Importing Remnux and SIFT OVA's into Proxmox (New Way to Do It)

EDIT: This post is pretty outdated now, so I wouldn't rely on it.
The REMnux folks have made it much easier to do this now, so this post is a lot of extra steps for nothing. REMnux now has an available qcow2 image you can download and use in Proxmox without all the rest of the stuff I detailed in this post. They also have the other VM options they previously offered as well. You can get the qcow2 image at https://docs.remnux.org/install-distro/get-virtual-appliance#proxmox-qcow2 .

I've used Proxmox (PVE) for quite a few years now for my "home lab" virtual machines as well as various self-hosted servers. For home lab activities, it's nice running a virtual machine on a server instead of having to run it on my laptop using Virtualbox, HyperV or VMWare Workstation.

My experience with PVE has been extemely good from the very beginning. One thing I always wished for though was the ability to directly import OVF or OVA files directly. With the new 8.3 release, Proxmox can finally do that! I decided to try out the new feature by importing Remnux and the SIFT workstation OVA files. I won't go into how to enable the import feature in this post but I can follow up with a separate one if anyone needs help.

I actually set up the import feature a couple of different ways to try it out. First, I added it to the local storage; the same place that ISO files and container templates are stored. I also created a new SMB storage and added the import feature to that. In that case, I created a new directory on a Debian file server I have (also a VM on the same Proxmox server) and shared it so that the files could be accessed there. I then uploaded my OVA files to the two new storage areas and tried them out individually. It seemed like everything was going to work but there was a problem importing the Remnux OVA. Upon trying to import I got this message:

I opened the Remnux OVA file and discovered that the vmdk disk file in it is further compressed in a gzip file and Proxmox couldn't work with that. I manually changed the OVA by removing the vmdk and placing it in the OVA uncompressed (and removed the gz file). This also required making changes to the other files in the OVA that pointed to the gz file. I tried again but got a different error. So then I decided to do it a different way.

I imported the Remnux OVA into Virtualbox and then exported it again from there into a new OVA. I then uploaded the new OVA to the server and imported it. I had downloaded the "general OVA" of Remnux as I thought that might be the best option since I wasn't using Virtualbox. However, the "Virtualbox OVA" I downloaded later does not have the vmdk in a gzip file as the general one does.

Once that was all sorted out I started the import process. 

The first photo shows where I selected the Remnux OVA from the two available files. In this case, they were both stored on my "remote" storage in the Debian file server and had to be imported across the network from there.

This second photo shows where I set the parameters such as VM ID number and virtual machine name. I assign the ID numbers based on which PVE server they are on. I have 4 different servers (I may have a problem), though two are generally not turned on and only used occasionally. In this case, the ID is 212 which signifies it is VM number 12 on PVE server 2. Other than assigning the ID and name I left everything else at the defaults.

After a few minutes the OVA had fully imported across the network and was ready to run. But something still wasn't quite right.

The machine started up but wasn't showing any display when I viewed it in the PVE terminal window. I decided to experiment with the different available display settings in the hardware section of PVE and found that the display just wasn't going to work with the default graphics adapter. I shut down the VM and changed the display adapter setting from the default to "vmware compatible." I started the machine again and everything worked like it should.

 

 

Once it got to the desktop, I enabled the network adapter and started the update/upgrade process. If you're not aware of how to manually enable the network adapter, here's how I did it:

1. From the command prompt, type "networkctl" and find out the name of the adapter. In my case, it was named "ens18".
2. Next, I typed "sudo ifconfig ens18 up" to enable the adapter.
3. Last, I typed "sudo dhclient" to get the adapter to reach out for a dhcp assigned IP address.

That got the network going and I completed the updates.

Next it was time to try importing the SIFT Workstation. I used SIFT a great deal when I was more active in the digital forensics world and it's still a great resource. Anyway, I completed the same import and naming procedure as described above and started the import. It took a little longer than the Remnux import because the SIFT ova is about 1 gigabyte larger.

There isn't much to say about this one. The import just worked and I had no problems with it at all. I did find it was helpful to increase the amount of video memory in the VM hardware settings.

You may wonder how I might get files for analysis to the VM. I use mostly Linux computers in my house and my laptop is no different. If I have a file on it I want to analyze in Remnux or SIFT, I generally just use "scp" to put it there across the network. I then disable the Remnux networking again if necessary.

So, that's about it for now. If you have any questions, please leave a comment!

 

WinFE Course Review

Yesterday, I completed the WinFE course I mentioned in my last post. I wanted to do a review of the course because I found a lot of value in it.

First, what is the Windows Forensic Environment (WinFE)? In short, it is a slightly modified portable Windows distribution with software based write-blocking capability for the acquisition of digital media.It is based on the Windows Pre-Installation Environment and was initially created by Troy Larson at Microsoft. It can be made by anyone free of charge for personal use. It is not a commercial product and there is no support. You are your own technical support, so it's absolutely necessary to understand what you're working with and how it works (to some degree).

The WinFE course is available on the DFIR.Training site. The course, as well as the site are the product of Brett Shavers, a well known instructor/practitioner/author in the digital forensics field. He is the author of the X-Ways Forensics Practitioner's Guide/2E and several other publications including WinFE: Windows

WinFE Book

Forensic Environment. Brett has been instrumental in the continued development of Windows FE and has offered training on it in the past.

The course is divided into 18 lessons, followed by a pre-test, test and then a resources section. The lessons start out by covering some basics, such as what WinFE is (and what it isn't), as well as the topic of write-blocking.

Brett talks a lot in the course about when WinFE might be a good choice and when it isn't. I appreciated that he didn't sell this as the "all you need" solution to all your forensic problems. He discusses keeping it simple (my words, not his) as far as what you include in a WinFE build. WinFE is not meant to be a full forensic suite and indeed it is not. While you can add various tools (X-Ways Forensics, FTK Imager, etc) to your build, you need to decide what you really need and what is just extra stuff that doesn't need to be there, such as an office suite, zip file extractor and so on.

Once you get to the point of actually building your own WinFE, two different methods are taught for doing so. One is the "Mini WinFE" built with tools you can obtain from https://github.com/MistyFromReboot/Mini-WinFE . The second method requires a few more steps to get started, but it isn't terribly difficult to get ready. In fact, both methods are pretty easy to do. Once you have the initial steps done, you can build your own WinFE from either method in just a short time.

