encase에서 비트락커 메시지 다시 띄우기

포렌식/컴퓨터
posted by 블르샤이닝 2023. 2. 14. 10:42
728x90

encase에서 먼저 이미지 획득한 후 비트락커 걸려있는 디스크일 때 파일시스템 안에 들어갈때 한번 메시지 띄우고 마는데

 

다시 띄우는 방법은 rescan 실행으로 다시 띄을 수 있다.

 

맨처음 이미지 파일 정보에서 마우스 오르쪽 누르고 rescan을 실행하면 된다.

 

조심할게 리스캔은 분석 정보등을 다 초기화 시키는 거니까 초기에 할거 아니면 왠만하면 건들지 말것

728x90

'포렌식 > 컴퓨터' 카테고리의 다른 글

Study on Windows Event Log-Based Corporate Security Audit and Malware Detection  (0) 2023.05.15
윈도우 레지스트리에서 디바이스 정보  (0) 2023.04.18
윈도우 10 이벤트 로그 중 연결 장치(저장장치) 흔적 확인  (0) 2022.11.16
sticky 메모(스티키 메모) db에서 시간 데이터 변환 쿼리문  (0) 2022.09.26
하드링크에 대한 교육  (0) 2022.08.31

윈도우 10 이벤트 로그 중 연결 장치(저장장치) 흔적 확인

포렌식/컴퓨터
posted by 블르샤이닝 2022. 11. 16. 14:08
728x90
윈도우 10 이벤트 로그 중 연결 장치 흔적을 볼 수 있는 로그가 하나 더 있습니다.
- 파일: Microsoft-Windows-Partition%4Diagnostic.evtx
- 이벤트ID: 1006
+ 획득가능 정보 (HDD, USB 모두 해당)
--- 제조사명, 제품명, 버전명, 시리얼번호, 용량
--- 파티션테이블, MBR, VBR의 RAW덤프 데이터

SB와 같은 장치를 연결하면 윈도우는 장치로부터 드라이버를 받아 설치하거나 이미 있다면 기존 드라이버를 로드시키고, 연결 해제 시 드라이버를 언로드 시킨다. 이와 같은 드라이버 이벤트는 다음 로그 파일에 기록된다.

  • %SystemRoot%\System32\winevt\Logs\Microsoft-Windows-DriverFrameworks-UserMode%4Operational.evtx

장치 연결 시 드라이버 로드는 반드시 일어나므로 해당 이벤트 로그를 확인하면 장치의 연결, 해제 흔적을 알 수 있다.

 

http://forensic-proof.com/archives/5945

 

윈도우 7 장치 연결/해제 이벤트 로그 (Windows 7 Device Tracking Event Log) | FORENSIC-PROOF

 

forensic-proof.com

 

728x90

'포렌식 > 컴퓨터' 카테고리의 다른 글

윈도우 레지스트리에서 디바이스 정보  (0) 2023.04.18
encase에서 비트락커 메시지 다시 띄우기  (0) 2023.02.14
sticky 메모(스티키 메모) db에서 시간 데이터 변환 쿼리문  (0) 2022.09.26
하드링크에 대한 교육  (0) 2022.08.31
Windows Artifacts  (0) 2022.08.18

sticky 메모(스티키 메모) db에서 시간 데이터 변환 쿼리문

포렌식/컴퓨터
posted by 블르샤이닝 2022. 9. 26. 13:33
728x90

selected datetime(Note.CreatedAt/10000000 - 62135596800, 'unixerpoch',"localtime") AS message_date.text

 

명령어이고 해당 쿼리에서는 생성시간 정보만 나오게 한 명령어이다.

