SlideShare a Scribd company logo
TOR BROWSER FORENSICS ON WINDOWS OS
MATTIA EPIFANI, FRANCESCO PICASSO, MARCO SCARITO, CLAUDIA MEDA
DFRWS 2015
DUBLIN, 24 MARCH 2015
REAL CASE
 Management salaries of a private company were published on a Blog
 Through an analysis of the internal network, we found a possible suspect
because he accessed the Excel file containing the salaries the day before
the publication
 Company asked us to analyze the employee laptop
 We found evidences that confirm that the Excel file was opened [LNK,
Jumplist, ShellBags]
 But no traces were found in browsing history about the publishing
activity on the blog…
PREVIOUS RESEARCH
 An interesting research by Runa Sandvik is available at
Forensic Analysis of theTor Browser Bundle on OS X, Linux,
and Windows
https://research.torproject.org/techreports/tbb-forensic-analysis-2013-06-28.pdf
 We started from her work to find other interesting artifacts
TOR BROWSER – MICROSOFT WINDOWS
Version
4.0.2
TOR BROWSER FOLDER
 The most interesting folders are located in Tor BrowserBrowserTor Browser:
DataTor DataBrowserprofile.default
FOLDER DATATOR
 State: it contains the last execution date
 Torrc: it contains the path from where the Tor Browser was launched with the
drive letter
FOLDER DATABROWSERPROFILE.DEFAULT
 The traditional Firefox folder containing the user profile without usage traces
 The most interesting files:
 Compatibility.ini
 Extension.ini
• Browser execution path
• Date Created  First execution
• Date Modified  Last execution
OS ARTIFACTS ANALYSIS
 Evidence of TOR usage can be found (mainly) in:
 Prefetch file TORBROWSERINSTALL-<VERSION>-<PATH-HASH>.pf
 Prefetch file TOR.EXE-<PATH-HASH>.pf
 Prefetch file FIREFOX.EXE-<PATH-HASH>.pf
 Prefetch file START TOR BROWSER.EXE-<PATH-HASH>.pf (old version < 4.0.2)
 NTUSER.DAT registry hive  User Assist key
 Windows Search Database
 Thumbnail cache
PREFETCH FILES
 We can recover:
 First execution date
 Last execution date
 In Windows 8/8.1  Last 8 executions
 Number of executions
 Execution Path
 Install date (from Tor Browser Install prefetch file)
 Tor Browser version (from Tor Browser Install prefetch file)
USER ASSIST
 We can recover:
 Last execution date
 Number of executions
 Execution path
 By analyzing various NTUSER.DAT
from VSS we can identify the
number and time of execution in
a period of interest
OTHER ARTIFACTS ON THE HARD DRIVE
Other files noted:
Thumbnail Cache
It contains the TOR Browser icon
Windows Search Database
Tor Browser files and folders path
BROWSING ACTIVITIES
Evidence of browsing activities can be found in:
 Bookmarks (places.sqlite database)
 Pagefile.sys
 Memory Dump / Hiberfil.sys
BOOKMARKS
User saved bookmarks:
PAGEFILE.SYS
Information about visited websites
Search for the keyword
HTTP-memory-only-PB
HTTP-MEMORY-ONLY-PB
 A function used by Mozilla Firefox for Private Browsing (not saving cache
data on the hard drive)
 Tor Browser uses the Private Browsing feature of Mozilla Firefox
 But Tor Browser typically uses an old Firefox version, based on Firefox
ESR
 To distinguish if the browsing activity was made with Mozilla Firefox or
with Tor Browser:
 Check if Firefox is installed
 If it is installed, verify the actual version
PAGEFILE.SYS - EXAMPLE
ANALYSIS METHODOLOGY
• Install date
• First execution date
• Last execution date(s)
• Number of executions
• Tor Browser version
Prefetch files
• Execution path
• Last execution date
• Total number of executions
• Verify the history of execution through theVolume Shadow
Copies
NTUSERUserAssist key
• Thumbnail Cache
• Windows Search Database
Other possible artifacts
•State
•Torrc
•Compatibility.ini
•Extension.ini
•Places.sqlite [Bookmarks]
Tor Browser Files
•HTTP-memory-only-PB
•Torproject
•Tor
•Torrc
•Geoip
•Torbutton
•Tor-launcher
Pagefile.sys
(keywords search)
• Convert to a memory dump
• Analyze through
• Volatility
• Keywords search
Hiberfil.sys
REAL CASE
 We indexed the hard drive and searched for the blog URL
 We found some interesting URLs in the pagefile, indicating the
access to the Blog Admin page
(http://www. blognameblabla.com/wp-admin/)
REAL CASE
 All the URLs were preceded by the string HTTP-MEMORY-
ONLY-PB and Firefox is not installed on the laptop
 We found that the TOR Browser was downloaded with Google
Chrome the night in which the file was published on the blog
 By analyzing the OS artifacts we found that it was installed and
only executed once, 3 minutes before the publish date and
time on the blog
ACTIVE RESEARCHES
 Memory Dump with Volatility and Rekall
 Can we find any temporal reference for browsing
activities?
 Can we correlate Tor Browser cache entries to carved
files from pagefile/hiberfil/memory dump?
 Tor Browser on Mac OS X
 Tor Browser on Linux
 Orbot on Android
Q&A?
Mattia Epifani
 Digital Forensics Analyst
 CEO @ REALITY NET – System Solutions
 GCFA, GMOB, GNFA, GREM
 CEH, CHFI, CCE, CIFI, ECCE,AME,ACE, MPSC
Mail mattia.epifani@realitynet.it
Twitter @mattiaep
Linkedin http://www.linkedin.com/in/mattiaepifani
Web http://www.realitynet.it
Blog http://blog.digital-forensics.it
http://mattiaep.blogspot.it