Brett also covers topics like dealing with Bitlocker, troubleshooting and hashing. He provides casework  examples as well. One of my favorite parts of the class however is the lesson on testing and validation. The need to test and validate WinFE (and all your software tools) is explained and I was very happy about that. It's easy to make a WinFE boot disk and use it to acquire a drive, but do you know that everything worked right? Do you know if any changes were accidentally introduced to the subject media? I'm so glad this topic was covered because it's just so easy to skip testing and assume all is well.

Something else I really appreciated was the lesson on report writing and testifying. I enjoy writing reports (I'm weird like that) because it present the opportunity to tell a story. I've testified in court related to forensic cases I've worked as well. With both of those things, I'm always happy to hear tips on doing them better, even though I'm not in a position where I'm likely to be testifying in court these days.

Possibly the best part of the course is that you actually have to show your work. You can't just blow through the videos, take a little test and get a certificate. You actually have to build both versions of WinFE to get past the pre-test before you can take the final.

The pre-test consists of answering a few questions followed by providing photographic evidence that you did the WinFE builds (photo of screen booted to each version). You also have to submit a PDF of your validation documentation for either one of the two versions you made. I love that these things were required before the student is allowed to take the final test. I think it lends a lot of credibility to the course certificate you earn when you can say that you actually did something other than watch a few videos to get it. Kudos to Brett for making this part of the course.

After completing the pre-test requirements, you are eligible to take the final test. The 17 question final covered various aspects of the training material. A score of 90% is required to pass. I passed and received my certificate. My next goal is to take the WinFE Instructor training course.

As you can tell, I was very pleased with this class. The instruction from Brett was top-notch. He provided the information based on his own developing and usage experience. He does an outstanding job covering each topic. I didn't come away from any of the lessons feeling like he left anything out. If you have the interest, I highly encourage you to take this course.

Learning and Research Ideas

 What's this? Two, yes two posts. Not just in the same year, but even in the same month! What has gotten into me?

More Training

Yesterday, I completed a course I started a long while back but never finished. I signed up for the Autopsy 8 hour course from BasisTech (https://dfir-training.basistech.com/) and got around halfway through it but, as often happens with me I got distracted and went off in another direction (squirrel!!!). Since it had been a long time since I started it, I decided to start over from the beginning. I enjoyed the course, which was taught by no less than Brian Carrier himself. Psst, hey Brian...in the extremely unlikely event you're reading this, I'd love to see some more online training from you.

Anyway, the course covers general setup and then goes through the various included ingest modules and views you can use to analyze the data. It also covers the various ways of producing reports. If you're interested in Autopsy but haven't used it, I encourage you to check out this course.

Also this week, I started the Windows Forensic Environment (WinFE) training taught by Brett Shavers at DFIR.Training. I'm only a little ways into this course, but I'm enjoying it so far. One thing that I really like is how much Brett goes into great detail on each thing. He explains very well why and when to use WinFE as well as when you should not use it. I've just gotten to the part of the course where the student is shown how to create a version of WinFE called Mini WinFE. It's my goal after completing this training to then go through the WinFE Instructor training as well.

Thinking about Research

Something I've wanted to do for a long time is find a good research project to work on. There are so many fun things to learn and do in digital forensics and I know there is much still to learn. I've been trying to come up with an idea, but I'm still not sure what I want to work on.

 That's all I've got for now. Be well and I'll (hopefully) be back soon with a new post.

Forensics/Malware Courses and Tools

I've been working hard on forensic and malware related courses lately and having a lot of fun with it. I had almost forgotten how cool it was working on and learning this material. I thought I'd give a little update on my activities, so here it is. Take your No-Doz, this may be the longest post I've ever done.

Forensic and Malware Courses

In my last post, I mentioned that I was working on the Practical Malware Analysis and Triage (PMAT) class over at the TCM Academy. I finished the course recently and found it was a very worthwhile course to take.

PMAT was a lot of fun for me. I've always enjoyed looking at malware, but I had never taken a course or really tried to get past the absolute basics. This course was a well designed and taught introduction to malware analysis. The course author/instructor is Matt Kiely The course covered the important topics of setting up your lab and covering how to use it safely. Multiple malware samples were made available for analysis including wannacry ransomware. The course started off with basic dynamic and static analysis and then moved into advanced versions. Also covered were binary patching, maldocs, shell code mobile device malware.

The course involved the use of both Windows and Linux investigation tools. The lab was setup so that you ran both the Windows FlareVM and the Remnux Linux VM for different tasks. Occasionally you needed to run both at the same time, such as using Inetsim on Remnux for the malware sample running on FlareVM to connect to, so you need a computer with high enough specs to run both at the same time.

If you're interested in learning more about malware analysis, I strongly encourage you to check out this course. 

Now that I'm done with PMAT, I'm working on another course, also at TCM This class is called Practical Windows Forensics (PWF). The course author/instructor is Markus Schober. I'm over halfway through it and enjoying it very much. In my case, it's serving as both a refresher on things I "used to know" and teaching me things I never knew as well.

One of the things I've really enjoyed working with in the class is using the Eric Zimmerman tools. I had never used any of them before and I see now why everyone talks about them so much.

In PWF to this point, I've really liked learning again about NTFS artifacts. I had never really known much about the USN journal and it's forensic value, so finding out how to access this information has been great.

I'll follow up when I've completed the class. I intend to go back over some topics again before truly being done with it.

I bought another malware related course this morning on a LinkedIn contacts recommendation. I purchased Reverse Engineering and Malware Analysis Fundamentals on Udemy. The course author is Paul Chin. I'm not going to start it until I've finished the other courses I'm taking.

I'm kind of "on-hold" with the GRC class I mentioned last time. I've gotten so excited about forensic and malware training that I just put that one aside for the time being. It's a great class and I'll get back to it, but I've just got too many other things grabbing my attention right now.

  Tools

Jobparer.py

Some years ago, Jamie Levy wrote jobparser.py for parsing Windows .job files. The script was written for Python 2.x. Recently I have been working on a short course on Cyber5W Academy called Investigating Windows Scheduled Tasks and it called for the use of Jamie's script in one part. I, like many only have Python 3 installed on my Linux laptop, so this morning I converted the script to work in Python 3. The conversion was partially done with a conversion tool and I manually fixed what it wasn't able to. I sent it to Jamie and she said she would add it to the Github page.

