Why Local Email Clients Matter Webmail, which requires an internet to access messages, local email clients like Microsoft Outlook allow users to read, write, and organize emails even when they’re offline. This is possible because of Microsoft Exchange’s Cached Exchange Mode , which stores a copy of emails locally using Offline Outlook Data Files (.OST) . The Role of OST Files in Email Storage For Microsoft 365 (M365) and Outlook.com , OST files have become more common. These files store a cached version  of Exchange data, typically containing emails from the last 12 months and reaching sizes of up to 50 GB . ------------------------------------------------------------------------------------------------------------ Recovering Data from OST Files: The Challenges Unlike Personal Storage Table (.PST) files , which Outlook can open directly , OST files are encrypted and not easily accessible . This makes recovering data tricky. Convert OST to PST  – Several third-party tools, l ike ost2pst.exe , help convert OST files into PST format for easier access. Use Forensic Suites  – Advanced forensic tools like AXIOM, X-Ways, FTK, and EnCas e  can natively parse OST files for investigation. Beware of Duplicate Data  – Since OST files sync with the Exchange server, investigators often encounter duplicate emails  when analyzing both sources. ------------------------------------------------------------------------------------------------------------ Kindly note, sometimes orphaned OST files  (files that failed to sync due to errors like mailbox corruption) can also be found on a system. Fixing Corrupt OST Files If an OST file gets damaged, there are a couple of ways to repair it: scanost.exe  – A built-in Outlook tool that attempts to fix corrupt OST files. pffexport  – An open-source tool (part of the libpff library) that extracts data from both OST and PST files. ------------------------------------------------------------------------------------------------------------ Best Tools for Viewing and Extracting Emails While forensic suites can analyze PST and OST files, sometimes a standalone email viewer is more convenient. Some useful tools include: XstReader  – An open-source tool written in .NET/C# that allows quick access to PST, OST, and NST files. XstExporter  – A command-line tool for extracting emails and attachments in bulk. Kernel Data Recovery Viewers  – Free tools that allow users to view emails but require a paid version for exporting data. These tools have advantages over Outlook, such as: ✅ Opening files from any  Outlook version ✅ Bypassing  password protection ✅ Recovering  corrupted files ✅ Providing an easy-to-navigate  interface ------------------------------------------------------------------------------------------------------------ The Reality of Free vs. Paid Email Forensic Tools Unfortunately, when it comes to email forensics, free tools have limitations . Most investigators rely on commercial forensic suites for in-depth analysis. However, if you’re on a budget, some affordable tools include: PST Walker  – A low-cost PST viewer Aid4Mail, Emailchemy, and Logikcull  – Recommended by users for basic email extraction and analysis. Final Thoughts OST and PST files play a crucial role in email forensics, providing valuable insights even when data is deleted from the mail server. Whether you’re using forensic suites or standalone tools, understanding how these files work and where to find them is key to effective investigations. ------------------------------------------Dean----------------------------------------------

Google is known for its unique data storage formats , and Google Drive for Desktop  is no exception. Unlike JSON or XML , Google Drive stores critical metadata in Protocol Buffers (protobufs) —a binary format that is highly efficient but difficult to interpret . 🚀 Key Topics: ✅ What are Protocol Buffers (protobufs)? ✅ How to decode protobufs  in Google Drive databases ✅ Investigating Google Drive’s local file cache ✅ Mapping cached files to their original filenames ---------------------------------------------------------------------------------------------------------- 1️⃣ Understanding Protocol Buffers (protobufs) in Google Drive 🔍 What Are Protocol Buffers? Google developed Protocol Buffers (protobufs)  as a lightweight, efficient data format  for storing and transmitting structured data . Unlike JSON or XML , protobufs store data in binary , making them: ✅ Faster  to read/write ✅ More space-efficient ✅ Difficult for humans to interpret 📌 Where Are Protobufs Used in Google Drive? Several key Google Drive databases use protobufs for storing file metadata: Database Table Protobuf Field Description metadata_sqlite_db item_properties content-entry Stores cached file identifiers metadata_sqlite_db properties account_settings Stores Google account & sync settings ---------------------------------------------------------------------------------------------------------- 2️⃣ Decoding Protobufs Using CyberChef Protobufs are not human-readable . To extract valuable information, we need to decode them manually  using tools like CyberChef . 🛠️ Step-by-Step Protobuf Decoding (Using CyberChef) 1️⃣ Extract binary data  from the content-entry or account_settings field in metadata_sqlite_db. 2️⃣ Convert Hex to Binary  using CyberChef’s "From Hex"  operation. 3️⃣ Use the "Protobuf Decode" function  in CyberChef to parse the binary4️⃣ Extract file identifiers, hashes, and metadata  from the decoded protobuf. Example: 📌 Forensic Use: ✅ Recover filenames & hashes from cached files ✅ Extract Google account details from account_settings ✅ Tie cached files to their metadata in Google Drive ---------------------------------------------------------------------------------------------------------- 3️⃣ Collecting Google Drive’s Local Content Cache Since Google Drive operates as a virtual drive , forensic imaging of the system does not capture cloud-only files . Fortunately, Google Drive caches local copies  of some files, allowing investigators to recover deleted or cloud-only data . 📍 Cache Folder Location: C:\Users\\AppData\Local\Google\DriveFS\\content_cache\ Cached files are renamed  and lack file extensions . Files r emain in cache even after deletion from Google Driv e . Cached thumbnails and previews  may persist for longer periods . 📌 Forensic Use: (Using DB Browser) ✅ Recover cloud-only files that were previously accessed ✅ Extract deleted files from cache (even if removed from Google Drive) ✅ Analyze thumbnails and previews for additional evidence ---------------------------------------------------------------------------------------------------------- 4️⃣ Mapping Cached Files to Original Filenames(Investigating Cache Process) Since cached files lose their original names , we must rebuild their filenames  using metadata from metadata_sqlite_db. 📍 Key Database: metadata_sqlite_db 📌 Tables of Interest: Table Field Description items local_title Original filename items file_size File size (used for verification) item_properties content-entry Maps cached files to their original names 🛠️ Step-by-Step Process to Rebuild Filenames 1️⃣ Review items table to identify files of interest 2️⃣ Check item properties to see if cached (content-entry property) 3️⃣ Parse content-entry protobuf to identify filename on disk 4️⃣ Search content_cache folder for that filename and double-check with item file size information 📌 Forensic Use: ✅ Link cached files to their original names & locations ✅ Recover hidden files no longer visible in Google Drive ✅ Extract additional forensic metadata (e.g., file hash, timestamps) ---------------------------------------------------------------------------------------------------------- 5️⃣ File Type Identification Using Header Analysis Since cached files lack extensions , we must identify their types using header analysis . 🔍 Common File Headers (Magic Numbers) File Type Magic Number (Hex) JPEG Image FF D8 FF PNG Image 89 50 4E 47 PDF Document 25 50 44 46 ZIP Archive 50 4B 03 04 📌 Tools for Header Analysis: Hex Editors  (HxD, WinHex) Forensic Suites  (Autopsy, FTK, EnCase) 📌 Forensic Use: ✅ Determine file type even without extensions ✅ Identify potentially malicious files (e.g., renamed executables) ✅ Cross-check file headers against known malware signatures ---------------------------------------------------------------------------------------------------------- We will explore more about Google Drive in the next article (Automating Google Drive Forensics: Tools & Techniques)   , so stay tuned! See you in the next one.

