vision.htm

UTSA IS 6353 Incident Response

how the tool supports forensics
How The Tool Supports Forensics
  • Vision supports live analysis on a host.
  • Vision is a Host based forensic utility.
  • And it allows a forensic investigator to interrogate ports and identify potential “Trojan” services.
  • This tool supports “Incident Response” more than “Forensic Analysis”.

UTSA IS 6353 Incident Response

tool use
Tool Use
  • Vision is a windows GUI based application.
  • After launching, the application runs in the background and is located in the system tray.
  • Interval for “Auto-Refresh” can be specified in the options.
  • Vision can be used to log all the entries into a CSV file.

UTSA IS 6353 Incident Response

observations
Observations
  • Easy to download
  • Easy to Install (Windows Installer and easy configuration)
  • Free tool
  • Easy to use navigation menus. Sub-menus can collapse and expand. A single view can represent a LOT of information.

UTSA IS 6353 Incident Response

lessons learned
Lessons Learned
  • Doesn’t work on Windows 98, Me
  • Requires ‘psapi.dll’ on Windows NT.
  • Single comprehensive tool which performs the functions of tools like ‘fport’ and ‘pstools’.
  • CSV log file can be a good resource for future reference.

UTSA IS 6353 Incident Response

technical description of pasco
Technical Description of Pasco
  • This Tool provides the following:
    • Command line utility that parses information in the IE activity files (index.dat).
    • Index.dat files are in binary form and special tools, like Pasco, are required to view them.
    • Pasco is built to work on multiple platforms and will execute on Windows (through Cygwin), Mac OS X,Linux, and *BSD platforms.

UTSA IS 6353 Incident Response

technical description of pasco1
Technical Description of Pasco
  • Relevant Fields in index.dat header

UTSA IS 6353 Incident Response

how pasco supports forensics
How Pasco Supports Forensics
  • This Tool supports off-line analysis
  • Allows a forensic investigator to reconstruct a subject’s web browsing habit.
  • Provide evidentiary material for abuse of internet corporate usage policies, pornographic content, other illegal activities.

UTSA IS 6353 Incident Response

where to find pasco
Where to Find Pasco
  • On the web
    • Free utility
    • www.foundstone.com
  • Loaded on my directory
    • D:\Pasco

UTSA IS 6353 Incident Response

tool use1
Tool Use
  • For Windows, must first install CYGWIN – a Linux like environment for Windows.
    • Cygwin can be found at http://sources.redhat.com/cygwin/
  • Download and install Pasco from Foundstone site.
  • Search for index.dat files on system and copy into D:\pasco\bin.

UTSA IS 6353 Incident Response

tool use2
Tool Use
  • For Windows XP, index.dat file can be found at these locations or do a search:

UTSA IS 6353 Incident Response

tool use3
Tool Use
  • Pasco Usage:

pasco [options] index.dat file to be parsed > output file.txt

Options:

-d Undelete Activity Records-t Field Delimiter (TAB by default)

UTSA IS 6353 Incident Response

tool use4
Tool Use
  • Command line
    • Execute default mode of Pasco
      • $ ./pasco tif.dat > tif.txt

(Parse the index.dat file and output result to index.txt file)

    • Execute undeletion mode of Pasco
      • $ ./pasco –d –t , tif.dat > tifdtoptions.txt

UTSA IS 6353 Incident Response

slide24

Typical command line usage of Pasco.

UTSA IS 6353 Incident Response

slide25

Text file output from Pasco.

UTSA IS 6353 Incident Response

slide26

Text file output from Pasco exported into

spreadsheet for further analysis.

UTSA IS 6353 Incident Response

observations1
Observations
  • Easy to download
    • Small download – 460 Kb zipped file
  • Easy to Install
    • For Windows must first install CYGWIN
  • Simple command line use
    • Only two options available
  • Can be use to parse cookies and history index.dat files as well
  • White paper available for in-depth technical approach to Pasco development
    • http://www.foundstone.com/pdf/wp_index_dat.pdf

UTSA IS 6353 Incident Response

lessons learned1
Lessons Learned
  • Works better when index.dat file is copied into wherever Pasco directory is located .
  • Run both default and undeletion mode to make sure no entries are missed.

UTSA IS 6353 Incident Response

technical description galleta
Technical Description: Galleta
  • Galleta provides the following:
    • Internet Cookie analysis utility
      • Parses the contents of a Windows cookie file and outputs the result to a tab delimited file
    • Small download (<500Kb)
    • Requires CYGWIN to run
      • UNIX Bash Shell

UTSA IS 6353 Incident Response

where to find the tools1
Where to Find the Tools
  • CYGWIN installs to the root directory
    • www.cygwin.com
    • Large download (6.5MB)
    • Install from Internet
  • Galleta installs in Program Files directory or wherever you put it
    • www.foundstone.com/resources/proddesc/galleta.html

UTSA IS 6353 Incident Response

how the tool supports forensics1
How The Tool Supports Forensics
  • Galleta supports off-line analysis
    • Tedious, cumbersome
  • Recovers the contents of a single Internet cookie file
  • Allows the investigator to categorize and/or sort cookies within Excel

UTSA IS 6353 Incident Response

tool use5
Tool Use
  • Start CYGWIN
    • STARTAll ProgramsCYGWINCYGWIN Bash Shell
  • Change directories to the location where the Internet cookies are
    • Put the Galleta executable file in this same directory
  • From the UNIX prompt in CYGWIN type:
    • ./galleta cookiename.txt > newname.txt

UTSA IS 6353 Incident Response

observations2
Observations
  • Easy to download
  • Easy to Install
  • Command line use was cryptic depending on level of experience
  • No Help support
  • Don’t forget to download CYGWIN
  • Very labor intensive

UTSA IS 6353 Incident Response

lessons learned2
Lessons Learned
  • Watch out for location of Galleta executable
  • UNIX tool that works in Windows via CYGWIN
  • Best used in conjunction with string search utility (Pasco) to isolate questionable cookies

UTSA IS 6353 Incident Response

ad