 

시간정보는 아래 출처 정보부분에섯 참고하셔 만듬

 

 

출처 : https://github.com/dingtoffee/StickyParser

 

GitHub - dingtoffee/StickyParser: StickyPraser - Sticky Notes Forensic. A Windows Sticky Notes Praser (snt and plum.sqlite suppo

StickyPraser - Sticky Notes Forensic. A Windows Sticky Notes Praser (snt and plum.sqlite supported). Additional Feature: SQLite Recovery - Deleted content recovery from plum.sqlite or any generic s...

github.com

 

 

 

 

728x90

'포렌식 > 컴퓨터' 카테고리의 다른 글

encase에서 비트락커 메시지 다시 띄우기  (0) 2023.02.14
윈도우 10 이벤트 로그 중 연결 장치(저장장치) 흔적 확인  (0) 2022.11.16
하드링크에 대한 교육  (0) 2022.08.31
Windows Artifacts  (0) 2022.08.18
웹 메일에 대한 포렌식 설명 - Unistore 폴더  (0) 2022.08.17

하드링크에 대한 교육

2022. 8. 31. 10:50

보호되어 있는 글입니다.
내용을 보시려면 비밀번호를 입력하세요.

Windows Artifacts

포렌식/컴퓨터
posted by 블르샤이닝 2022. 8. 18. 14:12
728x90
Windows Artifacts
Windows Artifacts
 
 
Support HackTricks and get benefits!
Generic Windows Artifacts
Windows 10 Notifications
In the path \Users\<username>\AppData\Local\Microsoft\Windows\Notifications you can find the database appdb.dat (before Windows anniversary) or wpndatabase.db (after Windows Anniversary).
Inside this SQLite database you can find the Notification table with all the notifications (in xml format) that may contain interesting data.
Timeline
Timeline is a Windows characteristic that provides chronological history of web pages visited, edited documents, executed applications... The database resides in the path \Users\<username>\AppData\Local\ConnectedDevicesPlatform\<id>\ActivitiesCache.db This database can be open with a SQLite tool or with the tool WxTCmd which generates 2 files that can be opened with the tool TimeLine Explorer.
ADS/Alternate Data Streams
Files downloaded may contain the ADS Zone.Identifier indicating how was downloaded (from the intranet, Internet...) and some software (like browser) usually put even more information like the URL from where the file was downloaded.
File Backups
Recycle Bin
In Vista/Win7/Win8/Win10 the Reciclye Bin can be found in the folder $Recycle.bin in the root of the drive (C:\$Reciycle.bin). When a file is deleted in this folder are created 2 files:
 
Having these files you can sue the tool Rifiuti to get the original address of the deleted files and the date it was deleted (use rifiuti-vista.exe for Vista – Win10).
 
.\rifiuti-vista.exe C:\Users\student\Desktop\Recycle
Volume Shadow Copies
Shadow Copy is a technology included in Microsoft Windows that can create backup copies or snapshots of computer files or volumes, even when they are in use. These backups are usually located in the \System Volume Information from the roof of the file system and the name is composed by UIDs as in the following image:
Mounting the forensics image with the ArsenalImageMounter, the tool ShadowCopyView can be used to inspect a shadow copy and even extract the files from the shadow copy backups.
The registry entry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BackupRestore contains the files and keys to not backup:
The registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS also contains configuration information about the Volume Shadow Copies.
Office AutoSaved Files
You can find the office autosaved files in : C:\Usuarios\\AppData\Roaming\Microsoft{Excel|Word|Powerpoint}\
Shell Items
A shell item is an item that contains information about how to access another file.
Recent Documents (LNK)
Windows automatically creates these shortcuts when the user open, uses or creates a file in:
 
When a folder is created, a link to the folder, to the parent folder and to the grandparent folder is also created.
These automatically created link files contain information about the origin like if it's a file or a folder, MAC times of that file, volume information of where is the file stored and folder of the target file. This information can be useful to recover those files in case they were removed.
Also, the date created of the link file is the first time the original file was first used and the date modified of the link file is the last time the origin file was used.
To inspect these files you can use LinkParser.
In this tools you will find 2 set of timestamps: FileModifiedDate, FileAccessDate and FileCreationDate, and LinkModifiedDate, LinkAccessDate and LinkCreationDate. The first set of timestamp references the timestamps of the link file itself. The second set references the timestamps of the linked file.
You can get the same information running the Windows cli tool: LECmd.exe​
 