More Related Content

What's hot

Cloud-forensics
Cloud-forensicsCloud-forensics
Cloud-forensics
anupriti
 
Cyber Forensics Overview
Cyber Forensics OverviewCyber Forensics Overview
Cyber Forensics Overview
Yansi Keim
 
Intrusion detection
Intrusion detectionIntrusion detection
Intrusion detection
CAS
 
Detection Rules Coverage
Detection Rules CoverageDetection Rules Coverage
Detection Rules Coverage
Sunny Neo
 
Computer forensic ppt
Computer forensic pptComputer forensic ppt
Computer forensic ppt
Priya Manik
 
Introduction Network security
Introduction Network securityIntroduction Network security
Introduction Network security
IGZ Software house
 
Digital Evidence by Raghu Khimani
Digital Evidence by Raghu KhimaniDigital Evidence by Raghu Khimani
Digital Evidence by Raghu Khimani
Dr Raghu Khimani
 
Cyber forensic 1
Cyber forensic 1Cyber forensic 1
Cyber forensic 1
anilinvns
 
Pen test methodology
Pen test methodologyPen test methodology
Pen test methodology
Cahyo Darujati
 
Database forensics
Database forensicsDatabase forensics
Database forensics
Denys A. Flores, PhD
 
Cloud Forensics
Cloud ForensicsCloud Forensics
Cloud Forensics
sdavis532
 
Computer forensics ppt
Computer forensics pptComputer forensics ppt
Computer forensics ppt
Nikhil Mashruwala
 
Security tools
Security toolsSecurity tools
Security tools
arfan shahzad
 
Malware Analysis
Malware AnalysisMalware Analysis
Malware Analysis
Prashant Gupta
 
OSINT Social Media Techniques - Macau social mediat lc
OSINT Social Media Techniques - Macau social mediat lc OSINT Social Media Techniques - Macau social mediat lc
OSINT Social Media Techniques - Macau social mediat lc
Cyber Threat Intelligence Network
 
Cyber crime
Cyber crimeCyber crime
Cyber crime
Harendra Singh
 
Hunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentHunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows Environment
Teymur Kheirkhabarov
 
Computer forensics and Investigation
Computer forensics and InvestigationComputer forensics and Investigation
Computer forensics and Investigation
Neha Raju k
 
Browser forensics
Browser forensicsBrowser forensics
Browser forensics
Prince Boonlia
 
Ransomware: History, Analysis, & Mitigation - PDF
Ransomware: History, Analysis, & Mitigation - PDFRansomware: History, Analysis, & Mitigation - PDF
Ransomware: History, Analysis, & Mitigation - PDF
Andy Thompson
 

What's hot (20)

Cloud-forensics
Cloud-forensicsCloud-forensics
Cloud-forensics
 
Cyber Forensics Overview
Cyber Forensics OverviewCyber Forensics Overview
Cyber Forensics Overview
 
Intrusion detection
Intrusion detectionIntrusion detection
Intrusion detection
 
Detection Rules Coverage
Detection Rules CoverageDetection Rules Coverage
Detection Rules Coverage
 
Computer forensic ppt
Computer forensic pptComputer forensic ppt
Computer forensic ppt
 
Introduction Network security
Introduction Network securityIntroduction Network security
Introduction Network security
 
Digital Evidence by Raghu Khimani
Digital Evidence by Raghu KhimaniDigital Evidence by Raghu Khimani
Digital Evidence by Raghu Khimani
 