Emails are an integral part of modern communication, serving as both a personal and professional lifeline. Behind the scenes of every email is a digital envelope known as the email header, a treasure trove of metadata that offers invaluable insights into the email's journey, authenticity, and origin. Email Transmission Path An email's journey is a multi-step process: Mail Client : Emails originate from a mail client, which can be a local application like Outlook or a web-based platform such as Yahoo! Mail. Mail Transfer Agent (MTA) : The client communicates with an MTA, a server running the Simple Mail Transfer Protocol (SMTP), responsible for email transmission. Route : The MTA identifies the recipient's server and forwards the email. In larger networks, emails may traverse multiple MTAs. Key Metadata in Email Headers While the body of an email contains the message, headers contain the metadata that digital investigators seek. Here are some crucial header fields and their implications: Message-ID : Acts as a unique tracking number for the email, aiding in tracking its journey. Received : Chronicles the email's path with server IP addresses, timestamps, and time zones. It's crucial to validate these entries for authenticity. ( Always analyze from Bottom to Up) X-Originating-IP : Previously used to reveal the sender's IP address, this field has been removed from Gmail and Outlook headers due to privacy concerns. X-Mailer : Once indicating the email client used, this field is now missing in modern Gmail and Outlook headers. Headers:   https://www.iana.org/assignments/message-headers/message-headers.xhtml X-headers: - X-Headers are experimental or extensions to normal RFC headers. Mail   providers can create X-Headers for internal tracking or administrative purposes. Implications for Forensic Analysis 1. X-Originating-IP: • Challenges: Due to the removal of this field, tracing the actual originating IP of an email sender from Gmail or Outlook headers has become more challenging. • Alternative: Investigators might have to rely on "Received" headers, but these are often internal server IPs and may not provide the actual sender's IP. 2. X-Mailer: • Challenges: Lack of "X-Mailer" makes it harder to determine if an email was composed locally or via a web-based client. • Alternative : Other metadata and content analysis can sometimes provide clues about the client used to compose the email, but it's less direct than having an "X-Mailer" field. Forensic Considerations Challenges and Alternatives Spoofing : While rare, spoofing can lead to misleading header information, requiring investigators to be vigilant. Privacy : Due to global regulations like GDPR, headers have been anonymized to protect user data, complicating investigations. Forensic Tools : Specialized tools can parse headers, extract metadata, and trace an email's path, aiding in investigations. Encryption and Security Headers Modern email services prioritize user security: TLS/SSL : Both Gmail and Outlook use Transport Layer Security (TLS) for email encryption, indicated in headers. SPF/DKIM/DMARC/ARC : Authentication methods to verify sender identity, also present in headers. Server-Side Changes Both Gmail and Outlook have undergone significant changes: Google Workspace : Google's transition to Workspace brought changes in server infrastructure and email processing. Cloud Integration : Microsoft's integration of Outlook with cloud services affects email storage, routing, and access. User-Agent Headers Modern browsers and mobile apps have influenced User-Agent headers: Modern Browsers : Email headers now reflect modern browser usage, providing less specific client device information. Key Elements to Analyse Received Headers : Start from the bottom and work your way up. These headers detail the servers the email passed through. SPF Records : Check for valid SPF records. Apple, for example, publishes SPF records. DKIM/ARC : Look for DKIM/ARC signatures to verify message integrity. Return Path : Verify that the return path is from a legitimate source, not a suspicious domain. Message ID : Compare with known legitimate messages to check for consistency. Construction of Message ID : Typically combines the current date/time with unique system identifiers like a process ID or domain name. Detection : Checking the message ID format can help detect forged emails. --------------------------------------------------------------------------------------------------- Updated on 28 January,2025 When investigating emails, one of the most critical elements to understand is how messages are linked together in a thread. Every email is assigned a unique Message-ID , which helps track conversations. To make things even easier, email systems use two important fields: References  and In-Reply-To . How Emails Are Linked in a Thread References Field : This field maintains a list of all previous Message-IDs in a thread. Every time someone replies, the parent email’s Message-ID is added to the lis t. In-Reply-To Field : This field records just the Message-ID of the direct parent email. Most modern email clients check if the In-Reply-To  ID exists in the References  field and add it if needed . Because of this, the References  field usually provides the most complete view of an email thread. Why Does This Matter in Forensics? These fields help investigators track related emails and identify missing messages. Since Message-IDs  are unique, they are excellent search terms when analyzing email logs or using forensic tools. The best email forensic tools leverage References  and In-Reply-To  fields to reconstruct conversation threads, making it easier to review messages efficiently. --------------------------------------------------------------------------------------------------- Conclusion Email headers, though often overlooked, are a goldmine for digital forensic investigators. By meticulously analyzing these headers, professionals can trace an email's journey, verify its authenticity, and gather valuable metadata for investigations. Despite challenges like spoofing, privacy concerns, and evolving server-side changes, a thorough approach and specialized forensic tools can navigate these obstacles. --------------------------------------Dean-----------------------------------------------

