This is a series of blog articles that utilize the SIFT Workstation. The free SIFT workstation, can match any modern forensic tool suite, is also directly featured and taught in SANS' Advanced Computer Forensic Analysis and Incident Response course (FOR 508). SIFT demonstrates that advanced investigations and responding to intrusions can be accomplished using cutting-edge open-source tools that are freely available and frequently updated.

The SIFT Workstation is a VMware appliance, pre-configured with the necessary tools to perform detailed digital forensic examination in a variety of settings. It is compatible with Expert Witness Format (E01), Advanced Forensic Format (AFF), and raw (dd) evidence formats.

Super-Timeline Background

I first started teaching timeline analysis back in 2000 when I first started teaching for SANS. It was in my first SANS@Night presentation I gave in Dec 2000 at what was then called "Capitol SANS" and I demonstrated a tool I wrote called mac_daddy.pl based off of the TCT tool mactime. Since that point every certified GCFA has answered test questions on timeline analysis.

We have reached a new resurgence in timeline analysis thanks to Kristinn Gudjonsson and his tool log2timeline. Kristinn's work in the timeline analysis field will probably change the way many of you approach cases.

First of all, all of these tools will be found in the SIFT Workstation are ready to go out of the box, but you can keep them up to date at Kristinn's website www.log2timeline.net. Kristinn's tool was also recently added to the FOR508: Advanced Computer Forensic Analysis and Incident Response course last year and has already been taught to hundreds analysts who are now using it in the field daily.

Kristinn's log2timeline tool will parse all of the following data structures and more through AUTOMATICALLY recursing through the directories for you instead of having to manually accomplish this.

This is a list of the currently available formats log2timeline is able to parse. The tool is being constantly updated so to get the current list of available input modules it is possible to let the tool print out a list:

# log2timeline -f list

Artifacts Automatically Parsed in a SUPER Timeline:

How to automatically create a SUPER Timeline

log2timeline-sift recursively scans through an evidence image (physical or partition) and extracts artifact timestamp data gathered from the evidence that the tool log2timeline supports (see artifacts above). This tutorial will step a user who is interested in creating their first timeline from start to finish.

Step 0 — Use the SIFT Workstation Distro

Download Latest SIFT Workstation Virtual Machine Distro: http://computer-forensics.sans.org/community/downloads

It is recommended that you use VMware Player for PCs and VMware Fusion for MACs. Alternatively, you can install the SIFT workstation in any virtual machine or direct hardware using the downloadable ISO image as well.

Launch the SIFT workstation and login to the console by using the password "forensics".

Step 1 — Identify your evidence and gain access to it in the SIFT Workstation

The files used in this example.

• Scenario and Case Goals-> http://digitalcorpora.org/corp/images/nps/nps-2008-jean/M57-Jean.pdf
• Image 1 ->http://digitalcorpora.org/corp/images/nps/nps-2008-jean/nps-2008-jean.E01
• Image 2 -> http://digitalcorpora.org/corp/images/nps/nps-2008-jean/nps-2008-jean.E02

Link your evidence files to the SIFT Workstation through the Windows File Share that is enabled by default in the /cases directory. Either you can plug in a USB drive, mount a remote drive share, or copy the evidence to your /cases/ directory.

It should be noted that the design of the SIFT workstation has a separate drive for the /cases directory to allow for a larger virtual drive or you can connect it to an actual hard drive as well that you mount at the /cases directory.

Open in Explorer \\siftworkstation\cases\EXAMPLE-DIR-YYYYMMDD-###

If your evidence is a E01 then use this previous article on the topic to mount it correctly inside the SIFT workstation. If your evidence is RAW go ahead and skip to STEP 2. Access to the raw image is required as log2timeline-sift cannot parse E01 files... yet.

http://computer-forensics.sans.org/blog/2011/11/28/digital-forensic-sifting-mounting-ewf-or-e01-evidence-image-files

• $ sudo su —
• # cd /cases/EXAMPLE-DIR-YYYMMDD-####/
• # mount_ewf.py nps-2008-jean.E01 /mnt/ewf
• # cd /mnt/ewf

Note the commands that are inputted by the forensicator are highlighted in the blue outlined box.