Cyber forensic 1
Cyber forensic 1Cyber forensic 1
Cyber forensic 1
 
Pen test methodology
Pen test methodologyPen test methodology
Pen test methodology
 
Database forensics
Database forensicsDatabase forensics
Database forensics
 
Cloud Forensics
Cloud ForensicsCloud Forensics
Cloud Forensics
 
Computer forensics ppt
Computer forensics pptComputer forensics ppt
Computer forensics ppt
 
Security tools
Security toolsSecurity tools
Security tools
 
Malware Analysis
Malware AnalysisMalware Analysis
Malware Analysis
 
OSINT Social Media Techniques - Macau social mediat lc
OSINT Social Media Techniques - Macau social mediat lc OSINT Social Media Techniques - Macau social mediat lc
OSINT Social Media Techniques - Macau social mediat lc
 
Cyber crime
Cyber crimeCyber crime
Cyber crime
 
Hunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentHunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows Environment
 
Computer forensics and Investigation
Computer forensics and InvestigationComputer forensics and Investigation
Computer forensics and Investigation
 
Browser forensics
Browser forensicsBrowser forensics
Browser forensics
 
Ransomware: History, Analysis, & Mitigation - PDF
Ransomware: History, Analysis, & Mitigation - PDFRansomware: History, Analysis, & Mitigation - PDF
Ransomware: History, Analysis, & Mitigation - PDF
 

Similar to Tor Browser Forensics on Windows OS

deftcon 2015 - Epifani, Picasso, Scarito, Meda - Tor Browser forensics on Win...
deftcon 2015 - Epifani, Picasso, Scarito, Meda - Tor Browser forensics on Win...deftcon 2015 - Epifani, Picasso, Scarito, Meda - Tor Browser forensics on Win...
deftcon 2015 - Epifani, Picasso, Scarito, Meda - Tor Browser forensics on Win...
Deft Association
 
SANS Windows Artifact Analysis 2012
SANS Windows Artifact Analysis 2012SANS Windows Artifact Analysis 2012
SANS Windows Artifact Analysis 2012
Rian Yulian
 
Disk forensics for the lazy and the smart
Disk forensics for the lazy and the smartDisk forensics for the lazy and the smart
Disk forensics for the lazy and the smart
Jeff Beley
 
AntiForensics - Leveraging OS and File System Artifacts.pdf
AntiForensics - Leveraging OS and File System Artifacts.pdfAntiForensics - Leveraging OS and File System Artifacts.pdf
AntiForensics - Leveraging OS and File System Artifacts.pdf
ekobelasting
 
Chetan-Mining_Digital_Evidence_in_Microsoft_Windows
Chetan-Mining_Digital_Evidence_in_Microsoft_WindowsChetan-Mining_Digital_Evidence_in_Microsoft_Windows
Chetan-Mining_Digital_Evidence_in_Microsoft_Windows
guest66dc5f
 
Operating System Forensics
Operating System ForensicsOperating System Forensics
Operating System Forensics
ArunJS5
 
OSDF 2013 - Autopsy 3: Extensible Desktop Forensics by Brian Carrier
OSDF 2013 - Autopsy 3: Extensible Desktop Forensics by Brian CarrierOSDF 2013 - Autopsy 3: Extensible Desktop Forensics by Brian Carrier
OSDF 2013 - Autopsy 3: Extensible Desktop Forensics by Brian Carrier
Basis Technology
 
BP301: Q: What’s Your Second Most Valuable Asset and Nearly Doubles Every Year?
BP301: Q: What’s Your Second Most Valuable Asset and Nearly Doubles Every Year? BP301: Q: What’s Your Second Most Valuable Asset and Nearly Doubles Every Year?
BP301: Q: What’s Your Second Most Valuable Asset and Nearly Doubles Every Year?
panagenda
 
WindowsRegistry.ppt
WindowsRegistry.pptWindowsRegistry.ppt
WindowsRegistry.ppt
AliAshraf68199
 
4055-841_Project_ShailendraSadh
4055-841_Project_ShailendraSadh4055-841_Project_ShailendraSadh
4055-841_Project_ShailendraSadh
Shailendra Sadh - CISSP
 
Kealy OWASP interactive_artifacts
Kealy OWASP interactive_artifactsKealy OWASP interactive_artifacts
Kealy OWASP interactive_artifacts
Frank Victory
 
Windowsforensics
WindowsforensicsWindowsforensics
Windowsforensics
Santosh Khadsare
 
Introduction To Unix
Introduction To UnixIntroduction To Unix
Introduction To Unix
CTIN
 
Linux
LinuxLinux
Computer forensics libin
Computer forensics   libinComputer forensics   libin
Computer forensics libin
libinp
 