Emails, a ubiquitous form of communication in the digital age, hold a treasure trove of information for forensic investigators. Understanding the structure and nuances of emails is crucial for effective forensic analysis. Email Structure An email comprises mainly of three components: Header:  This contains metadata like sender, recipient, timestamp, and routing information. Body:  The main content of the email, which can include text, images, and other multimedia. Attachments:  Files that are sent along with the email, often carrying critical information. Most standard email clients hide header information, but dedicated forensic tools can unveil this hidden data, offering deeper insights into the email's journey. Email Body Analysis The email body is relatively simple to analyze. It primarily contains the content provided by the sender, often supplemented with signature blocks or device-specific tags. Analyzing email bodies often involves: Manual Review:  Using a forensic tool or email client to manually read each message. Keyword Searching:  Employing string searches to filter emails based on specific keywords or phrases. Data Reduction:  Removing duplicate emails to streamline the review process. When dealing with emails in foreign languages, ensure the forensic tool supports Unicode characters to avoid misinterpretation. Email Attachments Attachments are a goldmine of information, making up around 80% of email data. However, they come with their own set of challenges: Formats:  Attachments can be in various formats requiring specialized viewers. Identification:  Matching attachments with their corresponding emails can be tricky. Security Risks:  Attachments are a common vector for malware, necessitating thorough virus scanning. Forensic Considerations Binary Storage:  While emails are text-based, they can be stored as binary data, requiring specialized forensic tools for accurate searching. Raw Email Analysis:  When analyzing raw email data, remember that attachments are encoded (typically in MIME/base64 format), requiring decoding tools or email clients for proper viewing. Virus Scanning:  Given the potential security risks, scanning attachments for viruses is imperative. Ensure your forensic workstation has updated antivirus software with email client plugins for comprehensive scanning. Conclusion Email forensics, though seemingly straightforward, requires a meticulous approach to extract valuable information effectively. With the right tools and techniques, investigators can uncover critical evidence stored within emails, aiding in a variety of investigations ranging from corporate fraud to cybercrimes. Akash Patel

Email forensics is indeed a powerful in the realm of digital investigations. 1. Who sent the email? Identifying the sender is pivotal as it sets the foundation for any email investigation. While emails can be anonymized or spoofed, there are often traces left behind that can help in determining the true sender. Origination Address: The email's "From" address is the first clue. Even if it's spoofed, it can sometimes lead to known domains or entities that can be investigated further. IP Address: Every email sent over the internet carries with it the IP address of the sending server. This IP can often be traced back to an ISP or, in some cases, to a specific organization or location. Contextual Clues: The content of the email, the signature block, language patterns, and references can also provide hints about the sender's identity or affiliation. 2. When was it sent? Timestamps are crucial in establishing timelines, which can be vital in investigations. Message Timestamp: The email's internal timestamp can be altered, but it still provides a reference point. Mail Server Timestamp : This is a more reliable source for determining when an email was sent. Mail servers maintain logs that record the exact time an email was received or sent, providing a trustworthy timeline for investigators. Verifying Authenticity To confirm whether an email is genuine or has been altered, investigators analyze mail headers. These headers contain various data points, including timestamps that can indicate possible tampering. Authentication technologies like SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and ARC (Authenticated Received Chain) help verify if an email is legitimate and whether it has been modified during transit. 4. Where was it sent from? Pinpointing the origin of an email can help trace its path and determine its legitimacy. IP Geolocation: The IP address associated with the sending server can be mapped to a geographical location using geolocation databases. This can give investigators an idea of where the email was sent from. Mail Server and ISP Tracking: By analyzing the email header, one can trace the path the email took through different mail servers and ISPs. This can help narrow down its origin and may lead to further investigative avenues. 5. Is there relevant content? While the above questions help in identifying the email's origin and path, the content often holds the key to understanding the email's significance to the investigation. Email Stores: Beyond the text and attachments, emails can contain valuable information stored in contact lists, calendar appointments, and task lists. This data can provide context to the email's intent and can be instrumental in corroborating evidence or establishing motive. In conclusion, email forensics is not just about reading emails but understanding the metadata, tracing its path, and extracting relevant content. A well-conducted email examination can provide a comprehensive view of an individual's activities, associations, and intentions, making it an indispensable tool for digital investigations -------------------------------------------------Dean-------------------------------------------------

Google Drive is one of the most widely used cloud storage services , integrated seamlessly with Gmail, Google Workspace (G Suite), and Android devices . With over one billion users , it presents unique forensic challenges  due to its virtual filesystem, cloud-only storage model, and metadata structures . ------------------------------------------------------------------------------------------------------------- 1️⃣ Understanding Google Drive for Desktop The Google Drive for Desktop  application ( previously called Google File Stream ) operates as a virtual FAT32 filesystem , appearing as a s eparate drive letter  (e.g., G:\ or H:\). 🔹 Key Forensic Challenges ✅ Cloud-Only Files:  Many files exist only in the cloud  and never touch local storage. ✅ Virtual Drive:  The mounted Google Drive folder disappears after logout , making live acquisition critical. ✅ Unique Metadata:   File information is stored in SQLite databases and protocol buffer (protobuf) formats . ------------------------------------------------------------------------------------------------------------- 2️⃣ Identifying Google Drive Activity on a System 📌 Key File Locations for Google Drive Artifacts Artifact Location Google Drive Local Storage %UserProfile%\Google Drive\  (if offline sync is enabled) Metadata Database %UserProfile%\AppData\Local\Google\DriveFS\\metadata_sqlite_db File Cache (Locally Stored Files) We can use this folder to recover original files stored in the cloud %UserProfile%\AppData\Local\Google\DriveFS\\content_cache\ Registry Keys ***** (Tracking the Mounter drive letter)**** NTUSER\Software\Google\DriveFS\Share Google Workspace Cloud Logs Google Workspace Admin Reports (for business users) 📌 Note:  The  folder is unique for each Google Drive account  and corresponds to Google Chrome profile IDs . ------------------------------------------------------------------------------------------------------------- 3️⃣ Investigating Google Drive Registry Keys Registry keys help confirm if Google Drive was installed, used, and what drive letter was assigned . 