Friday, May 28, 2010

Case Notes

OK...so, if you are not using Case Notes (CN) by QCC Information Security, I have to ask, "why not?"

If you answered, "What's Case Notes?", let me splain.

Case Notes is an awesome tool for taking notes during your investigations. Unlike simply using Notepad or Word Pad, Case Notes timestamps your entries, allows you to password protect your notes file, has customizable tabs, and keeps creates an audit log of your activity.

Once you download and install CN (either 32 or 64 bit version) you are prompted to set up your preferences...like this...


As you can see, I can set up to 10 fields of metadata such as my name, my agency, the case type etc...very handy. Then you can customize up to four (4) additional tabs for specific notes. The main space for notes is a tab called, "Case Notes" and cannot be changed. You will also have a tab labeled, "Audit Log" which also cannot be changed. So if you use all four like I did, you will have a total of six tabs.

I use my tabs to keep track of evidence items...systems, hostnames, IP addresses, etc, Dirty Words (keywords)...stuff I run across that I want to search for on my image(s), Questions that need to be answered and the subsequent answers, and my Investigation plan...what am I trying to accomplish, and why.

So, once you are all set up, your screen will look like this...



Now that we have covered the tool, let's cover the concept.

Harlan and I were talking this morning and we were wondering why so many investigators don't create an investigation plan. I mean, it seems like a no brainer doesn't it. What are you looking for? What have you been hired to do? What is the overall purpose of the investigation? That would be the first thing you should write down.

Next, you can break the investigation into smaller, more manageable chunks that feed into the overall investigation plan. This is where you would use the Alexiou principle...

1. What question are you trying to answer?
2. What data do you need to answer that question?
3. How do you extract and analyze that data?
4. What does the data tell you?

Here is an example...

1. I want to know if the admin user account was used to launch malware.exe
2. I need the ntuser.dat file for the admin user
3. I am going to parse the MUICache and UserAssist Keys with Reg Ripper
4. The data from the UserAssist key indicates that malware.exe was launched by the admin user

This is pretty basic example, but it illustrates my point. You can ask yourself questions and answer them...inputting both into your case notes. Once you have your questions answered, you can update your investigation plan with HOW that information is relevant to the case.

For example, in this case what would the fact that malware.exe was launched locally by admin. Well, for one, I now know that the intruder had admin access. I also know that because the data appeared in the UserAssist key, that they had an interactive session with the shell. So what does that mean? Well, that means they had to login from somewhere, right? So now, I just generated some additional questions that need to be answered...so in my case notes, I would update my investigation plan and my To be answered sections.

1. How did the intruder gain admin access? I need to crack the passwords from the NTLM hashes and see what they are. I also need to parse the SAM hive to determine if the passwords were recently changed, and get the last login times for users in the admin group. If the passwords for admin users were changed recently, I need to get the passwords before the change. I can check to see if the system was taking restore points (or shadow volume copies) and extract the SAM and SYSTEM hives from the date immediately prior to the change. Then I can crack the NTLM hashes and get the passwords before the change occurred.

2. When did they gain access? I can tell this by looking at my timeline (which is one the FIRST things you need to create) and check the first appearance of malware.exe. That should give me a great place to start looking for remote access. I can then look for remote access attempts in the Security event logs. Does the customer have a VPN? Does it log? What about remote management tools? Which ones are in use (RDP, pcAnywhere, VNC, etc)? Are they open to the external internet? Do they log?

All of this from JUST answering a single question! Then as you progress through you case, if you take good notes you will make report writing MUCH MUCH easier! Also, since cases are getting more and more complex, and like me, you may be working more than one case at a time, good notes will keep you from trying to remember what you were doing three days ago and what you were thinking that made you do whatever it was that you were doing? Finally, should you get pulled off the case for any reason (or you just need help) good notes will help your fellow investigators know what you were doing, what you were thinking, and where you were headed.

So, back to my original question...if you are not using Case Notes...why? It's free. It's a great tool that has some really nice options. And taking good notes will help you keep your thoughts organized, and write your final report.

Lesson learned...TAKE GOOD NOTES!!!!!! I will give a dollar to anyone who can give me a good reason for not taking notes during a case. I am going to bet dollars to doughnuts that nobody is going to have any reason compelling enough for me to part with my GWs.

Happy hunting...and remember...TAKE GOOD NOTES!!!!

3 comments:

  1. "Harlan and I were talking this morning and we were wondering why so many investigators don't create an investigation plan. I mean, it seems like a no brainer doesn't it. What are you looking for? What have you been hired to do? What is the overall purpose of the investigation? That would be the first thing you should write down."

    It is a troubling issue I find with many people involved with investigations. Forensics is a scientific method and therefore should follow the scientific method:
    * Ask a Question
    * Do Background Research
    * Construct a Hypothesis
    * Test Your Hypothesis by Doing an Experiment
    * Analyze Your Data and Draw a Conclusion
    * Communicate Your Results
    I find myself constantly having to stop clients (or even people on my team) mid-sentence as they explain what tools/processes are needed and make them answer a simple question: What is it you want or would like to know? Your at point A. Where is point B? Then pick the route.

    I try to liken it to the analogy of if you were building a house, you would not go to the hardware store and just start buying things without having yet drawn out the plans. Or one step further, you would not start picking out paint colors before the walls are even framed!

    ReplyDelete
  2. Sounds like you are seeing the same things we are! So now, if we have a common "enemy", how do we fight it? I have been trying to educate folks on the need for a clearly thought out investigation plan, and how not doing it can negatively impact your work. I have only had marginal success getting others to not only understand, but to "get it" and make changes to their work habits. It's a constant source of frustration.

    ReplyDelete
  3. Firtstly, many thanks for the kind words regarding CaseNotes. You're right that a lot of analysts don't think clearly about the process of what they're trying to achieve prior to meandering through exhibits looking for clues. One of the driving factors that pushed me to write CaseNotes in the first place was a desire to be better organised in the way that I approach an investigation. I'm constantly trying to think of ways in which CaseNotes can better assist and I have a couple of useful features in the pipeline for release in the next few months, as a result of helpful suggestions by users.

    The first is the creation of a user defined and fully customisable check list. This will allow for standard operations to be prompted so that hopefully major steps won't get missed. Moving forward, I intend to allow for multiple check lists for differing types of investigation to be available, offering a kind of 'case workflow' template if you will. My aim is to make this loosly coupled so that users can share these templates between them and import them for use with CaseNotes.

    Much to do - many thanks for your support!
    John.

    ReplyDelete