(edited to clarify that I used an online Python at https://python2to3.com/ conversion tool to help me convert the script. It missed quite a few things, so I manually fixed the rest. No, it wasn't chatgpt or anything like that 🤣)

Qu1ckSc0pe

I wanted to talk about a couple investigation tools I only recently learned about. The first one is called Qu1ckSc0pe and you can find it HERE. According to the Github page, Qu1ckSc0pe is and "All-in-One malware analysis tool for analyze Windows, Linux, OSX binaries, Document files, APK files and Archive files". To this point, I've only tried Qu1cksc0pe with Windows executables, but as you can see it's capable of far more.

Qu1ckSc0pe iterates through the file being examined and pulls out a great deal of information. It pulls strings and does Yara rule matching, highlights "interesting" imports and other patterns, pulls out the time/date stamp and file hashes and much more. If you provide your VirusTotal API key, it can also check for VirusTotal detections and report on those.

This is an excellent tool I can see myself using a lot. Go check it out!

Events-Ripper

Events-Ripper...sound at all familiar? It should. If you've ever used the great RegRipper, then you might guess Events-Ripper comes from the same place and you'd be right. Both are the creations of Harlan Carvey and Events-Ripper is operated in much the same way as RegRipper, except it's goal is to parse evtx files for you. Specifically (according to the Github page),

"the current plugins extract value from the following Windows Event Logs:Security.evtx System.evtx Application.evtx Microsoft-Windows-Windows Defender%4Operational.evtx Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx"

Using Events-Ripper for the first time on an investigation requires you to create an "events" text file by running a batch file. The batch file relies on logparser and evtxparse. This might be done like this:

wevtx.bat c:\case\*.evtx c:\case\events.txt

Once the events.txt file (or whatever you want to call it) is done, you run the main program along with the appropriate plugin to get the data you're looking for. The syntax is like this:

erip -f c:\cases\events.txt -p <plugin-name>

or

 erip -f c:\cases\events.txt -a

to run all the plugins once

Also, using -r will allow you to run a profile instead of just a single plugin. The tool works quickly, printing the output to the terminal you're working in or you can redirect the output to a text file.

One thing that I love about this is how Harlan included investigative tips or hints in the output of many plugins. This helps you know how the data might be useful to you or indicative of certain things.

So, this post has gone on far longer than I expected, so I'll end it here. I'll be posting again soon.

Accomplishments and Goals

Hello everyone! I'm back for yet another drive-by blog post. I've had a lot going on since my last post in December and I thought I'd catch you up a little.

First and foremost, I graduated! It happened 35 years later than I'd originally intended to, but I finally made it. I graduated with honors from Lincoln Trail College (also my awesome employer) last week. It wasn't something I needed to do, but it's a goal I always regretted not accomplishing until now. So now what?

Despite being done with school, I'm not giving up education. I've already set some new learning goals and I'm working on them as I have time.

I recently started a malware analysis course. I'm nearly halfway through the Practical Malware Analysis & Triage course at the TCM Security Academy The course is authored by Matt Kiely. I've always had an interest in malware analysis, but this is the first course I've ever taken on it. I'm really enjoying it and learning a lot.

I also signed up for The Definitive GRC Analyst Master Class by Dr Gerald Auger. The class is very good so far. I've had very little exposure to GRC (Governance, Risk and Compliance) topics before and Dr Auger explains each of the topics very well. I'm still working my way through this class.

There are a couple other courses I picked up but I haven't decided yet which I'm going to start once I'm done with the two above. I feel like it's good to always keep learning, so I'm sure I'll keep on with courses that interest me as long as I have the time and energy to do them.

I continue to dabble in Python from time to time. I've written a couple little scripts to help with things I do at work, but they're nothing groundbreaking. Just little things to help me get my work done more easily.

I still have the goal of writing on this blog more, but it seems like so many other things take precedence. I've always enjoyed writing, so maybe I'll eventually get back to it on a more regular basis. Hopefully it won't be another 5 months until my next post, but who knows?

That's pretty much it for now. At the moment, I'm spending most of my time preparing for my granddaughter's wedding which will take place in my front yard next weekend. Until next time, I hope you all are well and living your best life.

A Little Homelab and Life Update

I'm going to start writing more on my blog. No! Really! You do believe me, right? Ok, can't blame you if you don't. I come back to this from time to time and think this time I'm really going to dive into it, only to get sidetracked in some other direction. I promise I have a good excuse this time.

Since I last posted, I have gone back to school on a part-time basis while continuing to work full-time. I decided it was high time to finally get that Associate's Degree I started on decades ago. My days have consisted of going to work in the morning and going home in the evening to do homework. I just completed the Fall semester which included a Technical Mathematics class and a Speech class. I enjoyed both classes quite a bit, but I must say I'm glad for some down time of an evening for a while. We're on Winter break now and I'll only have one class left to take in the Spring semester which will allow me to finally graduate in May.

I haven't completely ignored my home-lab efforts during this time, however. I've re-done most of what I talked about in my last post, lo those many months ago. Now there is no domain controller, though it may return someday when I have more time to really learn it. It was an interesting exercise and not hard to get setup initially, but I found I really needed focus on other things first.

I finally added a home built pfSense firewall/router as the gateway for my network. It is connected to my ISP fiber modem and then everything else goes from there. I've been learning about vlan's and have setup a couple in pfSense and my old MikroTik RB260GS switch.

I've been learning about Cisco as well and am fortunate to have a couple old Cisco switches a friend gave me. I can hook them up when I need to, though they're both a little too noisy and power hungry to use all the time on my little home network. Those fans really get to going at times, so I only power them up if I plan to spend some time in Cisco training.

I still have my Proxmox virtual machine server running and I've been trying out several different things using VM's on it. Most recently I set up a NextCloud server, a Guacamole server and a Cloudflare Argo tunnel so I can reach the NextCloud and Guacamole from anywhere. Finally, the VM I was using as a file server was getting a little unstable for some reason, so I created a new one to replace it and then removed the old one after migrating all the stored files off it.