14(1) 005
14(1) 00514(1) 005
14(1) 005
phanleson
 
Strategies to design FUD malware
Strategies to design FUD malwareStrategies to design FUD malware
Strategies to design FUD malware
Pedro Tavares
 
Windows forensic
Windows forensicWindows forensic
Windows forensic
MD SAQUIB KHAN
 
Autopsy Digital forensics tool
Autopsy Digital forensics toolAutopsy Digital forensics tool
Autopsy Digital forensics tool
Sreekanth Narendran
 
What Are You Looking ForThe variety of operating systems, appli.docx
What Are You Looking ForThe variety of operating systems, appli.docxWhat Are You Looking ForThe variety of operating systems, appli.docx
What Are You Looking ForThe variety of operating systems, appli.docx
alanfhall8953
 

Similar to Tor Browser Forensics on Windows OS (20)

deftcon 2015 - Epifani, Picasso, Scarito, Meda - Tor Browser forensics on Win...
deftcon 2015 - Epifani, Picasso, Scarito, Meda - Tor Browser forensics on Win...deftcon 2015 - Epifani, Picasso, Scarito, Meda - Tor Browser forensics on Win...
deftcon 2015 - Epifani, Picasso, Scarito, Meda - Tor Browser forensics on Win...
 
SANS Windows Artifact Analysis 2012
SANS Windows Artifact Analysis 2012SANS Windows Artifact Analysis 2012
SANS Windows Artifact Analysis 2012
 
Disk forensics for the lazy and the smart
Disk forensics for the lazy and the smartDisk forensics for the lazy and the smart
Disk forensics for the lazy and the smart
 
AntiForensics - Leveraging OS and File System Artifacts.pdf
AntiForensics - Leveraging OS and File System Artifacts.pdfAntiForensics - Leveraging OS and File System Artifacts.pdf
AntiForensics - Leveraging OS and File System Artifacts.pdf
 
Chetan-Mining_Digital_Evidence_in_Microsoft_Windows
Chetan-Mining_Digital_Evidence_in_Microsoft_WindowsChetan-Mining_Digital_Evidence_in_Microsoft_Windows
Chetan-Mining_Digital_Evidence_in_Microsoft_Windows
 
Operating System Forensics
Operating System ForensicsOperating System Forensics
Operating System Forensics
 
OSDF 2013 - Autopsy 3: Extensible Desktop Forensics by Brian Carrier
OSDF 2013 - Autopsy 3: Extensible Desktop Forensics by Brian CarrierOSDF 2013 - Autopsy 3: Extensible Desktop Forensics by Brian Carrier
OSDF 2013 - Autopsy 3: Extensible Desktop Forensics by Brian Carrier
 
BP301: Q: What’s Your Second Most Valuable Asset and Nearly Doubles Every Year?
BP301: Q: What’s Your Second Most Valuable Asset and Nearly Doubles Every Year? BP301: Q: What’s Your Second Most Valuable Asset and Nearly Doubles Every Year?
BP301: Q: What’s Your Second Most Valuable Asset and Nearly Doubles Every Year?
 
WindowsRegistry.ppt
WindowsRegistry.pptWindowsRegistry.ppt
WindowsRegistry.ppt
 
4055-841_Project_ShailendraSadh
4055-841_Project_ShailendraSadh4055-841_Project_ShailendraSadh
4055-841_Project_ShailendraSadh
 
Kealy OWASP interactive_artifacts
Kealy OWASP interactive_artifactsKealy OWASP interactive_artifacts
Kealy OWASP interactive_artifacts
 
Windowsforensics
WindowsforensicsWindowsforensics
Windowsforensics
 
Introduction To Unix
Introduction To UnixIntroduction To Unix
Introduction To Unix
 
Linux
LinuxLinux
Linux
 
Computer forensics libin
Computer forensics   libinComputer forensics   libin
Computer forensics libin
 
14(1) 005
14(1) 00514(1) 005
14(1) 005
 
Strategies to design FUD malware
Strategies to design FUD malwareStrategies to design FUD malware
Strategies to design FUD malware
 
Windows forensic
Windows forensicWindows forensic
Windows forensic
 
Autopsy Digital forensics tool
Autopsy Digital forensics toolAutopsy Digital forensics tool
Autopsy Digital forensics tool
 
What Are You Looking ForThe variety of operating systems, appli.docx
What Are You Looking ForThe variety of operating systems, appli.docxWhat Are You Looking ForThe variety of operating systems, appli.docx
What Are You Looking ForThe variety of operating systems, appli.docx
 

