UserAssist

We talk a lot about UseAssist key and its structure, but I don;t see much talk about what it really means to forensic investigators.  We've seen its structure change since WinXP and now the run count starts from 0 instead of 5 and it has some strange structures, but the time is still there to interpret. 

First of all, we need to understand what we have to check in order to see if it should keep the list of programs that were executed by the user.  If the values are empty, you should not jump to the conclusion that your suspect must have used an evidence eliminator.  It might have been set by the user previously or by the network administrator group policy.

The following image shows the settings that control is you see anything under your UserAssist key in the registry.  Un-checking the first check box not just disable the application logging, but it also clears the UserAssist key of any existing entries. 






The following registry keys correspond to the check boxes above.

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackDocs
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackProgs









Disabling the program logging ( TrackProgs ) will also update the following key.
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids\exefile

Since the start Menu properties window also includes the Power Button Action settings, every time you apply your settings changes, you will see this value also accessed.
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_PowerButtonAction

Note: Just in case if you are interested, its values are:
2             - shut down
1             - log off
256         - switch user
512         - lock
4             - restart
2097168 - sleep

So, the main question I wanted to answer was: Is UserAssist key keeps track of applications that were ran on a machine by a user?




Legend:
Green - Always 0s or Fs
Pink - Run count
Blue - Focus count
Orange - Focus time
Light orange - always same
green - always Fs
Purple - last run time
Red - unused

As you can see above, I can see that I launched calc.exe from its default location twice ( pink area ), but after I've moved it to c:\temp and wanted to start calc.exe, it did not launch and still showed the application run count.  Therefore, my conclusion is that you can not reliably determine how many times a user used an application, but how many time he/she tried to use it.

ISO 9660 - Structure Part 2

The file structure is based on the control of the Primary Volume Descriptor that points to the Root Directory Structure and to the Path Table.  The Path Table Records point back to the Root Directory Structure to locate the actual file content in the proper directory.  It is worth spending time with the date/time entry and digest its structure.  It is very interesting how you can pick up a pattern if you know what you are looking for.

i.e. In this example the file name is "acrobat_installer.exe".  The MAC time for the file as shown in Windows is:

                         Monday, July 01, 2002 - 4:33:00 a.m.

Data shown below: 66 07 01 05 21 00 F0

Year=1900+0x66(102)=2002

Month=07

Day=01

Hour=05

Minute=0x21(33)

Seconds=00

TimeZone Offset = 0xF0(-16)

GMT offset is from -48(West) to +52(East) that makes for 25 hours a day for some reason. 

So, GMT offset -16 is in 15 minute intervals, thus the offset it -16/4= -4 ( EST ).  In my experiments, it seems like some of the burning tools only record the GMT time with offset 00 without applying the actual offset.  I'm still researching why the recoded 5 hours at -4 offset is displayed in Daylight Central Time at -5 as 4 a.m. instead of 5.  If you know it, let me know.

The logical size of the file can be found as the first 4 bytes at offset 10 of the directory record. 009F3020 = 10,432,544 bytes

To find the file contents, we only need to look at the 4 bytes at offset 2 ( little endian ).  In this case, 20010000->0x00000120->288.  Thus, we can jump to logical sector 288 to see the content of this file.

Directory Records

length
     in bytes  contents
     --------  ---------------------------------------------------------
        1      R, the number of bytes in the record (which must be even)
        1      0 [number of sectors in extended attribute record]
        8      number of the first sector of file data or directory
                 (zero for an empty file), as a both endian double word
        8      number of bytes of file data or length of directory,
                 excluding the extended attribute record,
                 as a both endian double word
        1      number of years since 1900
        1      month, where 1=January, 2=February, etc.
        1      day of month, in the range from 1 to 31
        1      hour, in the range from 0 to 23
        1      minute, in the range from 0 to 59
        1      second, in the range from 0 to 59
                 (for DOS this is always an even number)
        1      offset from Greenwich Mean Time, in 15-minute intervals,
                 as a twos complement signed number, positive for time
                 zones east of Greenwich, and negative for time zones
                 west of Greenwich (DOS ignores this field)
        1      flags, with bits as follows:
                 bit     value
                 ------  ------------------------------------------
                 0 (LS)  0 for a norma1 file, 1 for a hidden file
                 1       0 for a file, 1 for a directory
                 2       0 [1 for an associated file]
                 3       0 [1 for record format specified]
                 4       0 [1 for permissions specified]
                 5       0
                 6       0
                 7 (MS)  0 [1 if not the final record for the file]
        1      0 [file unit size for an interleaved file]
        1      0 [interleave gap size for an interleaved file]
        4      1, as a both endian word [volume sequence number]
        1      N, the identifier length
        N      identifier
        P      padding byte: if N is even, P = 1 and this field contains
                 a zero; if N is odd, P = 0 and this field is omitted
    R-33-N-P   unspecified field for system use; must contain an even
                 number of bytes

Path Table Record

 
     length
     in bytes  contents
     --------  ---------------------------------------------------------
        1      N, the name length (or 1 for the root directory)
        1      0 [number of sectors in extended attribute record]
        4      number of the first sector in the directory, as a
                 double word
        2      number of record for parent directory (or 1 for the root
                 directory), as a word; the first record is number 1,
                 the second record is number 2, etc.
        N      name (or 0 for the root directory)
      0 or 1   padding byte: if N is odd, this field contains a zero; if
                 N is even, this field is omitted

Ref: http://alumnus.caltech.edu/~pje/iso9660.html
 

ISO9660 - Primary Volume Descriptor

CDs and DVDs might not be as popular these days as they used to be, but their structure is very interesting from a forensic point-of-view when someone is learning about data structures.  It is interesting how a value can be saved in little-endian and in big-endian formats to provide access regardless of the platform.  The date and time stamps are also not in "standard format" that we seen in most forensic investigations on storage devices.  The application identifier might also be of use in investigations.