LECmd.exe -d C:\Users\student\Desktop\LNKs --csv C:\Users\student\Desktop\LNKs
In this case the information is going to be saved inside a CSV file.
Jumplists
These are the recent files that are indicated per application. It's the list of recent files used by an application that you can access on each application.
They can be created automatically or be custom.
The jumplists created automatically are stored in C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\. The jumplists are named following the format {id}.autmaticDestinations-ms where the initial ID is the ID of the application.
The custom jumplists are stored in C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Recent\CustomDestination\ and they are created by the application usually because something important has happened with the file (maybe marked as favorite)
The created time of any jumplist indicates the first time the file was accessed and the modified time the last time.
You can inspect the jumplists using JumplistExplorer.
(Note that the timestamps provided by JumplistExplorer are related to the jumplist file itself)
Shellbags
Use of Windows USBs
It's possible to identify that a USB device was used thanks to the creation of:
 
Note that some LNK file instead of pointing to the original path, points to the WPDNSE folder:
The files in the folder WPDNSE are a copy of the original ones, then won't survive a restart of the PC and the GUID is taken from a shellbag.
Registry Information
​Check this page to learn which registry keys contains interesting information about USB connected devices.
setupapi
Check the file C:\Windows\inf\setupapi.dev.log to get the timestamps about when the USB connection was produced (search for Section start).
USB Detective
​USBDetective can be used to obtain information about the USB devices that have been connected to an image.
Plug and Play Cleanup
The 'Plug and Play Cleanup' scheduled task is responsible for clearing legacy versions of drivers. It would appear (based upon reports online) that it also picks up drivers which have not been used in 30 days, despite its description stating that "the most current version of each driver package will be kept". As such, removable devices which have not been connected for 30 days may have their drivers removed. The scheduled task itself is located at ‘C:\Windows\System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup’, and its content is displayed below:
The task references 'pnpclean.dll' which is responsible for performing the cleanup activity additionally we see that the ‘UseUnifiedSchedulingEngine’ field is set to ‘TRUE’ which specifies that the generic task scheduling engine is used to manage the task. The ‘Period’ and ‘Deadline’ values of 'P1M' and 'P2M' within ‘MaintenanceSettings’ instruct Task Scheduler to execute the task once every month during regular Automatic maintenance and if it fails for 2 consecutive months, to start attempting the task during. This section was copied from here.
Emails
The emails contains 2 interesting parts: The headers and the content of the email. In the headers you can find information like:
 
Also, inside the References and In-Reply-To headers you can find the ID of the messages:
Windows Mail App
This application saves the emails in HTML or text. You can find the emails inside subfolders inside \Users\<username>\AppData\Local\Comms\Unistore\data\3\. The emails are saved with .dat extension.
The metadata of the emails and the contacts can be found inside the EDB database: \Users\<username>\AppData\Local\Comms\UnistoreDB\store.vol
Change the extension of the file from .vol to .edb and you can use the tool ESEDatabaseView to open it. Inside the Message table you can see the emails.
Microsoft Outlook
When Exchange servers or Outlook clients are used there are going to be some MAPI headers:
 
In the Microsoft Outlook client all the sent and received messages, contacts and calendar data is stored in a PST file in:
 
The registry path HKEY_CURRENT_USER\Software\Microsoft\WindowsNT\CurrentVersion\Windows Messagin Subsystem\Profiles\Outlook indicates the file that is being used.
You can open the PST file using the tool Kernel PST Viewer.
Outlook OST
When Microsoft Outlook is configured using IMAP or using an Exchange server, it generates a OST file that stores almost the same info as the PST file. It keeps the file synchronized with the server for the last 12 months, with a max file-size of 50GB and in the same folder as the PST file is saved.
You can inspect this file using Kernel OST viewer.
Recovering Attachments
You may be able to find them in the folder:
 
Thunderbird MBOX
Thunderbird stores the information in MBOX files in the folder \Users\%USERNAME%\AppData\Roaming\Thunderbird\Profiles
Thumbnails
When a user access a folder and organised it using thumbnails, then a thumbs.db file is created. This db stores the thumbnails of the images of the folder even if they are deleted. in winXP and WIn8-8.1 this file is created automatically. In Win7/Win10, it's created automatically if it's accessed via an UNC path (\IP\folder...).
It is possible to read this file with the tool Thumbsviewer.
Thumbcache
Beginning with Windows Vista, thumbnail previews are stored in a centralized location on the system. This provides the system with access to images independent of their location, and addresses issues with the locality of Thumbs.db files. The cache is stored at %userprofile%\AppData\Local\Microsoft\Windows\Explorer as a number of files with the label thumbcache_xxx.db (numbered by size); as well as an index used to find thumbnails in each sized database.
 