More from Reality Net System Solutions

BYOM Build Your Own Methodology (in Mobile Forensics)
BYOM Build Your Own Methodology (in Mobile Forensics)BYOM Build Your Own Methodology (in Mobile Forensics)
BYOM Build Your Own Methodology (in Mobile Forensics)
Reality Net System Solutions
 
Forensic Analysis of the Raspberry PI 400
Forensic Analysis of the Raspberry PI 400Forensic Analysis of the Raspberry PI 400
Forensic Analysis of the Raspberry PI 400
Reality Net System Solutions
 
iOS Forensics a costo zero
iOS Forensics a costo zeroiOS Forensics a costo zero
iOS Forensics a costo zero
Reality Net System Solutions
 
The state of the art in iOS Forensics
The state of the art in iOS ForensicsThe state of the art in iOS Forensics
The state of the art in iOS Forensics
Reality Net System Solutions
 
(in)Secure Secret Zone
(in)Secure Secret Zone(in)Secure Secret Zone
(in)Secure Secret Zone
Reality Net System Solutions
 
Forensicating the Apple TV
Forensicating the Apple TVForensicating the Apple TV
Forensicating the Apple TV
Reality Net System Solutions
 
iOS Forensics: where are we now and what are we missing?
iOS Forensics: where are we now and what are we missing?iOS Forensics: where are we now and what are we missing?
iOS Forensics: where are we now and what are we missing?
Reality Net System Solutions
 
Acquisizione forense di dispositivi iOS
Acquisizione forense di dispositivi iOSAcquisizione forense di dispositivi iOS
Acquisizione forense di dispositivi iOS
Reality Net System Solutions
 
Life on Clouds: a forensics overview
Life on Clouds: a forensics overviewLife on Clouds: a forensics overview
Life on Clouds: a forensics overview
Reality Net System Solutions
 
Study and analysis of Orweb anonymizer on Android Devices
Study and analysis of Orweb anonymizer on Android DevicesStudy and analysis of Orweb anonymizer on Android Devices
Study and analysis of Orweb anonymizer on Android Devices
Reality Net System Solutions
 
Discovering Windows Phone 8 Artifacts and Secrets
Discovering Windows Phone 8 Artifacts and Secrets Discovering Windows Phone 8 Artifacts and Secrets
Discovering Windows Phone 8 Artifacts and Secrets
Reality Net System Solutions
 
ReVaulting! Decryption and opportunities
ReVaulting! Decryption and opportunitiesReVaulting! Decryption and opportunities
ReVaulting! Decryption and opportunities
Reality Net System Solutions
 
Dammi il tuo iPhone e ti dirò chi sei (Forse)
Dammi il tuo iPhone e ti dirò chi sei (Forse)Dammi il tuo iPhone e ti dirò chi sei (Forse)
Dammi il tuo iPhone e ti dirò chi sei (Forse)
Reality Net System Solutions
 

More from Reality Net System Solutions (13)

BYOM Build Your Own Methodology (in Mobile Forensics)
BYOM Build Your Own Methodology (in Mobile Forensics)BYOM Build Your Own Methodology (in Mobile Forensics)
BYOM Build Your Own Methodology (in Mobile Forensics)
 
Forensic Analysis of the Raspberry PI 400
Forensic Analysis of the Raspberry PI 400Forensic Analysis of the Raspberry PI 400
Forensic Analysis of the Raspberry PI 400
 
iOS Forensics a costo zero
iOS Forensics a costo zeroiOS Forensics a costo zero
iOS Forensics a costo zero
 
The state of the art in iOS Forensics
The state of the art in iOS ForensicsThe state of the art in iOS Forensics
The state of the art in iOS Forensics
 
(in)Secure Secret Zone
(in)Secure Secret Zone(in)Secure Secret Zone
(in)Secure Secret Zone
 
Forensicating the Apple TV
Forensicating the Apple TVForensicating the Apple TV
Forensicating the Apple TV
 
iOS Forensics: where are we now and what are we missing?
iOS Forensics: where are we now and what are we missing?iOS Forensics: where are we now and what are we missing?
iOS Forensics: where are we now and what are we missing?
 