I'm off for a couple weeks now since the college is closed for break, so I'm sure I'll work on some more of this stuff soon. I'll try to do a more timely job of posting about it, but I make no promises I can't keep.

Setting up My Learning Environment

First, welcome to my renamed blog. I couldn't think of a good name for the blog years ago when I first started so I just settled for the most boring name I could think of, "Digital Forensics Blog". Granted, that was the main focus but it was just boring. A while back, I tweeted that I was looking for a better name. Phill Moore suggested Pryor Knowledge which I liked, but I decided to change it to No Pryor Knowledge. As I said in my last post, the focus will be a little wider here now but I'll still talk about forensics sometimes while other topics will also be featured as well. So, on with the post.

Not sure if this is a good thing or a bad thing, but I have many different interests when it comes to tech. My first love was just learning anything I could about repairing computers. Later I deeply fell for digital forensics and was fortunate to have the opportunity to learn from people like Mark McKinnon, Luby Novitovic, Harlan Carvey, Rob Lee, Jimmie Weg, Ali Hadi and so many others. Forensics held my full attention for a good while and is still a great interest. I still do forensic CTF's from time to time and always enjoy learning from them.

Later, I got really interested in security and blue team ops. I've watched countless security related videos and worked through online training environments like TryHackMe and Rangeforce. These things too are still of great interest to me.

I eventually worked my around full circle to my my enjoyment of just doing builds and repairs with the addition of servers and networking. I recently got a job that allows me to work in those areas every day and I'm loving it.

While I'm not over the servers or network, I am frequently involved in work related to those things. I wanted to learn more about networking, servers, Active Directory and Group Policy. I've watched videos, but I learn a lot more from watching the videos, reading books or blog posts and then doing hands on. This led me to set up a new learning environment at home.

I set up a Proxmox Virtual Environment (PVE) server on an old computer and connected it to my home network. I then set up a Proxmox Backup Server (PBS) on a separate computer. I wanted a separate device maintaining all the backups I knew I'd be making of my virtual machines.

Once that was all in place, it was time to set up my own local domain. I certainly didn't "need" a domain for my home network but it's nice having it as a learning environment that I can restore from backup anytime I mess it up.

 I decided to build a domain controller with the Zentyal Linux distribution. Zentyal allows you to set up a controller compatible with Microsoft Windows Active Directory and that allows you to administer your Active Directory environment using Windows tools in Windows instead of having to use Linux. I thought this was my best option because Zentyal is free to use (there are paid subscription plans as well) and I could still administer it with the tools available from Microsoft.

I decided my domain controller would exist as a virtual machine instead of running yet another computer. I downloaded the Zentyal ISO to Proxmox storage and then created the new machine. I gave it 6 gigabytes of RAM and a 250 gigabyte virtual hard disk. That was more than enough disk space, but I'd really like to have a little more RAM available for it. Still, it works pretty well for my home network. It would need a lot more RAM if it were a production network for a business. I'll go over the setup of my domain in greater detail in a future post.

In addition to the domain controller, I also set up another virtual machine on PVE to use as a file server. This VM is an Ubuntu Linux Server and I use it for simple file storage as well as using it for a DNS server for my network with Pi-Hole. I have a second install of Pi-Hole running on a Raspberry Pi and duplicate my settings between the two. I have both of them set up as DNS forwarders in my domain controller and they take care of that mission plus blocking ads too.

I still have very much to learn. I've just barely scratched the surface of working with AD and Group Policy. It's fun learning new stuff and getting a better understanding of what our admins are doing at work. My future plans include adding a pfSense or OPNSense router/firewall to my network to learn more about networking and vlans's.

I'll end this here for now. I have a lot of ideas for future posts and will hopefully be back with another one soon.

Ch Ch Ch Changes

I came back to this blog a little over a year ago or so thinking I'd really get back into writing. I was missing talking, thinking, doing and writing about forensics. I still do miss all those things but it seemed like I just couldn't find the time to really do anything about it. My job consumed so much of my time and energy that there just wasn't much left for anything else. My last post here was nearly a year ago.

Since then, life has taken a very positive turn. I enjoyed the work I was doing in the home improvement store electrical department but it wasn't really where my heart was. I knew I still wanted to be working in some type of tech related job but I didn't see much chance for that. That changed back in February when I fell into a job I absolutely love. My daughter texted me about an IT technician job for our local community college she'd seen posted. I taught an introductory computer forensics course there a few years back and knew it was a great place to work.

My first thought upon receiving the text from my daughter was "I've got to apply for this now!" The second thought came from my ever present self doubt saying "they'll never want to hire me" and I proceeded to forget about the job for a while. A few days, maybe a week later I decided to go ahead and take a chance and apply. Much to my surprise and delight I was called for an interview. A few hours later I got a call offering me the job and I immediately accepted.

I had no experience working with IT on this level before, so it's been a fun learning experience so far. While I ran my own part-time IT business for many years, my clientele was largely home based with just one or two computers or other devices. In this new job I'm enjoying learning about working with computers and other devices on a large network. To help me learn about things like Active Directory and Group Policy I decided to set up a domain on my home network. I've got that up and running now and will be doing a new post about that "soon".

My plan at this time is to start blogging more but broaden the subject range. While I will still write about digital forensic topics from time to time, I'm also going to write about other tech stuff that I'm learning and doing.

So I'm wondering if my blog needs a different name. It currently has the most boring name I could think of and it would be nice to change it. Someone suggested I change it to "Pryor Knowledge" a while back (EDIT: It was Phill Moore who suggested Pryor Knowledge...thanks Phill!)

"Pryor knowledge"

— Phill Moore (@phillmoore) October 16, 2020

I considered that but came to the conclusion that "No Pryor Knowledge" might be more appropriate. If you've got a good name for the blog, make a comment below and let me know!

Training! Cyber5W, CyberDefenders and more

Hello all, thanks for looking in.

As I continue trying to figure out what I want to be if/when I grow up, I'm finding so many awesome learning resources, including websites that offer basic introductions to DFIR and other infosec topics along with sites that have challenges to work through. I mentioned in an earlier post that I was considering a move toward learning to be a SOC analyst and that is still a possibility, though not my final goal. I hope one day to qualify for a digital forensic role with some company and I'm trying to learn all I can to make that happen. While I've been working on blue team training and exercises, I keep seeing amazing DFIR training opportunities and find I'm spending a lot more time on them than anything else at the moment.