You can read this file using ThumbCache Viewer.
Windows Registry
The Windows Registry Contains a lot of information about the system and the actions of the users.
The files containing the registry are located in:
 
From Windows Vista and Windows 2008 Server upwards there are some backups of the HKEY_LOCAL_MACHINE registry files in %Windir%\System32\Config\RegBack\. Also from these versions, the registry file %UserProfile%\{User}\AppData\Local\Microsoft\Windows\USERCLASS.DAT is created saving information about program executions.
Tools
Some tools are useful to analyzed the registry files:
 
Recovering Deleted Element
When a key is deleted it's marked as such but until the space it's occupying is needed it won't be removed. Therefore, using tools like Registry Explorer it's possible to recover these deleted keys.
Last Write Time
Each Key-Value contains a timestamp indicating the last time it was modified.
SAM
The file/hive SAM contains the users, groups and users passwords hashes of the system. In SAM\Domains\Account\Users you can obtain the username, the RID, last logon, last failed logon, login counter, password policy and when the account was created. In order to get the hashes you also need the file/hive SYSTEM.
Interesting entries in the Windows Registry
Programs Executed
Basic Windows Processes
in the following page you can learn about the basic Windows processes to detect suspicious behaviours:
Windows RecentAPPs
Inside the registry NTUSER.DAT in the path Software\Microsoft\Current Version\Search\RecentApps you can subkeys with information about the application executed, last time it was executed, and number of times it was launched.
BAM
You can open the SYSTEM file with a registry editor and inside the path SYSTEM\CurrentControlSet\Services\bam\UserSettings\{SID} you can find the information about the applications executed by each user (note the {SID} in the path) and at what time they were executed (the time is inside the Data value of the registry).
Windows Prefetch
Prefetching is a technique that allows a computer to silently fetch the necessary resources needed to display content that a user might access in the near future so resources can be accessed in less time.
Windows prefetch consist on creating caches of the executed programs in order to be able to load them faster. These caches as created as .pf files inside the path: C:\Windows\Prefetch. there is a limit of 128 files in XP/VISTA/WIN7 and 1024 files in Win8/Win10.
The file name is created as {program_name}-{hash}.pf (the hash is based on the path and arguments of the executable). In W10 these files are compressed. Note that the sole presence of the file indicates that the program was executed at some point.
The file C:\Windows\Prefetch\Layout.ini contains the names of the folders of the files that are prefetched. This file contains information about the number of the executions, dates of the execution and files open by the program.
To inspect these files you can use the tool PEcmd.exe:
 
.\PECmd.exe -d C:\Users\student\Desktop\Prefetch --html "C:\Users\student\Desktop\out_folder"
Superprefetch
Superprefetch has the same goal as prefetch, load programs faster by predicting what is going to be loaded next. However, it doesn't substitute the prefetch service. This service will generate database files in C:\Windows\Prefetch\Ag*.db.
In these databases you can find the name of the program, number of executions, files opened, volume accessed, complete path, timeframes and timestamps.
You can access this information using the tool CrowdResponse.
SRUM
System Resource Usage Monitor (SRUM) monitors the resources consumed by a process. It appeared in W8 and it stores the data en an ESE database located in C:\Windows\System32\sru\SRUDB.dat.
It gives the information:
 
This information is updated every 60mins.
You can obtain the date from this file using the tool srum_dump.
 