Acquisizione forense di dispositivi iOS
Acquisizione forense di dispositivi iOSAcquisizione forense di dispositivi iOS
Acquisizione forense di dispositivi iOS
 
Life on Clouds: a forensics overview
Life on Clouds: a forensics overviewLife on Clouds: a forensics overview
Life on Clouds: a forensics overview
 
Study and analysis of Orweb anonymizer on Android Devices
Study and analysis of Orweb anonymizer on Android DevicesStudy and analysis of Orweb anonymizer on Android Devices
Study and analysis of Orweb anonymizer on Android Devices
 
Discovering Windows Phone 8 Artifacts and Secrets
Discovering Windows Phone 8 Artifacts and Secrets Discovering Windows Phone 8 Artifacts and Secrets
Discovering Windows Phone 8 Artifacts and Secrets
 
ReVaulting! Decryption and opportunities
ReVaulting! Decryption and opportunitiesReVaulting! Decryption and opportunities
ReVaulting! Decryption and opportunities
 
Dammi il tuo iPhone e ti dirò chi sei (Forse)
Dammi il tuo iPhone e ti dirò chi sei (Forse)Dammi il tuo iPhone e ti dirò chi sei (Forse)
Dammi il tuo iPhone e ti dirò chi sei (Forse)
 

Recently uploaded

Enchancing adoption of Open Source Libraries. A case study on Albumentations.AI
Enchancing adoption of Open Source Libraries. A case study on Albumentations.AIEnchancing adoption of Open Source Libraries. A case study on Albumentations.AI
Enchancing adoption of Open Source Libraries. A case study on Albumentations.AI
Vladimir Iglovikov, Ph.D.
 
Introduction to CHERI technology - Cybersecurity
Introduction to CHERI technology - CybersecurityIntroduction to CHERI technology - Cybersecurity
Introduction to CHERI technology - Cybersecurity
mikeeftimakis1
 
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdfFIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance
 
GraphSummit Singapore | The Art of the Possible with Graph - Q2 2024
GraphSummit Singapore | The Art of the  Possible with Graph - Q2 2024GraphSummit Singapore | The Art of the  Possible with Graph - Q2 2024
GraphSummit Singapore | The Art of the Possible with Graph - Q2 2024
Neo4j
 
Monitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR EventsMonitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR Events
Ana-Maria Mihalceanu
 
“I’m still / I’m still / Chaining from the Block”
“I’m still / I’m still / Chaining from the Block”“I’m still / I’m still / Chaining from the Block”
“I’m still / I’m still / Chaining from the Block”
Claudio Di Ciccio
 
Microsoft - Power Platform_G.Aspiotis.pdf
Microsoft - Power Platform_G.Aspiotis.pdfMicrosoft - Power Platform_G.Aspiotis.pdf
Microsoft - Power Platform_G.Aspiotis.pdf
Uni Systems S.M.S.A.
 
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
Neo4j
 
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
DanBrown980551
 
UiPath Test Automation using UiPath Test Suite series, part 5
UiPath Test Automation using UiPath Test Suite series, part 5UiPath Test Automation using UiPath Test Suite series, part 5
UiPath Test Automation using UiPath Test Suite series, part 5
DianaGray10
 
Artificial Intelligence for XMLDevelopment
Artificial Intelligence for XMLDevelopmentArtificial Intelligence for XMLDevelopment
Artificial Intelligence for XMLDevelopment
Octavian Nadolu
 
A tale of scale & speed: How the US Navy is enabling software delivery from l...
A tale of scale & speed: How the US Navy is enabling software delivery from l...A tale of scale & speed: How the US Navy is enabling software delivery from l...
A tale of scale & speed: How the US Navy is enabling software delivery from l...
sonjaschweigert1
 
zkStudyClub - Reef: Fast Succinct Non-Interactive Zero-Knowledge Regex Proofs
zkStudyClub - Reef: Fast Succinct Non-Interactive Zero-Knowledge Regex ProofszkStudyClub - Reef: Fast Succinct Non-Interactive Zero-Knowledge Regex Proofs
zkStudyClub - Reef: Fast Succinct Non-Interactive Zero-Knowledge Regex Proofs
Alex Pruden
 
20240609 QFM020 Irresponsible AI Reading List May 2024
20240609 QFM020 Irresponsible AI Reading List May 202420240609 QFM020 Irresponsible AI Reading List May 2024
20240609 QFM020 Irresponsible AI Reading List May 2024
Matthew Sinclair
 
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
James Anderson
 
Video Streaming: Then, Now, and in the Future
Video Streaming: Then, Now, and in the FutureVideo Streaming: Then, Now, and in the Future
Video Streaming: Then, Now, and in the Future
Alpen-Adria-Universität
 
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
Neo4j
 
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Albert Hoitingh
 
RESUME BUILDER APPLICATION Project for students
RESUME BUILDER APPLICATION Project for studentsRESUME BUILDER APPLICATION Project for students
RESUME BUILDER APPLICATION Project for students
KAMESHS29
 
GridMate - End to end testing is a critical piece to ensure quality and avoid...
GridMate - End to end testing is a critical piece to ensure quality and avoid...GridMate - End to end testing is a critical piece to ensure quality and avoid...
GridMate - End to end testing is a critical piece to ensure quality and avoid...
ThomasParaiso2
 