📍 Registry Key for Google Drive for Desktop: NTUSER\Software\Google\DriveFS\Share Value Description SyncTargets Tracks assigned drive letter and Google account ID (hex format) MountPoint (Older Versions) Path where Google Drive was mounted on older File Stream versions 💡 Forensic Use: Identify if Google Drive was installed and used . Determine the drive letter  Google Drive was mapped to. Cross-reference with Windows shell items, RecentDocs, and prefetch files  to track activity. ------------------------------------------------------------------------------------------------------------- 4️⃣ Metadata & File Forensics in Google Drive for Desktop The primary forensic database  for Google Drive is stored in SQLite format  and contains file details, ownership metadata, timestamps, and deletion status . 📍 Metadata Database Location: %UserProfile%\AppData\Local\Google\DriveFS\\metadata_sqlite_db 📌 Database Tables of Interest 🔹 Table: items (Tracks Google Drive Files & Folders) Column Description stable_id Unique file identifier id Cloud file identifier ( can be cross-referenced with Google Drive URLs & audit logs) trashed Indicates ****i f file is in Google Drive Trash (1 = Yes) is_owner Shows if the user owns the file (1 = Yes) is_folder Differentiates between files (0) and folders (1) local_title Actual file name file_size Size of the file in bytes modified_date Last modified time (Unix Epoch format) viewed_by_me_date Last time user interacted with file shared_with_me_date Indicates if file was shared (1 = Yes) proto Binary data containing MD5 file hash  (stored in protocol buffer format) 📌 Forensic Use: ✅ Identify files that were deleted (trashed = 1) . ✅ Correlate viewed_by_me_date with user activity to determine last access . ✅ Recover shared files & owners from shared_with_me_date . ✅ Extract MD5 hashes from proto column to match files with known malware databases . ------------------------------------------------------------------------------------------------------------- 5️⃣ Investigating Cached Files & Deleted Data Google Drive maintains locally cached files  in the following location: 📍 Cache Folder: %UserProfile%\AppData\Local\Google\DriveFS\\content_cache\ These temporary f iles may persist even after deletion  from the cloud. If a file was opened but not saved , it might still exist in cache . Cached files lack original filenames  but can be matched via metadata. 🔹 Table: item_properties (Tracks Cached & Deleted Files) These Below are all keys which u can search in Key folder Column Description pinned Indicates if file was stored offline  (1 = Yes) trashed_locally trashed_locally_name Original name of locally deleted file (found in $Recycle.Bin) content-entry Confirms if file is locally cached file drivefs.Zone.Identifier Provides file origin details (useful for identifying downloads) version-counter Tracks file modifications & revisions Modified-date Modification time of the file reported from the local filesystem Local-title Name of file or folder 📌 Forensic Use: ✅ Recover files that were deleted but still present in cache . ✅ Identify files that were deleted locally but still exist in Google Drive Trash . ✅ Determine if files were downloaded from external sources (drivefs.Zone.Identifier) . 🔍 Tools for Parsing Google Drive Databases: DB Browser for SQLite   protobuf-decoder   Google Drive API   ------------------------------------------------------------------------------------------------------------- 6️⃣ Investigating Google Drive Cloud Logs (Google Workspace Only) For Google Workspace (G Suite) users , cloud logs provide detailed file access records , including: ✅ Uploads, downloads, file deletions, and sharing events ✅ User email, IP address, timestamps, and file actions ✅ Cross-referencing file IDs with forensic artifacts 📍 Google Workspace Audit Log Location: Google Workspace Admin Console → Reports → Audit → Drive Audit Log 📌 Key Audit Events: Event Name Description File Edited Logs file modifications File Deleted Tracks deleted files (even if removed from Trash) File Downloaded Identifies files copied to another device File Uploaded Captures new files added to Google Drive File Shared Tracks when files are shared externally File Unshared Logs when shared access is removed 💡 Forensic Use: Identify stolen data  by tracking downloads and external shares . Recover deleted file information  using file IDs from forensic artifacts . Monitor insider threats  by analyzing suspicious access patterns . ------------------------------------------------------------------------------------------------------------- 7️⃣ Forensic Workflow: Investigating Google Drive for Desktop 🔹 Step 1: Identify Google Drive Usage on the System Check registry keys  (NTUSER\Software\Google\DriveFS\Share). Identify Google Drive mount point & assigned drive letter . 🔹 Step 2: Extract Metadata & File Listings Parse metadata_sqlite_db  to list all Google Drive files, including cloud-only files . Check i tem_properties  for cached & deleted files . 🔹 Step 3: Recover Locally Stored or Deleted Files Extract locally cached files  from content_cache . Look for deleted files in $Recycle.Bin and Google Drive Trash . 🔹 Step 4: Investigate External Sharing & Data Exfiltration Cross-reference file IDs  with Google Workspace Admin logs . Track file downloads & sharing events  to detect data leaks . 🔹 Step 5: Correlate with Other Forensic Artifacts Compare Google Drive activity with browser history, Windows Event Logs, and Prefetch data . Look for unauthorized access from unusual IP addresses . ------------------------------------------------------------------------------------------------------------- We will explore more about Google Drive in the next article ( Decoding Google Drive’s Protocol Buffers and Investigating Cached Files)   , so stay tuned! See you in the next one. ----------------------------------------------Dean------------------------------------------

Microsoft OneDrive for Business  is a powerful enterprise cloud storage solution , distinct from the personal OneDrive available by default on Windows . With Microsoft 365 integration, extensive logging, and advanced security controls , it provides rich forensic opportunities  for investigators. 🔹 Why Investigate OneDrive for Business? ✅ Tracks file uploads, downloads, deletions, and modifications ✅ Stores detailed metadata for all synchronized files ✅ Keeps 90 days of Unified Audit Logs (UAL)  with granular user activity ✅ Logs file sharing events, including external access 🚀 Let’s dive into forensic artifacts, registry keys, logs, and the powerful Microsoft 365 Unified Audit Log (UAL). ----------------------------------------------------------------------------------------------------- 1️⃣ Identifying OneDrive for Business on a System Unlike personal OneDrive, OneDrive for Business requires authentication with a Microsoft 365 account . A single system can sync: ✅ One personal OneDrive account ✅ Up to nine OneDrive for Business accounts 📌 Key File Locations for OneDrive for Business ✅ Up to nine OneDrive for Business accounts Artifact Location Synchronized Files %UserProfile%\OneDrive - \ Sync Metadata %UserProfile%\AppData\Local\Microsoft\OneDrive\settings\Business1\SyncEngineDatabase.db Sync Logs %UserProfile%\AppData\Local\Microsoft\OneDrive\logs\Business1\ Audit Logs (Cloud-based) Microsoft 365 Unified Audit Log 📌 Note:  If multiple OneDrive for Business accounts exist, folders and settings will be named Business2, Business3 , etc. ---------------------------------------------------------------------------------------------------------- 2️⃣ Investigating OneDrive for Business Registry Keys Forensic investigators must audit registry keys  to determine: ✅ The existence of OneDrive for Business accounts ✅ User authentication details (email, last sign-in time, account names) ✅ The actual sync folder location  (which may differ from default) 📍 Registry Keys for OneDrive for Business: NTUSER\Software\Microsoft\OneDrive\Accounts\Business1 Value Description UserFolder Path to OneDrive for Business local storage UserEmail Microsoft 365 account email UserName Name of the user tied to the account LastSignInTime Last authentication timestamp (Unix Epoch) ClientFirstSignInTimestamp Timestamp of first authentication SPOResourceID SharePoint URL linked to OneDrive Business 📌 Key Insight:   SPOResourceID  confirms SharePoint integration , as OneDrive for Business leverages SharePoint for storage and sharing . 