.\srum_dump.exe -i C:\Users\student\Desktop\SRUDB.dat -t SRUM_TEMPLATE.xlsx -o C:\Users\student\Desktop\srum
AppCompatCache (ShimCache)
Shimcache, also known as AppCompatCache, is a component of the Application Compatibility Database, which was created by Microsoft and used by the operating system to identify application compatibility issues.
The cache stores various file metadata depending on the operating system, such as:
 
This information can be found in the registry in:
 
You can use the tool AppCompatCacheParser to parse this information.
Amcache
The Amcache.hve file is a registry file that stores the information of executed applications. It's located in C:\Windows\AppCompat\Programas\Amcache.hve
Amcache.hve records the recent processes that were run and lists the path of the files that’s executed which can then be used to find the executed program. It also record the SHA1 of the program.
You can parse this information with the tool Amcacheparser​
 
AmcacheParser.exe -f C:\Users\student\Desktop\Amcache.hve --csv C:\Users\student\Desktop\srum
The most interesting CVS file generated if the Amcache_Unassociated file entries.
RecentFileCache
This artifact can only be found in W7 in C:\Windows\AppCompat\Programs\RecentFileCache.bcf and it contains information about the recent execution of some binaries.
You can use the tool RecentFileCacheParse to parse the file.
Scheduled tasks
You can extract them from C:\Windows\Tasks or C:\Windows\System32\Tasks and read them as XML.
Services
You can find them in the registry under SYSTEM\ControlSet001\Services. You can see what is going to be executed and when.
Windows Store
The installed applications can be found in \ProgramData\Microsoft\Windows\AppRepository\ This repository has a log with each application installed in the system inside the database StateRepository-Machine.srd.
Inside the Application table of this database it's possible to find the columns: "Application ID", "PackageNumber", and "Display Name". This columns have information about pre-installed and installed applications and it can be found if some applications were uninstalled because the IDs of installed applications should be sequential.
It's also possible to find installed application inside the registry path: Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Applications\ And uninstalled applications in: Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deleted\
Windows Events
Information that appears inside Windows events:
 
The logs are located in C:\Windows\System32\config before Windows Vista and in C:\Windows\System32\winevt\Logs after Windows Vista.
Before Windows Vista the event logs were in binary format and after it, they are in XML format and use the .evtx extension.
The location of the event files can be found in the SYSTEM registry in HKLM\SYSTEM\CurrentControlSet\services\EventLog\{Application|System|Security}
They can be visualized from the Windows Event Viewer (eventvwr.msc) or with other tools like Event Log Explorer or Evtx Explorer/EvtxECmd.
Security
These event register the accesses and give information about the security configuration. they can be found in C:\Windows\System32\winevt\Security.evtx.
The max size of the event file is configurable, and it will start overwriting old events when the maximum size is reached.
Events that are registered:
 
Events related to the user authentication:
EventID
Description
4624
Successful authentication
4625
Authentication error
4634/4647
log off
4672
Logon with admin permissions
Inside the EventID 4634/4647 there are interesting sub-types:
 
In this post you can find how to mimic all these types of login and in which of them you will be able to dump credentials from memory: https://www.alteredsecurity.com/post/fantastic-windows-logon-types-and-where-to-find-credentials-in-them​
The Status and sub status information of the event s can indicate more details about the causes of the event. For example take a look to the following Status and Sub Status Codes of the Event ID 4625:
Recovering Windows Events
It's highly recommended to turn off the suspicious PC by unplugging it to maximize the probabilities of recovering the Windows Events. In case they were deleted, a tool that can be useful to try to recover them is Bulk_extractor indicating the evtx extension.
Identifying Common Attacks with Windows Events
Brute-Force Attack
A brute-force attack can be easily identifiable because several EventIDs 4625 will appear. If the attack was successful, after the EventIDs 4625, an EventID 4624 will appear.
Time Change
This is awful for the forensics team as all the timestamps will be modified. This event is recorded by the EventID 4616 inside the Security Event log.
USB devices
The following System EventIDs are useful:
 
The EventID 112 from DeviceSetupManager contains the timestamp of each USB device inserted.
Turn Off / Turn On
The ID 6005 of the "Event Log" service indicates the PC was turned On. The ID 6006 indicates it was turned Off.
Logs Deletion
The Security EventID 1102 indicates the logs were deleted.
 

