Tracking Copy vs. Move

In this test procedures, we wanted to examine the time stamp ( metadata ) changes between copying and moving files between the same and different file systems.

 Findings
We can distinguish between copy and move of a file from FATxx and from NTFS to NTFS file system, but we can not distinguish if we are performing these operations to a FATxx files system as a destination.  The main difference is the created time stamp in the Standard Information Attribute ( SIA ) is updated to the time the action was performed while moving the file did not make changes to the create time stamp.  In the case of copying files from FAT32 to NTFS, the modified time stamp did not change while all other time values reflected the time the file was originally created.  In the case of moving a file from FAT32 to NTFS, the created and modified time stamps did not change and all other fields were filled in reflecting the time the move was performed.  FAT16 showed a difference since SIA updated the accessed time stamp in a case of moving it to an NTFS volume while moving the file did not update SIA file accessed time stamp.

Eventtrigers and their danger - attacker

This is the second part of "Eventtrigers and their danger - victim" video where the attacker point of view is examined.  In this case, knowing internal logging policy can be used against the victim by purposely triggering a log event.

SNORT with Database Setup

In this video, I continue setting up SNORT and configure logging to MySQL database.  I also show the testing methodology and monitoring of the database using SNORT Alert Monitor Jr. I modify a rules file to generate quick alerts at different priority levels.

Pivot Charts

Use of pivot charts in Excel makes triage and/or indicators of compromise discovery easier just by examining file metadata and ownership by plotting them on charts.  Pivot charts can be used in many other type of analysis where specific patterns can help the analysis.  Patterns can be easily identified by a visual reference like a chart and pivot charts make the creation and identification much easier.

Be Prepared, not Afraid

This video shows you how to setup SNORT on Windows 7.  As I setup SNORT, I also show you how to troubleshoot problems that you might face in configuring a primarily Linux application on Windows.  One of the most common issues will be the interpretation of folder separators.

Enjoy!