Recently uploaded (20)

Enchancing adoption of Open Source Libraries. A case study on Albumentations.AI
Enchancing adoption of Open Source Libraries. A case study on Albumentations.AIEnchancing adoption of Open Source Libraries. A case study on Albumentations.AI
Enchancing adoption of Open Source Libraries. A case study on Albumentations.AI
 
Introduction to CHERI technology - Cybersecurity
Introduction to CHERI technology - CybersecurityIntroduction to CHERI technology - Cybersecurity
Introduction to CHERI technology - Cybersecurity
 
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdfFIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
 
GraphSummit Singapore | The Art of the Possible with Graph - Q2 2024
GraphSummit Singapore | The Art of the  Possible with Graph - Q2 2024GraphSummit Singapore | The Art of the  Possible with Graph - Q2 2024
GraphSummit Singapore | The Art of the Possible with Graph - Q2 2024
 
Monitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR EventsMonitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR Events
 
“I’m still / I’m still / Chaining from the Block”
“I’m still / I’m still / Chaining from the Block”“I’m still / I’m still / Chaining from the Block”
“I’m still / I’m still / Chaining from the Block”
 
Microsoft - Power Platform_G.Aspiotis.pdf
Microsoft - Power Platform_G.Aspiotis.pdfMicrosoft - Power Platform_G.Aspiotis.pdf
Microsoft - Power Platform_G.Aspiotis.pdf
 
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
 
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
 
UiPath Test Automation using UiPath Test Suite series, part 5
UiPath Test Automation using UiPath Test Suite series, part 5UiPath Test Automation using UiPath Test Suite series, part 5
UiPath Test Automation using UiPath Test Suite series, part 5
 
Artificial Intelligence for XMLDevelopment
Artificial Intelligence for XMLDevelopmentArtificial Intelligence for XMLDevelopment
Artificial Intelligence for XMLDevelopment
 
A tale of scale & speed: How the US Navy is enabling software delivery from l...
A tale of scale & speed: How the US Navy is enabling software delivery from l...A tale of scale & speed: How the US Navy is enabling software delivery from l...
A tale of scale & speed: How the US Navy is enabling software delivery from l...
 
zkStudyClub - Reef: Fast Succinct Non-Interactive Zero-Knowledge Regex Proofs
zkStudyClub - Reef: Fast Succinct Non-Interactive Zero-Knowledge Regex ProofszkStudyClub - Reef: Fast Succinct Non-Interactive Zero-Knowledge Regex Proofs
zkStudyClub - Reef: Fast Succinct Non-Interactive Zero-Knowledge Regex Proofs
 
20240609 QFM020 Irresponsible AI Reading List May 2024
20240609 QFM020 Irresponsible AI Reading List May 202420240609 QFM020 Irresponsible AI Reading List May 2024
20240609 QFM020 Irresponsible AI Reading List May 2024
 
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...
 
Video Streaming: Then, Now, and in the Future
Video Streaming: Then, Now, and in the FutureVideo Streaming: Then, Now, and in the Future
Video Streaming: Then, Now, and in the Future
 
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
 
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
 
RESUME BUILDER APPLICATION Project for students
RESUME BUILDER APPLICATION Project for studentsRESUME BUILDER APPLICATION Project for students
RESUME BUILDER APPLICATION Project for students
 
GridMate - End to end testing is a critical piece to ensure quality and avoid...
GridMate - End to end testing is a critical piece to ensure quality and avoid...GridMate - End to end testing is a critical piece to ensure quality and avoid...
GridMate - End to end testing is a critical piece to ensure quality and avoid...
 