I've recently started working on challenges at CyberDefenders. They have a variety of challenges for disk and memory forensics, malware, network traffic analysis and more. I completed a memory forensics challenge there a couple days ago called DumpMe. I had forgotten how much fun it was to work with Volatility. I learned a lot doing the challenge.

As has usually been the case for me, my training budget is mostly non-existent so I'm always on the lookout for low cost/no cost learning opportunities. I saw mention of a new training site while viewing my Twitter feed a couple weeks ago and I'm excited to see this site develop.

The Cyber5W Academy has multiple low cost and no cost training courses available. The 5W part of the name alludes to "who, what, where, when and why. The site is run by Professor Ali Hadi, Ph.d, who also teaches forensics and security courses at Champlain College. Cyber5W offers digital forensic consulting and on-site training as well.

The courses are broken down into three categories: Intro to Forensics, Windows Forensics and Linux Forensics. Quite a few courses are already available and many more are under development. All courses at the time of this post are either free or $50. The courses are online PDF based and include instruction, hands on exercises and the occasional quiz. Each course provides a certificate of completion as well.

I've been working my way through the Intro courses as I try to find my way to a DFIR role somewhere. They are helping me remember so much of what I've forgotten over the 5 years since I last did any forensic work. They are also introducing new ideas and helping me get up to speed on what is the current norm for forensic investigations. I especially liked the digital forensic reporting course, as reporting has always been something I enjoy. I intend to work my way through the available courses in all three categories.

I contacted Ali Hadi to thank him for this great learning opportunity and asked if he would tell me about his motivation for creating the Cyber5W Academy. He kindly replied and allowed me to share his thoughts here on the blog.

The Nobel Prize for an educator, is seeing his students being successful. There is literally nothing better than that and those success stories are prizes I love to collect. Now, currently teaching at Champlain College, allows me to engage with how many students per year? A hundred, two hundred, triple that number? It's good, I'm grateful, but still not much! But what if I am be able to teach and engage with thousands around the world? That's a great motivation! This is not the first educational organization that I have established, there are others, and they all share the same core goal "helping others".

Ali has created courses on other sites as well, including Hacking Techniques and Intrusion Detection, Digital Forensics Professional and Malware Analysis. He also has Offensive Software Exploitation and other great material on his YouTube channel.

I've received so many positive feedback, thank you and appreciation messages, network connection requests, etc, which I'm very happy that I was able to help those students advance in their careers, but also grateful for the opportunity. I thought now is the time in my career to start my own path and focus on something that I really love, which is teaching Digital Forensics.

He views Cyber5W as a way for him to help others, notably including those with little money to spend on quality training.

I do not want money to be a barrier for those who want to learn; I want to help as much as I can. Another important aspect, is the world is now so dependable on technology, and this means more abuse/crime/incidents/etc are going to happen. Unfortunately, that's true, so we need more investigators/fighters, we need more people to make this world a better place for our beloved ones. Therefore, I hope C5W will be able to encourage new people to start their DFIR journey, raise more awareness to DFIR, increase the DFIR community members, and also be a resource they can all depend on!

I'm looking very forward to seeing what all Ali has in store for Cyber5W. I'm having fun learning from his courses and can't wait to see what's next.

One other course I just purchased yesterday and plan to start working on soon is Cyber Security Incident Response: Wannacry Ransomware. The course is on Udemy and was authored by Balazs Lendvay.

The course is designed to teach the following (list taken from the Udemy course page):

Investigate and understand the behavior of the Wannacry ransomware in a lab environment using your own computer if you will.
Triage and identify indicators of compromise.
Live-analysis of the infected lab machine for windows artifacts
Static-analysis of the identified executable and artifacts
Sandbox analysis of the malicious activity, including network activity, processes, services, autoruns
Create a summary report of the incident and identify remediation recommendations

I've always liked learning about malware analysis, so it should be a lot of fun working through this course.

By the way, have you noticed how I keep mentioning the word "fun"? That's because learning is fun and it's my hope that more people will come to realize that. I'm very grateful to the people behind all these low cost and no cost courses for making this kind of fun available.

And with that, I will end this post. Hope to be back soon with some more cool stuff.

Running Remnux on a Proxmox Server

One of techy things I really enjoy is working with virtual machines. I decided to set up a VM server a while back. There are several to pick from, but just for the sake of learning something new I set up a Proxmox Virtual Environment. While the computer I installed it on is ancient (AMD Phenom X4 965 with 8GB RAM), it still seems to run pretty well. I've been running two different Ubuntu server VM's on it since then. One is a Minecraft server for the grandkids and friends (and maybe me too) while the other is a simple file server. I also have one Windows virtual machine on there, but rarely use it.

Today, I started the Performing Malware Analysis on Malicious Documents course by Tyler Hudak on Pluralsight. The course makes use of the great Remnux Linux virtual machine by Lenny Zeltser. For those unfamiliar (if any such person exists), Remnux is a distro dedicated to malware analysis and comes with tons of malware analysis tools. Instead of adding Remnux to my nearly full laptop hard drive (too many other VM's taking up space), I decided to run it from my Proxmox server instead.

Remnux is available for download as a .ova file. The ova file is simply a compressed file containing other files. The files within the ova can be extracted with tar or 7zip (I used the 7z command line version). The only file within that we care about for this situation is the .vmdk virtual hard drive file. I went on to the next step while waiting for the vmdk to be extracted. I should note that what I describe below should apply for most any ova file. I just happened to be using Remnux.

Importing a virtual machine from an ova file to Proxmox isn't exactly a straightforward thing to do, but if you don't mind spending just a bit getting it ready it will work just fine. I'll talk about one issue I encountered later in this post.

The first step over on the Proxmox server is creating a new virtual machine. I won't go through the entire process of doing this, as there are plenty of other guides out there explaining it. However, during the creation process you are asked to create a new hard drive. Go ahead and do it, although we'll delete it later. I created the machine with a virtual dual-core processor, 4GB of RAM, a 10GB hard drive and accepted default setting for everything else.

Upon creating the VM, it was assigned an ID of 103. This meant that the temporary hard drive I mentioned above was created at /var/lib/vz/images/103 on the server. This temporary hard drive was just created so that the above directory would be created. This is where the Remnux vmdk we extracted earlier needs to be placed for the next step.