Windows Artifacts - HackTricks

The file/hive SAM contains the users, groups and users passwords hashes of the system. In SAM\Domains\Account\Users you can obtain the username, the RID, last logon, last failed logon, login counter, password policy and when the account was created. In ord

book.hacktricks.xyz

 

728x90

'포렌식 > 컴퓨터' 카테고리의 다른 글

sticky 메모(스티키 메모) db에서 시간 데이터 변환 쿼리문  (0) 2022.09.26
하드링크에 대한 교육  (0) 2022.08.31
웹 메일에 대한 포렌식 설명 - Unistore 폴더  (0) 2022.08.17
윈도우 11 설치 여부 확인하는 방법  (0) 2022.07.22
윈도우 11 explore 오류(마우스 오른쪽 실행시 깜빡임)  (0) 2022.07.18

웹 메일에 대한 포렌식 설명 - Unistore 폴더

포렌식/컴퓨터
posted by 블르샤이닝 2022. 8. 17. 14:55
728x90

Unistore 폴더에 웹 메일에 대한 정보가 있으며, 7번폴더는 첨부파일 3번은 원본 메일 정보가 가지고 있다.

 

웹메일에 대해 삭제된 데이터라도 해당 경로에 가면 웹메일에 대한 정보 확인이 가능

 

----------------------------------------------------------------------------------------------------------

이메일 응용프로그램 분석을 함께해보는 시간을 가지도록 하겠습니다.

​

이메일의 기능이 많아지면서 일정, 연락처, 첨부파일 등 다양한 정보를 함께 송수신하고 수신한 이메일 데이터는 관리하고 유지할 수 있습니다.

​

이메일 주소는 주소와 개인이 매핑되며 주소를 통해 개인을 유추할 수 있기 때문에 개인정보로 분류합니다.

로컬 컴퓨터에서 이메일을 수집할 때 어떤 프로토콜을 사용하는지 확인해야합니다.

​

이메일에서 대표적으로 사용되는 프로토콜은 POP3와 IMAP 수신 프로토콜입니다.

​

이메일 프로토콜은 송신과 수신이 다른 종류로 이루어져 있습니다.

​

POP3 프로토콜은 사용자가 이메일 서버와 연동하면 사용자가 다운로드하지 않은 이메일을 서버가 모두 보내주는 비동기화 방식을 사용합니다.

​

비동기화 방식은 오프라인 작업에 쓰이는데 데이터를 수정하거나 삭제해도 서버에 기록된 원본 이메일 데이터에 영향을 주지 않기 때문입니다.

​

단점으로는 많은 용량의 데이터가 서버에 있고 처음 POP3로 연동했을 때 모든 용량을 모두 받아오게 되어서 비효율적입니다.

​

IMAP 프로토콜은 서버에 이메일이 저장되며 사용자가 메일을 삭제하거나 수정하면 서버에 메일도 삭제되거나 수정되는 동기화 방식을 사용합니다.

​

실시간으로 서버와 연동하기 때문에 공동 작업시에 효율적입니다.

​

수정하거나 삭제하면 원본 데이터를 잃기 때문에 별도의 백업 관리가 필요하다는 단점이 있습니다.

어떤 프로토콜을 사용하는가에 따라 수집할 아티팩트의 경로나 데이터가 달라질 수 있기 때문에 이메일 관련 아티팩트 분석은 프로토콜을 먼저 파악하는 것이 순서입니다.

​

오늘은 MS 오피스 아웃룩과 윈도우 10 기본 이메일 앱에 대하여 분석해보는 시간을 가지도록 하겠습니다.

​

MS 오피스 아웃룩

​

아웃룩(Outlook)은 마이크로소프트사의 상용 소프트웨어인 오피스에 있는 개인 정보 관리 응용프로그램입니다.

​

제 컴퓨터상에 있는 아웃룩 버전은 2016버전으로 2013 이후 아웃룩 아티팩트 분석 방법을 통해 분석해야합니다.