Step 2 — Create The Super Timeline

Manual creation of a timeline is challenging and still requires some work to get through. We have included in the SIFT Workstation an automated method of generating a timeline via the new log2timeline-sift tool that can simply be pointed at a disk image (raw disk). Again, If you are examining an E01 or AFF file, please mount it first using mount_ewf.py or affuse respectively.

Creating a Super Timeline requires you to know whether or not your evidence image is a Physical or a Partition Image. A Physical image will include the entire disk image and can be parsed by the tool mmls to list the partitions. A Partition image will be the actual filesystem (e.g. NTFS) and can be parsed by the tool fsstat to list information about the partition.

Using log2timeline-sift is actually quite simple to use with very few options.

Once you have figured out if you have a physical disk image or a partition image, then choose the correct implementation of the command to run with the correct timezone.

Critical Failure Point Note: There is much confusion over what exactly the (-z) timezone option is used for. This is the timezone of the SYSTEM. The timezone is used to baseline convert time based data that is stored in "local" time to UTC time. Without telling log2timeline-sift the correct timezone of the system your timeline data will likely be off. Your output of the data will be in the same timezone as you inputted for log2timeline-sift. I do know Kristinn, log2timeline's developer, is working on a possible -Z (big Z) option that can specific the output timezone desired, but it is not currently implemented.

If your timezone includes areas that have daylight savings time, it is important to use the correct location. For example, on the East Coast, the correct implementation of daylight savings for the timezone value would be EST5EDT. For Mountain time it would be MST7MDT and so forth. If you do not use this data, any local time data that is set using daylight savings time will also be off.

In summary: It is crucial that the -z option matches the way the system is configured to produce accurate results.

TIMEZONE LISTINGS: http://www.cs.berkeley.edu/CT/ag4.0/appendid.htm

When you first run the log2timeline-sift command against your image. If it is not mounted, it will first ask you if you want to mount it and follow up with asking which specific partition needs to be mounted to have log2timeline-sift parse.

log2timeline-sift will now automatically parse through all of the structures to pull out a full timeline of the image. Note that processing errors are normal and expected as the tool will attempt to look for structures that may or may not exist.

Once log2timeline-sift has completed, you will find the final timeline as a text (.txt) file in the /cases/timeline-output-folder. To do a quick sort and to prepare the timeline for examination in EXCEL 2007 or higher use l2t_process.

Step 3 - Open the Timeline in EXCEL

Open your timeline up in Excel 2007 or higher and begin to examine around the time of your event. You will now see all of the data sorted and in order. I generally use excel so I can hide columns and rows easily and mark data that is particularly interesting.

Now open the file using EXCEL 2007 or higher to examine/parse.

CONGRATS!

You just created your first SUPER Timeline... now you get to analyze thousands of entries! (Wha???)

In another upcming article, I will discuss how to parse and reduce the timeline efficiently so you can analyze the data easier. SUPER-TIMELINES obtain much data from your operating system, but learning how to parse it into something useable is extremely valuable. In my SANS360 talk, I will take this technique even further. Of course, we go through all these techniques in our full training courses at SANS specifically FOR508: Advanced Computer Forensic Analysis and Incident Response.

There is another article planned on creating MICRO-TIMELINES using log2timeline when you do not want to parse the entire filesystem image.

Keep Fighting Crime!

Rob Lee has over 15 years of experience in digital forensics, vulnerability discovery, intrusion detection and incident response. Rob is the lead course author and faculty fellow for the computer forensic courses at the SANS Institute and lead author for FOR408 Windows Forensics and FOR508 Advanced Computer Forensics Analysis and Incident Response.