To get it there, I uploaded the vmdk from my laptop to the Proxmox server using the scp (Secure Copy) command. The syntax for the upload looks like this: scp <file-to-upload> <user@ipaddress:/path-to-folder>. In my case, it looked like scp remnux-v7-focal-disk1.vmdk root@192.168.x.x:/var/lib/vz/images/103. With that done, it's time to switch over to the Proxmox server view page located at <server-IP-address> port 8006 and start working in a shell (see pic).

Remember, you're logged in here as root so be careful if you're not really up on working at the Linux command line.

Upon logging in to the Promox page and going to the shell, we need to navigate to the directory mentioned above where our hard drive was uploaded to. Once there, we can just delete that temporary hard drive we created with a simple rm <filename>. In this case, it was rm vm-103-disk-0.qcow2. That leaves us with only the vmdk file still in the directory. Now, we have to convert it for use with Proxmox.

Still working from the command line, we need to type the following command: qm importdisk 103 remnux-v7-focal-disk1.vmdk local -format qcow2. The 103 in all of that of course is our machine ID. The command will convert our disk file from a vmdk to a qcow2. Qcow2 is a file format for QEMU virtual machines. Upon completion of the conversion, we are left with the original vmdk file and the newly created vm-103-disk-0.qcow2. We can now safely delete the vmdk as we won't be needing it anymore.

Now we go to the hardware settings for our new VM. We'll need to add our new hard drive to the machine. You'll see it listed as an unused hard drive. Double click it and check your settings. Once satisfied, you can click Add and it will be attached to your VM. In my case, I set the drive as a SCSI device and clicked Add. My hardware settings are picture below.

Next I clicked options (see pic) and double clicked the boot order setting. I clicked the check box to enable the hard drive and then dragged it to the top of the boot order.

We're done! Well, almost. After getting the boot order set, I switched to console view and clicked Start to boot the VM. In the console I was greeted with...a black screen. That's it. A little troubleshooting led me to change the display settings in the VM hardware from default to VMWare compatible and finally I got to the Remnux desktop.

Finally, once on the Remnux desktop, we need to enable networking so we can update. At the Bash prompt in the terminal, we type sudo ifconfig ens18 up. Actually, type sudo ifconfig -a to make sure yours shows up at ens18 as well and adjust accordingly. It didn't pick up an IP address at first in my case, so I typed sudo dhclient ens18 and the IP was set. After that, it was just a matter of running sudo apt update and sudo apt upgrade to get things updated.

If you have any questions or if I got something wrong or left something out, please comment below and I'll take care of it. Have a great day!

Feeling kinda blue (team)

Hello all! It took me much longer than I had planned to post again, but life has a way of keeping one busy. Between extra crazy hours at work, spending two weeks in bed "enjoying" the Covid-19 experience and otherwise just being busy as heck, I'm finally back to write a little.

In my last post, I said that I felt like it was unlikely I'd work in a digital forensics or any other security role ever again. I just didn't feel like I had a real chance to do anything in the field again. However, thanks to a lot of encouragement from a good friend, I'm studying and hoping to land a job as a entry level SOC analyst. The work seems very interesting to me and I believe it's something I would love.

Just like my earlier days getting into digital forensics, the ol' budget is pretty much nothing, so I'm actively searching out free and low cost training opportunities. The best source I've found for information on free and low cost training is on the DFIR Diva site. Along with her training information pages, Elan has so much more on the site that helps security noobs and veterans as well. I nominated her site for the DFIR Resource of the Year Forensic 4:cast Award and I hope you will too. There are so many great resources out there, but I think this one deserves recognition for it's fantastic wealth of information for those new or returning to the field.

One fantastic training I attended last month was the SOC Core Skills course taught by John Strand. This is a 16 hour (4 hours per day, 4 days) class that teaches entry level folks the basics they need to work in a SOC. It includes both lecture and labs. From the course info page, here's what the class teaches:

1. Core networking skills
2. Live Windows Forensics
3. Live Linux Forensics
4. Memory Forensics
5. Active Directory Analysis
6. Network Threat Hunting
7. Basics of Vulnerability Management
8. The Incident Response Process

The class is "pay what you can", so there is no reason for anyone to say they can't afford it. I was very impressed with the quality of the training. A Windows virtual machine is used in the course and it has all the lab materials. The lab materials are frequently updated.

Another opportunity I'm taking advantage of is the community version of Rangeforce. This free version of the site includes 20 course modules covering such things as Splunk, Docker, regular expressions, Kubernetes and so much more. This is an incredible resource and I'm learning a lot from it. The modules are taught in virtual machines so you can do hands on learning. I absolutely love this site and encourage you to give it a look.

I'm also training on the TryHackMe site. Like Rangeforce, there is free and paid training available and it too uses virtual machines in the browser to perform the labs. I'm having a lot of fun with this site too. I'm enrolled in the free Cyber Defense path which includes modules like Intro to Networking, Network Services, Active Directory Basics and more.

I've spent a little time on LetsDefend.IO This site simulates working in a SOC environment and does it pretty well. I've worked through the free exercises and plan to subscribe soon so that I can do more.

Finally, a great video resource I've found is the YouTube channel of Gerald Auger called Simply Cyber. He does a lot of great videos on getting into Cyber Security.

So that's all I've got for now. My progress through all of this is pretty slow, given my work schedule. When I have free time, I spend a lot of it working through this excellent training and look forward to finding more. Hope you all are well and thanks for reading!

Where the heck have I been?

In the unlikely chance that someone will read this, I thought I'd just say hello and talk about what I've been doing since my last post nearly two years ago. Since then, I've disappeared from and then reappeared on social media and got a new job.

I'm currently in a job completely unrelated to anything I've ever done before. I'm working for a national home improvement store chain in the electrical department. I've learned so much about home electrical wiring and everything that goes with it and I'm really enjoying it. The hours are pretty crazy, but the work is usually enjoyable. After almost 4 years of retirement, I needed to get off my butt and do something productive again.

With all that said, I've recently started re-engaging with the DFIR world. This is because I missed learning cool new things and then experimenting with them on my own. From the first time I ever learned about digital forensics, I've been fascinated by it and all the different things that fall under the DFIR umbrella.