🔍 Tracking Shared Folders & External Sources: NTUSER\Software\Microsoft\OneDrive\Accounts\Business1\Tenants ---------------------------------------------------------------------------------------------------------- 3️⃣ OneDrive for Business Sync Logs & Metadata Analysis Investigating OneDrive-Business for Sync Logs & Metadata Analysis is similar to analyzing data in a personal-OneDrive account . Headline of the article Advanced OneDrive Forensics: Investigating Cloud-Only Files & Synchronization https://www.cyberengage.org/post/advanced-onedrive-forensics-investigating-cloud-only-files-synchronization Part 3: Of the mentioned above Link/Article 3️⃣ Investigating Cloud-Only Files Using OneDrive Sync Database ---------------------------------------------------------------------------------------------------------- 4️⃣ Microsoft 365 Unified Audit Logs (UAL) for OneDrive Business OneDrive for Business integrates with Microsoft 365 Unified Audit Logs (UAL) , providing detailed forensic tracking  of user activity for 90 days . 📍 Accessing UAL Logs: Microsoft 365 Security & Compliance Center PowerShell (Search-UnifiedAuditLog) Microsoft Graph API 📌 Key UAL Events for OneDrive Investigations: Event Name Description FileAccessed Tracks file views (noisy, consider FileAccessedExtended) FileModified Tracks file edits (use FileModifiedExtended for fewer entries) FileDeleted Tracks file deletions FileDeletedFirstStageRecycleBin Identifies files moved to the OneDrive Recycle Bin FileDeletedSecondStageRecycleBin Identifies permanently deleted files FileDownloaded Tracks files downloaded from OneDrive/SharePoint AnonymousLinkCreated Tracks externally shared files (links sent outside the organization) FileSyncUploadedFull Logs full file uploads FileSyncDownloadedFull Logs full file downloads 💡 Forensic Use: Identify suspicious file downloads and deletions . Track data exfiltration via external sharing  (AnonymousLinkCreated). Correlate file access patterns  to suspicious login activity . https://learn.microsoft.com/en-us/purview/audit-search?tabs=microsoft-purview-portal ---------------------------------------------------------------------------------------------------------- 5️⃣ Investigating External File Sharing & Data Exfiltration Investigating OneDrive-Business for File Sharing & Data Exfiltration is similar to analyzing data in a personal-OneDrive account . Headline of the article Advanced OneDrive Forensics: Investigating Cloud-Only Files & Synchronization https://www.cyberengage.org/post/advanced-onedrive-forensics-investigating-cloud-only-files-synchronization Part 5: Of the mentioned above Link/Article 5️⃣ Tracking Shared Files & External Data Sources ---------------------------------------------------------------------------------------------------------- Final Thoughts: OneDrive for Business Forensics is a Goldmine for Investigators 🚀 Next Up: Google Drive for desktop– Investigating Enterprise Cloud Storage Activity  🔍 -------------------------------------------Dean-------------------------------------------------------

USB devices play an essential role in digital forensics. While some devices, like Human Interface Devices (HIDs), may not seem particularly data-rich, they can still hold critical clues . Knowing how to analyze USB artifacts is crucial, especially when investigating potential malicious activity or suspicious system behavior. ------------------------------------------------------------------------------------------------------------ Human Interface Devices (HIDs) HIDs, such as keyboards, mice, and game controllers, might not be the flashiest USB devices, but they can reveal important information. For instance, you might discover a new HID device installed during a time of suspicious activity. This is significant because malicious devices often disguise themselves as HIDs to bypass detection. One common attack involves using a HID keyboard to send pre-programmed keystrokes that execute scripts, such as PowerShell commands. Devices like the Hak5 Rubber Ducky are built specifically for this purpose. Other tools, like hardware keyloggers (e.g., AirDrive) and the USB Ninja, can mimic HID input to compromise systems stealthily. Fortunately, HIDs must associate with a USB device class , and this process leaves traces in the system registry. HID associations are stored under the registry SYSTEM\\Enum\HID. Here, you’ll typically find Vendor ID (VID), Product ID (PID), and timestamps. These timestamps, located in sub-keys like 0064, 0066, and 0067, record: First connected time Last connected time Last removal time ------------------------------------------------------------------------------------------------------------ Media Transfer Protocol (MTP) and Picture Transfer Protocol (PTP) Devices like smartphones, cameras, and music players often use MTP or PTP. These protocols differ from traditional mass storage devices and leave fewer forensic traces, but they are still worth investigating when analyzing data exfiltration or suspicious activity. Picture Transfer Protocol (PTP) PTP is an older protocol designed for transferring images, videos, and related metadata. It only allows files to be copied from the device to a computer and does not support other file types. Media Transfer Protocol (MTP) MTP is an upgraded protocol introduced by Microsoft to support a wider variety of file types. Unlike PTP, MTP allows two-way file transfers and enables simultaneous access to storage by both the device and the computer. In forensic investigations, MTP devices can be tricky. They don’t receive drive letters and are instead displayed under “Devices and Drives” in Windows 10+ o r “Portable Devices” on older systems. Additionally, accessing files on MTP devices may not create typical artifacts like .LNK files. To identify MTP or PTP devices, examine the following registry keys: SYSTEM\\Enum\USB SOFTWARE\Microsoft\Windows Portable Devices\Devices Artifacts like ShellBags and limited .LNK file records may also reference MTP. What Happens? When you open files from an MSC device (like a flash drive), you get these little LNK files. These files point back to what you opened and where it came from. ------------------------------------------------------------------------------------------------------------ Mass Storage Class (MSC) Devices Mass storage devices, such as external hard drives and