​

2013 이상 버전은 2007, 2010 버전과 다르게 POP3 프로토콜로 연동할 경우에만 .pst확장자를 가진 파일을 생성합니다.

​

.pst는 personal storage table의 약자이고 IMAP 프로토콜과 연결하여 메일을 동기화할 경우 off-line storage table 약자를 가진 .ost 확장자 파일이 로컬에 생성됩니다.

​

pst 파일은 원본 이메일이 기록된 파일이며, ost 파일은 캐시 형태로 기록된 파일입니다.

​

먼저 ost 파일의 저장경로는 다음과 같습니다.

​

C:\Users\USER\AppData\Local\Microsoft\Outlook

​

이 경로에 이메일주소.ost 형태로 저장됩니다.

​

ost 파일은 서버와 동기화하는 IMAP 프로토콜 특성상 캐시데이터를 보관하고 관리할 필요가 있기 때문입니다.

​

사용자는 ost 파일에 저장할 데이터의 기록 기간을 정할 수 있습니다.

​

예를 들어 1개월로 설정할 경우 서버에서 한달 전까지의 데이터를 다운로드해서 .ost 파일에 기록하고 1개월이 지나면 삭제합니다.

​

ost 파일은 ost viewer를 통하여 열람이 가능합니다.

​

윈도우 10 기본 이메일 앱

​

윈도우 10 기본 메일 응용프로그램은 별도의 설정 없이 기본 값으로 외부 이메일 서버와 연동할 경우 IMAP 프로토콜을 이용합니다.

​

어떤 이메일 통신방법을 사용했는지 알아보려면 다음 레지스트리 경로를 열람합니다.

​

컴퓨터\HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveSync\Partners\{C6340B54-7CC9-4C2B-A135-8C11442A00B7}

윈도우 이메일 연동 프로토콜을 확인 가능합니다.

​

IMAP을 사용하고 있습니다.

​

연동된 이메일은 다음 위치에 데이터가 저장됩니다.

​

C:\Users\USER\AppData\Local\Comms\Unistore\data

​

3은 메일 본문을 저장하고 7은 첨부파일을 기록합니다.

​

각각은 영문자 폴더로 저장되고 폴더 안에는 .dat 파일이 저장되어 있습니다.

​

파일 내부에는 주로 HTML 형태나 파일 원본이 저장됩니다.

감사합니다! :)

 

출처 : https://mandu-mandu.tistory.com/14

728x90

'포렌식 > 컴퓨터' 카테고리의 다른 글

하드링크에 대한 교육  (0) 2022.08.31
Windows Artifacts  (0) 2022.08.18
윈도우 11 설치 여부 확인하는 방법  (0) 2022.07.22
윈도우 11 explore 오류(마우스 오른쪽 실행시 깜빡임)  (0) 2022.07.18
Windows 10 App Store을 통해 설치된 페이스북 메신저에 대한 분석 방법  (0) 2022.05.09

윈도우 11 설치 여부 확인하는 방법

포렌식/컴퓨터
posted by 블르샤이닝 2022. 7. 22. 14:02
728x90

https://geun-yeong.tistory.com/m/73

 

Registry에서 Windows 버전 정보 획득하기

Table of Contents Abstract 본 글에서는 Windows의 버전 관련 정보를 얻을 수 있는 레지스트리를 알아보고, 기존 레지스트리로는 구분할 수 없는 10과 11을 구분할 수 있는 또 다른 레지스트리에 대해 찾아

geun-yeong.tistory.com

 

728x90

'포렌식 > 컴퓨터' 카테고리의 다른 글

Windows Artifacts  (0) 2022.08.18
웹 메일에 대한 포렌식 설명 - Unistore 폴더  (0) 2022.08.17
윈도우 11 explore 오류(마우스 오른쪽 실행시 깜빡임)  (0) 2022.07.18
Windows 10 App Store을 통해 설치된 페이스북 메신저에 대한 분석 방법  (0) 2022.05.09
encase 오픈소스 프로그램 받는 곳  (0) 2022.05.09

티스토리툴바