More importantly, I've missed the people. I made a lot of good friends over the years and I've lost touch with them for the most part, which I truly hate. So I've started trying to get back in touch with old friends and hope they're interested in being back in touch with me.

While I don't know if it's likely I'll ever work in any DFIR related job again, I still want to stay engaged with it. I love it and it's good for the brain to keep learning. That's why I've signed up for some free training courses and am working through them at the moment.

The courses I'm currently taking are both from Basis Technology. One is an introductory course called Intro to DFIR: The Divide and Conquer Process. The other Basis Tech course I'm taking is Autopsy Basics and Hands On. Both courses are online. I'm learning new investigative concepts, as well as being reminded of things I used to know and had forgotten about. I'm grateful to Basis for making these courses available.

My current plan, such as it is, is to continue these courses just to get my mind active on the subject(s) of DFIR. I've already started realizing just how much I've forgotten and how much has changed over the last few years. I'm excited to be thinking about these topics again. 

I reopened this blog in hopes it will prompt me to continue learning and writing about what I've learned. I always enjoyed writing and have missed doing it on a regular basis.

Be well and I'll be back with another post soon.

DFIR Training

Hello all! Back again, though not as soon as I had thought. Anyway, today I want to tell those who haven't already heard about the training offered by Brett Shavers. His courses have recently moved to a new home at https://www.patreon.com/DFIRtraining. This is where you will find all his current courses, as well as new courses as they come out. All courses are bundled and available for a monthly subscription.

I reviewed his old WinFE course four years ago. You can read it HERE, although that course is no longer active. I have also had access to his older X-Ways Forensics course and learned a lot from it.

While I haven't taken any of his newest training, the courses I've seen were great. The material itself is very well prepared and presented. The video and audio quality is also good, with items on screen easy to see and understand.

DFIR training is usually very expensive, as we all know. Brett is offering some high quality training at a fraction of the cost of many other courses. I plan to become one of his Patreon supporters soon and experience his newest offerings.

Brett also started a DFIR oriented social network at https://social.dfir.training/. There are currently three groups on the site. One group is for DFIR Book Giveaways. Group members have the opportunity to win DFIR related books on a monthly basis. The other two groups are a SANS FOR 508 study group and a WinFE group.

Kudos to Brett for all he's doing with these sites. I encourage you to support him on his Patreon page and take part in some good DFIR training.

Life Update, a little Object ID research and More

It's been just over two years since I retired from the police department. As a retiree, I've enjoyed a lot of time with my wife, kids and grandkids, spent a lot of hours on my tractor, taken many walks in the woods and generally enjoyed life. As much as I've enjoyed my time off, I've realized I'm too young to be "really" retired.

While trying to figure out what I want to be when (if) I grow up, the field of digital forensics is always at the top of my list. I've missed the fun of learning cool new things and I miss solving cases. I often think back to my first case and how much I enjoyed doing that investigation. Finding what was on the computer and being able to report how and when it got there was so cool. Doing my own testing to find how artifacts were created and using that testing to help me tie the illegal materials in question to a certain user account, eventually getting a conviction was something I'll never forget.

I know that getting into forensics in the private sector won't be easy for me. I've accepted the possibility that it may never happen, but I'm going to give it a try. I know I have much to learn and catch up on. But honestly, learning the material is at least half the fun, right?
-------------------------

Speaking of learning, I watched the Forensic Lunch Test Kitchen with David Cowen a few days ago. In the video, he demonstrated the difference between Windows 7 and Windows 10 when it comes to the creation of an Object ID for a file. I recreated the test he did here and got the same results of course. But I started thinking about what may or may not change those results.

I wondered what might happen if I created the file as David did and then copied it to another location on the disk. I created a file called Never-opened.txt in my Documents folder. It was automatically given an object ID as expected from the earlier test. Next, I copied the file to another folder and used fsutil once again to check for an object ID for the copied file. In this case, no object ID was assigned.

Finally, I cut the file from it's original location and pasted it to another folder. the object ID traveled with the file to its new location. I went back and opened the copied file and as expected, a new object ID was created for it.  This testing all occurred on a Windows 10 Home system.

After talking with David, I've got a few other things I want to test as well. I'll post more when that's been done.
-------------------------

Finally, Brett Shavers wrote an excellent post on his blog How to start a digital forensic lab in your police department. The experiences he talked about were very similar to mine. He's absolutely right that you can make it happen, but it takes a lot of work and commitment to get it done. I was fortunate to have a chief who was very receptive to my ideas and helped me make it happen.

I wrote several grants to get funding for software and hardware. In addition to Federal grants, I was able to obtain funding from two different local foundations and one corporation. I like writing anyway, so getting to write a grant narrative explaining what I wanted and why was an enjoyable part of the process

Brett also talked about training. Like he mentioned, I paid my own way through some of my training (SANS FOR 508, 526 (old version) and 558 (old network forensics course). However, being in law enforcement, I also had the opportunity to attend training put on by the National White Collar Crime Center (NW3C). I took the NW3C BDRA and IDRA courses and those gave me an excellent introduction to the world of forensics prior to my SANS course attendance. If you are in in law enforcement, make sure you take advantage of the courses available to you for free through the NW3C.

-------------------------

That's it for now. I hope to start posting a little more often as time allows. Be well!

DFIR Reminiscing

Hello all. I have a new, mostly non-forensics blog that I occasionally post to. I just posted yesterday on a topic that I thought would be interesting to readers of this blog as well. The post is about fun/cool stuff I've acquired over the last few years from conferences and friends. Instead of re-posting it here, just take a look at the post on my Mental Field Trip blog.

2017 Forensic 4:cast Awards Nominations are Open!

Just in case anyone still stops by this blog, I wanted to post that nominations are now open for the 2017 Forensic 4:cast Awards. Click HERE to go and nominate your favorites. I think the 4:cast Awards are a very good thing for the DFIR community and encourage you to participate. Thanks to the great Lee Whitfield for continuing to run the awards program every year. Your efforts do not go unappreciated.

Regarding my last post way back in July, I was unable to attend ArchC0n 2016 due to illness. I'm really sorry to have missed it, especially since I learned recently that this was the final ArchC0n. Congratulations and thanks to Paul Jaramillo and crew for what was an excellent conference.