flash drives, are among the most common USB devices . They leave behind a wealth of artifacts and are essential to examine in forensic investigations. Protocols for MSC Devices USB Storage Port (USBSTOR): This protocol supports the traditional Bulk-Only Transport (BOT) method, which allows straightforward data transfer. USB Attached SCSI Protocol (UASP): Introduced with USB 3.0, UASP enables faster, multi-threaded transfers and is commonly used with solid-state drives . UASP devices are recorded in the SCSI registry key rather than USBSTOR. MSC devices typically appear with a drive letter and are fully accessible for file transfers. They are recorded in the registry under USBSTOR or SCSI, depending on the protocol. ------------------------------------------------------------------------------------------------------------ Key Forensic Takeaways HID Devices: Look for suspicious timestamps and unexpected devices in the HID registry key. Even if attackers spoof VID/PID, the timing can provide valuable clues. MTP/PTP Devices: These devices leave fewer traces but can serve as potential data exfiltration points. Investigate their registry entries and any associated ShellBag or .LNK file artifacts. MSC Devices: These devices leave behind the most artifacts, making them easier to analyze. Pay attention to whether they use USBSTOR or SCSI protocols, as modern devices increasingly rely on UASP. By understanding these USB device types and the artifacts they leave behind, forensic investigators can better uncover and analyze suspicious activity on a system. -----------------------------------------Dean------------------------------------

Since their inception, r emovable devices have posed a significant threat to enterprise security. From insider threats and confidential data theft to data leakage and the propagation of malicious code, the challenges surrounding removable devices remain prevalent. With an estimated six billion USB devices in use worldwide , their ubiquity underscores the critical need for organizations to understand and manage their risks effectively. ---------------------------------------------------------------------------------------------------------- USB: The Dominant External Media Interface Among removable devices, USB (Universal Serial Bus) has long been the most widely adopted external media interface. While competitors such as FireWire (IEEE 1394) and eSATA once presented healthy alternatives, the industry has largely consolidated around USB. Fortunately, USB device usage leaves behind a wealth of digital artifacts . These artifacts enable investigators to piece together comprehensive stories of USB activity, including identifying connected devices, determining when they were introduced, and pinpointing the responsible users. ---------------------------------------------------------------------------------------------------------- Understanding USB Device Classes Not all USB devices are created equal. The USB Implementers Forum maintains over twenty distinct device classes , each with unique purposes and forensic footprints. While the Mass Storage Class —which includes external hard drives and flash drives—is often of primary interest Some notable USB device classes include: Human Interface Devices (HID):  This category includes keyboards, mice, microphones, and malicious devices like keyloggers. Identifying these peripherals can offer insights into unusual or suspicious activity. Media Transfer Protocol (MTP):  MTP devices, such as mobile phones, represent specialized USB-connected systems often relevant in investigations. Other Device Classes:  Beyond storage and HIDs, devices such as webcams, printers, and gaming controllers may also leave behind valuable artifacts. ---------------------------------------------------------------------------------------------------------- Investigative Techniques in USB Forensics Effective USB forensic investigations involve connecting disparate data points to form a cohesive narrative. By analyzing system logs, registry entries, and shell item data, investigators can determine: The types of devices connected to a system. The time and date of device introduction. The files and folders accessed via the device. The users responsible for the device’s connection and usage. Combining this information enables investigators to draw valuable conclusions about device activity and its potential implications for the enterprise. ---------------------------------------------------------------------------------------------------------- Challenges and Opportunities in USB Forensics USB forensics is not without its challenges. Device artifacts are often scattered across a system, requiring significant time and expertise to locate and interpret. Moreover, the diversity of device classes and the variety of data formats involved mean that investigators must remain adaptable, armed with the right tools and methodologies. USB device forensics is a powerful tool in combating insider threats, preventing data leaks, and uncovering malicious activity. By leveraging the insights provided by USB artifacts, organizations can enhance their security posture and respond more effectively to potential incidents. ---------------------------------------------------------------------------------------------------------- Conclusion By understanding the nuances of USB device classes and their associated artifacts, investigators can extract critical insights to address enterprise security risks. Although the process may require effort, the rich data obtained through USB forensics makes it an indispensable asset in the modern investigative toolkit. ---------------------------------------------Dean----------------------------------------------------

Linking USB Devices to User Accounts If the d evice you’re profiling is a mass storage class USBSTOR device , you can go a step further and try to tie the device to a specific user account. This is where the NTUSER.DAT  registry hive comes into play. ------------------------------------------------------------------------------------------------------- Why NTUSER.DAT Matters Each user on a system has an NTUSER.DAT hive , which keeps track of their personal settings and activity. When a user logs in, their NTUSER.DAT hive is loaded into memory . Inside this hive, there’s a key called: NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 This key logs details about: Mounted volumes (like USB devices) Network shares accessed by the user If the Volume GUID  you identified earlier from the SYSTEM\MountedDevices  key appears in this MountPoints2 key, it means: The user was logged in when the device was connected. Or, it was the last account logged in before the device was introduced. ------------------------------------------------------------------------------------------------------- How to Check for User Activity Load NTUSER.DAT hives: Load all NTUSER.DAT hives for suspected users into Registry Explorer. Search for the Volume GUID: Use the Find  tool in Registry Explorer and search for the GUID (e.g., 7560496c-3102-11e8-9eb7-9eb6d0dc1465). Verify matches: If you find a sub-key matching the GUID, that user’s account interacted with or was active while the device was connected. The last write timestamp   of the sub-key can give you an idea of the last time the device was connected. ------------------------------------------------------------------------------------------------------- Important Notes Be cautious!   