Tor Browser Forensics on Windows OS

  • 1. TOR BROWSER FORENSICS ON WINDOWS OS MATTIA EPIFANI, FRANCESCO PICASSO, MARCO SCARITO, CLAUDIA MEDA DFRWS 2015 DUBLIN, 24 MARCH 2015
  • 2. REAL CASE  Management salaries of a private company were published on a Blog  Through an analysis of the internal network, we found a possible suspect because he accessed the Excel file containing the salaries the day before the publication  Company asked us to analyze the employee laptop  We found evidences that confirm that the Excel file was opened [LNK, Jumplist, ShellBags]  But no traces were found in browsing history about the publishing activity on the blog…
  • 3. PREVIOUS RESEARCH  An interesting research by Runa Sandvik is available at Forensic Analysis of theTor Browser Bundle on OS X, Linux, and Windows https://research.torproject.org/techreports/tbb-forensic-analysis-2013-06-28.pdf  We started from her work to find other interesting artifacts
  • 4. TOR BROWSER – MICROSOFT WINDOWS Version 4.0.2
  • 5. TOR BROWSER FOLDER  The most interesting folders are located in Tor BrowserBrowserTor Browser: DataTor DataBrowserprofile.default
  • 6. FOLDER DATATOR  State: it contains the last execution date  Torrc: it contains the path from where the Tor Browser was launched with the drive letter
  • 7. FOLDER DATABROWSERPROFILE.DEFAULT  The traditional Firefox folder containing the user profile without usage traces  The most interesting files:  Compatibility.ini  Extension.ini • Browser execution path • Date Created  First execution • Date Modified  Last execution
  • 8. OS ARTIFACTS ANALYSIS  Evidence of TOR usage can be found (mainly) in:  Prefetch file TORBROWSERINSTALL-<VERSION>-<PATH-HASH>.pf  Prefetch file TOR.EXE-<PATH-HASH>.pf  Prefetch file FIREFOX.EXE-<PATH-HASH>.pf  Prefetch file START TOR BROWSER.EXE-<PATH-HASH>.pf (old version < 4.0.2)  NTUSER.DAT registry hive  User Assist key  Windows Search Database  Thumbnail cache
  • 9. PREFETCH FILES  We can recover:  First execution date  Last execution date  In Windows 8/8.1  Last 8 executions  Number of executions  Execution Path  Install date (from Tor Browser Install prefetch file)  Tor Browser version (from Tor Browser Install prefetch file)
  • 10. USER ASSIST  We can recover:  Last execution date  Number of executions  Execution path  By analyzing various NTUSER.DAT from VSS we can identify the number and time of execution in a period of interest
  • 11. OTHER ARTIFACTS ON THE HARD DRIVE Other files noted: Thumbnail Cache It contains the TOR Browser icon Windows Search Database Tor Browser files and folders path
  • 12. BROWSING ACTIVITIES Evidence of browsing activities can be found in:  Bookmarks (places.sqlite database)  Pagefile.sys  Memory Dump / Hiberfil.sys
  • 14. PAGEFILE.SYS Information about visited websites Search for the keyword HTTP-memory-only-PB
  • 15. HTTP-MEMORY-ONLY-PB  A function used by Mozilla Firefox for Private Browsing (not saving cache data on the hard drive)  Tor Browser uses the Private Browsing feature of Mozilla Firefox  But Tor Browser typically uses an old Firefox version, based on Firefox ESR  To distinguish if the browsing activity was made with Mozilla Firefox or with Tor Browser:  Check if Firefox is installed  If it is installed, verify the actual version
  • 17. ANALYSIS METHODOLOGY • Install date • First execution date • Last execution date(s) • Number of executions • Tor Browser version Prefetch files • Execution path • Last execution date • Total number of executions • Verify the history of execution through theVolume Shadow Copies NTUSERUserAssist key • Thumbnail Cache • Windows Search Database Other possible artifacts •State •Torrc •Compatibility.ini •Extension.ini •Places.sqlite [Bookmarks] Tor Browser Files •HTTP-memory-only-PB •Torproject •Tor •Torrc •Geoip •Torbutton •Tor-launcher Pagefile.sys (keywords search) • Convert to a memory dump • Analyze through • Volatility • Keywords search Hiberfil.sys
  • 18. REAL CASE  We indexed the hard drive and searched for the blog URL  We found some interesting URLs in the pagefile, indicating the access to the Blog Admin page (http://www. blognameblabla.com/wp-admin/)
  • 19. REAL CASE  All the URLs were preceded by the string HTTP-MEMORY- ONLY-PB and Firefox is not installed on the laptop  We found that the TOR Browser was downloaded with Google Chrome the night in which the file was published on the blog  By analyzing the OS artifacts we found that it was installed and only executed once, 3 minutes before the publish date and time on the blog
  • 20. ACTIVE RESEARCHES  Memory Dump with Volatility and Rekall  Can we find any temporal reference for browsing activities?  Can we correlate Tor Browser cache entries to carved files from pagefile/hiberfil/memory dump?  Tor Browser on Mac OS X  Tor Browser on Linux  Orbot on Android
  • 21. Q&A? Mattia Epifani  Digital Forensics Analyst  CEO @ REALITY NET – System Solutions  GCFA, GMOB, GNFA, GREM  CEH, CHFI, CCE, CIFI, ECCE,AME,ACE, MPSC Mail mattia.epifani@realitynet.it Twitter @mattiaep Linkedin http://www.linkedin.com/in/mattiaepifani Web http://www.realitynet.it Blog http://blog.digital-forensics.it http://mattiaep.blogspot.it