 

BytePosition	Field Name	Content
1	Volume Descriptor Type	1
2 - 6	Standard Identifier	CD001
7	Volume Descriptor Version	1
8	Unused Field	(00)17  byte
9 - 40	System Identifier	a-characters allowed18
41 - 72	Volume Identifier	d-characters allowed19
73 - 80	Unused Field	(00) bytes
81 - 88	Volume Space Size	Number of logical blocks in the Volume
89 - 120	Unused Field	(00) bytes
121 - 124	Volume Set Size	The assigned Volume Set size of the Volume
125 - 128	Volume Sequence Number	The ordinal number of the volume in the Volume Set
129 - 132	Logical Block Size	The size in bytes of a Logical Block
133 - 140	Path Table Size	Length in bytes of the path table
141 - 144	Location of Type L Path Table	Logical Block Number of first Block allocated to the Type L
		Path Table, Type L meaning multiple byte numerical values are
		recorded with least significant byte first.  This value is also
		recorded with least significant byte first.
145 - 148	Location of Optional Type L Path Table	0 if Optional Path Table was not recorded, otherwise, Logical
		Block Number of first Block allocated to the Optional Type L
		Path Table.
149 - 152	Location of Type M Path Table	Logical Block Number of first Block allocated to the Type M
		Path Table, Type M meaning multiple byte numerical values are
		recorded with most significant byte first.  This value is also
		recorded with most significant byte first.
153 - 156	Location of Optional Type M Path Table	0 if Optional Path Table was not recorded, otherwise, Logical
		Block Number of first Block allocated to the Type M Path Table.
157 - 190	Directory record for Root Directory	This is the actual directory record for the top of the directory
		structure.  See the section on directory records for the format of this data.
191 - 318	Volume Set Identifier	Name of the multiple volume set of which this volume is a
		member.  d-characters allowed.
319 - 446	Publisher Identifier	Identifies who provided the actual data contained in the files.  a-characters allowed.
447 - 574	Data Preparer Identifier	Identifies who performed the actual creation of the current
		volume. a-characters allowed.
575 - 702	Application Identifier	Identifies the specification of how the data in the files are
		recorded.  For example, this field might contain SGML if the
		files were recorded according to the Standard Generalized Markup
		Language
703 - 739	Copyright File Identifier	Identifies the file in the root directory that contains the
		copyright notice for this volume.  If there is no copyright file,
		this field should contain all spaces (20) Level 1 interchange
		restrictions apply.20
740 - 776	Abstract File Identifier	Identifies the file in the root directory that contains the abstract
		statement for this volume.  If there is no copyright file, this
		field should contain all spaces (20) Level 1 interchange
		restrictions apply.
777 - 813	Bibliographic File Identifier	Identifies the file in the root directory that contains
		bibliographic records.  ISO-9660 does not specify the format of
		these records.  If there is no copyright file, this field should
		contain all spaces (20) Level 1 interchange restrictions apply.
814 - 830	Volume Creation Date and Time	Date and time at which the volume was created.
		Represented by seven bytes:
		1: Number of years since 1900
		2: Month of the year from 1 to 12
		3: Day of the Month from 1 to 31
		4: Hour of the day from 0 to 23
		5: Minute of the hour from 0 to 59
		6: second of the minute from 0 to 59
		7: Offset from Greenwich Mean Time in
		number of 15 minute intervals from -48(West) to +52(East)
831 - 847	Volume Modification Date and Time	Date and time at which the volume was last modified.
		Represented the same as the Volume Creation Date and Time
848 - 864	Volume Expiration Date and Time	Date and Time at which the information in the volume may be
		considered obsolete.  Represented the same as the Volume
		Creation Date and Time
865 - 881	Volume Effective Date and Time	Date and Time at which the information in the volume may be
		used.  Represented the same as the Volume Creation Date and Time
882	File Structure Version	1
883	Reserved for future standardization	(00)
884 - 1395	Application Use	This field is reserved for application use.  Its content is not
		specified by ISO-9660.
1396 - 2048	Reserved for future standardization	All bytes must be set to (00).

17 Numbers surrounded by parentheses () are hexadecimal numbers.
18  a-characters are A-Z, 0-9, _, space, !, ", %, &, ', (, ), *, +, ,, -, ., /, :, ;, <, =, >, ?
  see ISO-9660:1988, Annex A, Table 15
19 d-characters are A-Z, 0-9, _
  see ISO-9660:1988, Annex A, Table 14

20 For a description of the level 1 interchange restrictions, see page <?>

Ref: "Introduction to ISO 9660", Disc Manufacturing, Inc., by Clayton Summers