If a user logs out or reboots the system while the device is still connected, Windows may incorrectly attribute the device to the last logged-in account. This issue is common in older versions of Windows. To confirm user activity, cross-reference with: Logon/logoff events from Windows Event Logs. Other artifacts like browser history or shell items. Multiple accounts:  Don’t forget to check all NTUSER.DAT hives for matches if there are multiple users on the system. Non-USBSTOR devices:   If you’re profiling a device that isn’t a USB storage device, this method won’t work . Instead, use connection timestamps and Event Logs to link device usage to user activity. ------------------------------------------------------------------------------------------------------- Beyond USB Devices: Network Shares The MountPoints2 key doesn’t just track USB devices ; it also logs network shares accessed by the user. This can be helpful for: Tracking lateral movement in an investigation. Identifying systems accessed by an attacker or malicious insider. Example: A share named Ubuntu-24.04 was accessed by the user on the system #wsl.localhost# ------------------------------------------------------------------------------------------------------- Microsoft-Windows-Partition/Diagnostic.evtx for Device Profiling (Win10+) Windows 10 introduced a valuable custom log, Microsoft-Windows-Partition/Diagnostic.evtx , which records detailed information about connected and disconnected devices. This log, particularly Event ID 1006 , is a game-changer for investigating mass storage class (MSC) devices. What Event ID 1006 Captures Each Event ID 1006  entry logs detailed data when an MSC device is connected or disconnected , including: Device Details: Manufacturer, Model, Vendor ID (VID), and Product ID (PID). Disk capacity. SCSI Serial Number  (labeled as "SerialNumber"). iSerialNumber  (found in the "ParentId" field). Partition Data: Contents of the Master Boot Record (MBR) . Volume Boot Records (VBRs) f or up to three partitions. These logs provide historical records of device usage, including internal devices like SSD drives. Connection vs. Disconnection Events Capacity Field: Populated for connection events (records the device’s capacity). Displays " 0" for disconnection events . Pro Tip:  Be mindful of events triggered by sleep/hibernation or shutdown . For instance: If a device remains connected during sleep mode, a new connection event will be logged upon resumption , creating back-to-back connect events  without a corresponding disconnect event in between. Strengths and Limitations Advantages: Tracks every device connection and disconnectio n with comprehensive data. Provides timestamps for all events, helping to establish device activity timelines. Far surpasses earlier removable device logging capabilities. Limitations: The log may be cleared during major Windows updates , retaining only post-update data. Initially displays the message "For internal use only" in the Event Viewer, but the XML Details  view reveals all the detailed information. Pro Tip: Start with This Log If you're profiling devices on Windows 10 or later, begin your investigation with Microsoft-Windows-Partition/Diagnostic.evtx . It provides a wealth of data upfront, saving time and effort in the profiling process. While additional details like user accounts and drive letters may require further investigation, this log is an exceptional resource for building a foundational understanding of device activity . -------------------------------------------------------Dean------------------------------------

When investigating external media connected to a system, determining what files and folders were accessed on the media is critical. This can be achieved by linking LNK files  and Jump List shell items  to device details using the Volume Serial Number (VSN) . ------------------------------------------------------------------------------------------------------------ What Is a Volume Serial Number (VSN)? Found in the Volume Boot Record (VBR)  of FAT, exFAT, and NTFS file systems. Captured in LNK files  and Jump List entries  for every file or folder accessed on the device. Matching the VSN between a removable device and a shell item confirms the source of the accessed files or folders. How to Retrieve a Device’s VSN VSN can be retrieved through Windows artifacts , such as: 1. Microsoft-Windows-Partition/Diagnostic.evtx What it records: The Master Boot Record (MBR)  and Volume Boot Records (VBR)  for up to three partitions. Detailed data like disk signature, partition structure, and Volume Serial Numbers. How to extract VSN from raw data: Hex offsets: FAT: Offset 0x43 exFAT: Offset 0x64 NTFS: Offset 0x48 Important:  Convert the Little Endian  byte order to the correct format. Tools to simplify this process: Partition-4DiagnosticParser : Maps raw hex data to human-readable output. USB Detective: Extracts VSN and other device details automatically. ------------------------------------------------------------------------------------------------------------ 2. EMDMgmt Registry Key Location: SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt Details captured: Manufacturer, iSerialNumber, Volume Name, and Volume Serial Number (in decimal form). Note: Convert the decimal VSN to hex to match shell item records. This key may not be available on systems with SSDs , as it was o riginally tied to the now-defunct ReadyBoost feature. ----------------------------------------------------------------------------------------------------------------------------- Key Insights About VSNs VSN Changes: A device’s VSN changes every time the partition is reformatted. If the same iSerialNumber appears with different VSNs , it indicates the device was reformatted. U se timestamps from the Partition/Diagnostic log  or EMDMgmt key  to estimate when formatting occurred. Non-Windows File Systems: VSN data is not recorded for Mac, Linux, or GPT partitions. ----------------------------------------------------------------------------------------------------------------------------- Tools for USB Device Analysis 1. USB Detective What it offers: Automates the USB forensics process, pulling data from various sources: Registry keys (e.g., DeviceMigration, EMDMgmt). Event Logs (e.g., Microsoft-Windows-Partition/Diagnostic.evtx). Shell items (e.g., LNK files, Jump Lists, ShellBags). Volume Shadow Copies for historical analysis. Strengths: Provides an intuitive interface and links data to original sources for easy validation. Consolidates and simplifies device activity audits. First screenshot: 2nd Screenshot: 3rd After Processing Output: 2. parseUSBs.py ( https://github.com/khyrenz/parseusbs ) An open-source Python script by Kathryn Hedley. Parses registry hives and outputs findings in CSV format. Strengths: Simple and efficient for written reports. Useful for quick analyses. Limitations: Less comprehensive than USB Detective. Thank you for taking the time to dive into this deep exploration of USB device forensics and the critical tools and techniques that can simplify the process. By mastering these methods, you'll be equipped to uncover valuable insights during investigations efficiently. See you in the next article, where we'll explore more cutting-edge forensic strategies and tools. Until then, happy investigating! 🚀 --------------------------------------------Dean--------------------------------------------