Since my retirement, I haven't been especially active in the world of forensics. I did work one case for the local sheriff's office that involved a Raspberry Pi. That was my first Linux related investigation and it was pretty interesting. When I get some time and my thoughts together, I'll try to post about it as it was fun working something different than a Windows case.

Till the next time, take care and don't forget to head over to the Forensic 4:cast website and nominate your favorites for an award.

ArchC0n 2016

 Hello Dear Readers. I hav returned to the blogosphere (I hate that term) to remind you of a great security conference coming up. ArchC0n 2016 will be held August 26 at the Hyatt Regency in St. Louis.

This will be the third annual ArchC0n and once again it looks like it's going to be a great one. I've attended the previous events and had a great experience with each. I cannot recommend this conference enough.

 I like to call ArchC0n the "little con that could" because, for a new conference, they've consistently come up with great speakers and workshops. This year looks to be no different in that respect. Malware is one of  my favorite subjects and there will be plenty of info on that topic presented by Harlan Carvey and Andrew Pease. I've attended several of Harlan's talks over the last few years and can tell you he's an entertaining speaker.

Likewise, I've previously attended talks by Kyle Maxwell, Andrew Hay, Robert M Lee and Scott Roberts. Each of them is someone I look up to in the field and I'm excited to hear them speak again. You can view the full list of speakers and trainers HERE. The program schedule can be found HERE.

I'm planning to attend ArchC0n 2016 and I hope to see you there too. It's a great conference and it's one that I hope will continue to be an annual event for a very long time to come. Follow the ArchC0n Twitter account for news.

Farewell to a Friend

As many of you know already, our friend and fellow forensics practitioner, Ken Johnson, was killed last night when the vehicle he was riding in was struck by a drunk driver. To say that those who knew him are saddened by this is an understatement. Ken was a great guy and great at DFIR.

When Windows 8 arrived on scene, Ken began studying its file history and other related features. He became an expert on the subject and presented his findings at conferences. I remember speaking with him after one of his early presentations and he wasn't happy with how he had done. But I was lucky enough to attend several other of his presentations and I remember telling him after one of them how much more confident he seemed at the microphone. Each time I saw him present he was better than the time before and I was so happy to see him doing well.

Ken and I spent quite a bit of time together at the last WACCI conference. I had been asked to fill in for David Nides and present in one of the breakout sessions. Ken was the guy building me up that time. I was nervous, as that was the first (and so far only) time I had presented to a DFIR group. We attended each others talks and he was very supportive, making it sound like I did better than I  probably really did.

When I finally got my first Windows 8 investigation, Ken was the first one to volunteer his assistance. As it turned out, I wound up asking him several things and he was very helpful.  

The last time I saw him in person was a couple years ago at ArchC0n in St. Louis, though we had corresponded occasionally via email, Twitter or Facebook since then. I will miss his friendship and smile. I am thankful I knew him and got to spend a little time with him. I offer my condolences to his wife and children along with his entire family and colleagues at KPMG. Rest in peace Ken.

The End

The time has come to say farewell. My time in both law enforcement and in digital forensics is rapidly coming to an end. I have reached the age at which I decided long ago I wanted to retire from police work.

Despite my occasional gripes, law enforcement, specifically my department, has been very good to me and I am grateful. It has been an exciting, boring, depressing, thrilling, scary and interesting job over the last 28 years. It's not every line of work that allows you the thrill of being pepper sprayed and shot with a Taser without being taken to jail shortly thereafter.

Law enforcement opened the door to my entry into digital forensics. I came in to DF barely knowing what it even was, but my interest in computers mixed with my desire to fight crime drove me to get more involved. I've had a few interesting cases, seen a few images and videos I wish I could forget and felt like my work made somewhat of a difference in our community.

Four people in particular made my entry into the digital forensics field so much easier than it could have been. First, Ovie Carroll and Bret Padres helped me just by doing CyberSpeak (sorry Lee) and helping me get a greater understanding of the issues and topics in the field. They also started talking about Twitter in one episode and they were the first two people I started following. That led to my becoming acquainted with Luby Novitovic and Mark McKinnon soon thereafter. Both of them were always there to help when I had a question or needed advice. Since that time, I've been lucky to interact and become friends with so many great people in the field.

I have developed some great and close "in-person" friendships with DFIR people I initially met on Twitter. I won't try to name them all here because I will invariably forget someone. At a SANS DFIR conference several years ago I got to meet up with several of my Twitter friends and by the end of it I had a whole new appreciation for corn. Those who were there will understand the reference ;-) By and large, the DFIR people I know are lots of fun and smarter than I'll ever be.

I've always been grateful for the way people in this field are willing to help. There have been several times over the years I've had questions and never once did I have someone tell me to ask Google, even when maybe they should have. I've been fortunate to befriend quite a few people in the field and each has helped me in some way, whether they knew it or not. I have such great respect for so many DFIR people. I have been amazed that course developers, tool creators, authors and other "leaders" in the field  were so willing to provide their email address or phone number so I could ask for advice.

In addition to my DF work in law enforcement, I've also been running a successful part-time business on the side doing forensics, data recovery and general computer troubleshooting and repair. It had been my desire to turn that into a full-time business once I retired from police work. However, for a number of reasons I won't get into at this point, I've decided that isn't the way for me to go.

Furthermore, because of where I live, there are no companies doing DFIR close by that I could go to work for. I have no desire to be on the road the majority of the time, so the "head to the airport and fly out now" jobs probably aren't for me. I now live where I've wanted to live for a long time, surrounded by woods and family close by. I don't intend to move...ever. Because of all this, I don't see any real opportunity to remain in the field. That's not a complaint; it's just the way it is.

While I'm not willing to say I'll never be involved in forensics again, I don't see any likely scenarios for that happening soon. Still, I never say never, so who knows? I've loved learning and practicing forensics and I am grateful for every moment I've spent with it. Furthermore, I am grateful for all the friends I've met in the field and the opportunities I've been given to learn some really cool stuff.

Addendum

I completely forgot to mention something in my last post. My friend Tom is doing a Year of Python series on his Ram Slack blog. He is posting a new Python 2 project each week for a whole year in his quest to learn. He's doing some very cool stuff and I recommend you check it out.