When investigating devices connected to a computer, every small detail can help. Identifying Drive letter: For instance, the v olume name  used by a device can link it to files like LNK files , which store volume name The drive letter  assigned to the device can lead us to other artifacts like Prefetch files, RecentDocs, Jump Lists, ShellBags, and more. But there’s a catch: drive letter info isn’t always available . Windows only keeps records of the last device  assigned to a specific drive letter. Also, the same drive letter can be reused for multiple devices(This can be problematic in because most recent device and its associated information will be recorded). Still, certain artifacts, especially in newer Windows versions (10 and 11), tend to stick around longer, even after system updates. ------------------------------------------------------------------------------------------------------------ Let’s look at two key places where you can dig for drive letter and volume name info: VolumeInfoCache  and MountedDevices . 1. VolumeInfoCache: A Quick and Easy Check If you're using Windows 7 or later, this is your starting point. The VolumeInfoCache is located at: SOFTWARE\Microsoft\Windows Search\VolumeInfoCache This key contains sub-keys for each drive letter (like C:, D:, E:, etc.). Each sub-key has a VolumeLabel  value, which tells you the volume name of the last device connected to that drive letter. Why use it? Quick and simple:  It’s easier to read compared to other registry keys. Good for SCSI drives and VHDs:  Especially useful for modern devices like virtual hard drives or USB drives using UASP mode. Limitations: Only records the last device  assigned to each drive letter. Timestamps here (the “last write time” of sub-keys) aren’t always reliable for figuring out exactly when the device was connected. 2. MountedDevices: A More Detailed Look If VolumeInfoCache doesn’t give you what you need, try checking SYSTEM\MountedDevices : This key tracks drive letters and the devices mounted to them. It’s especially useful for USB thumb drives ( USBSTOR  devices). How it works: Look for values like \DosDevices\E:  (where "E:" is the drive letter). Inside the value data, search for the device's iSerialNumber . This links the drive letter to the specific device. Things to keep in mind: Devices can be mounted with different drive letters  over time, so check all drive letter values. You might not find a match if another device was mounted at the same drive letter later. ------------------------------------------------------------------------------------------------------------- Special Cases: Hard Drives and Partition Types Hard drives and SSDs (especially those with multiple partitions) are trickier to profil e. Here’s how they work based on the partition scheme: GPT Partitions: Values start with DMIO:ID. The last 16 bytes in the value are the Unique Partition GUID . Search for this GUID in the registry to find keys tied to the original device. For MBR Partitions: If you do not see DMIO:ID at the start of a drive letter value , and do not see a USBSTOR Device ID and iSerialNumber , you are likely looking at partition data from a device using the older Master Boot Record (MBR) partition scheme The first 4 bytes represent the Disk Signature . Search for this Disk Signature in the registry to uncover related keys that identify the device ------------------------------------------------------------------------------------------------------------- Why This Matters Understanding where and how to find drive letter and volume name info can make all the difference in your investigation. While VolumeInfoCache is a fast and easy starting point, SYSTEM\MountedDevices gives you a deeper dive , especially for older or more complex devices. With these tools, y ou’ll be able to connect devices to their artifacts and uncover the story behind what was plugged in and when. ------------------------------------------------------------------------------------------------------------- What’s a Volume GUID? A Volume GUID  (Globally Unique Identifier) is Windows’ way of identifying a specific volume or partition on a device. It’s a unique name enclosed in curly braces \??\Volume{???????-????-????-????-??????} For devices like USB flash drives ( MSC USBSTOR ), this Volume GUID can help us track down user activity tied to the device in later steps. How to Find Volume GUIDs for USB Devices If you’re profiling a USB flash drive, check the value data  of Volume GUID entries within the MountedDevices  key. Look for the device’s iSerialNumber  (the unique serial number). If it matches, you’ve found the Volume GUID for that device. Why Is This Step Important? This step lets you: Tie the device to a GUID:  This helps you match the device with its associated user account in later steps. Track user activity:  You’ll need this Volume GUID to dive deeper into the behavior of the device and its user. Special Note: This method only works for MSC USBSTOR  devices, like USB flash drives. For other device types, y ou’ll need to rely on Windows Event Logs to identify which user account was active at the time the device was connected or used. ------------------------------------------------------------------------------------------------------ I know this is alot of information and I want to make thing wasy for you So you ready lets start Lets say you +you’ve identified a unique identifier for your device, such as the iSerialNumber . Registry explorer lets you search across all loaded registry hives at once, saving you a lot of time. How to Search for Device Information Load the right hives Make sure you’ve loaded the SYSTEM , SOFTWARE , and user NTUSER.DAT  hives in Registry Explorer. These hives contain most of the data related to devices. Use the Find option: Go to Tools > Find  and search for the device’s iSerialNumber  (or another unique identifier diskid ). Review the results: If the device information is still present in the registry, you’ll likely see many search hits. Not all of them will be relevant, so focus on keys needed for device profiling. What to Look For Search results will typically include keys that provide: Device ID Last Mountpoint Drive Letter Volume GUID You may also find hits in less common locations, like Windows Portable Devices , which could provide additional details. Double-click any result of interest to jump directly to that registry key within Registry Explorer. Work Smarter, Not Harder While it’s possible to manually comb through the registry to profile a device, this process can be incredibly time-consuming—especially if you’re dealing with multiple devices. By using unique identifiers and leveraging tools like Registry Explorer’s search function, you can dramatically speed up the process. -----------------------------------------------Dean-------------------------------------------------