Key Logging


SKL Dowload: http://shadow-keylogger.en.softonic.com/


Greetings.

For those of you who are new, this is the second blog post to Easy Computer Forensics. Last week’s post focused on deleted file recovery. This week, we dive into a darker, more controversial topic in computer forensics. As such, I have deemed it necessary to provide a forewarning of its contents.

The blog today will teach you how to  create, and covertly deploy a key logger. If you are not already familiar, a key logger is a device that allows a user to record every word, character, or symbol that is typed on someone’s computer. So what could you gain by key log someone’s computer?-A Password to a social networking site, a  credit card number, a social security number…the possibilities are endless.

 Sound malicious? How about unethical? Possibly illegal? That’s because it  almost always  is.  With that being said, keep in mind that:

1.       This blog post aims to inform, not to encourage. I am not condoning that you key log anyone.  I am simply explaining to you the steps involved in creating and deploying one.


2.  There are exceptions to every rule. Sometimes extreme circumstances call for extreme measures.I have successfully used the techniques in this blog countless times. In fact, I have close to a dozen key loggers deployed currently.   If you feel that you have reason enough to use a key logger,  these instructions can help. 

3.      Please be careful. There are laws that protect people from unlawful eavesdropping, sometimes key logging can break these laws . If you do decide to key log someone, at least make sure you read this post all the way through- that way you don’t get caught. 

_________________________________________________________________________________


Let’s continue our scenario where left off in last week’s post:

"After we provided our friend Theseus with the evidence we found, He decided to confront Helen about her affair. To our surprise, the conversation took a different direction than we expected. Helen apologized to Theseus, and promised to remain faithful if Theseus gave her another chance. 

Theseus, being the kind of guy he is, agreed. While he is eager to rebuild their relationship, Theseus also wants to be sure that he isn’t fooled again. He has come to us again for help, this time asking for a way that we can keep track of Helen's computer activity, in case she decides to write anymore love letters.”

So we begin.

We want to first consider possible solutions to Theseus’s problem.

There are many subscription based services that can provide real time monitoring of a person’s computer.  But such services are expensive, difficult to install, and are often designed for businesses with many computers.  On the other end of the extremity spectrum, we could just check Helen’s internet history every few days. But, internet history is easy to delete- and doesn't catch computer activity that takes place in programs that aren't web browsers.

 It looks like a better solution would be  to deploy a key logger. A key logger is easy to set up, and will catch everything that Helen types into the computer, no matter the program she is using.

So now we need to make the key logger. First, we download  and install  the program Shadow Key Logger. We take the "sk.exe" file from the download, and place it into a new folder. Name the new folder System_Config.

 At this point in time, we can double click and run sk.exe (on our computer) and verify that it is working .

We are taken to the key logger configuration screen. This screen prompts us for a handful of preferences, as well as a Session Password. (The Session Password allows us to end the key logging Session).
 Some of the preferences allow us to choose where to save our results, as well as how often we would like the results updated.

These options are fantastic.. However, as the program stands currently, the settings need to be inputed every time Shadow Key Logger is run. Not only will we not be around to do this every time Helen uses her computer, but a pop-up window asking for key logging preferences would probably make her very suspicious.

Luckily, we have found a way to edit Shadow Key Logger, so that it knows what preferences we want without having to prompt us. Additionally, This will allow us to run Shadow Logger on Helen's computer discretely, as there will be no pop-up window when the program begins..

To make these modifications, we will use a  XML file.  We create begin the modification by inserting the following code into Notepad.

<?xml version="1.0" encoding="UTF-8" ?>
 <config>
 <Password>easycomputerforensics</Password>
 <StartRecordingImmediately>1</StartRecordingImmediately>
 <AccessMode>Manual</AccessMode>
 <AccessIcon>Computer Networked</AccessIcon>
 <IncludeTimestamp>1</IncludeTimestamp>
 <SaveKeystrokes>1</SaveKeystrokes>
 <SaveKeystrokesDir>C:\System_Config\</SaveKeystrokesDir>
 <SaveKeystrokesRate>3</SaveKeystrokesRate>
 <TakeScreenshots>0</TakeScreenshots>
 <TakeScreenshotsDir></TakeScreenshotsDir>
 <TakeScreenshotsRate></TakeScreenshotsRate>
 <TakeScreenshotsQuality></TakeScreenshotsQuality>
 </config>

Now we must save the file as config.XML, and place it into our System_Config folder..

With this modification, we are ready to deploy our key logger on Helen's computer...  We Place the entire System_Config folder onto a falshdrive or other portable storage device.

While Helen is away. We have Theseus provide us with access to her computer.  The first step in the deployment is to copy System_Config, onto the root of Helen's C Drive.

At this point, our key logger is fully functioning, and is tucked away in  an innocent looking folder on Helen's computer.  Earlier, when we made our folder, we were sure to give it a name that would not spark Helen's curiosity. It is unlikely that she or anyone else would be suspicious of a folder named "System_Config" on the C drive.

So what is there left for us to do? Well unfortunately,  even with our XML file and our clever hiding spot, sk.exe will not run without someone double clicking on it. And we can't exactly ask  Helen to do it for us...

Luckily, there is  an easy way to modify the startup commands on Helen's computer, so that sk.exe runs automatically every time she turns it on.

Since Helen is using a Windows 7 computer, we can  use "RUN:" to navigate to:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
This will bring up the startup folder. Within the startup folder, we want to place a shortcut to sk.exe.

Now, whenever Helen turns on her computer, Windows will run the shortcut. The shortcut will direct Windows to C:\System_Config\sk.exe.  When sk.exe is activated, it will apply the default settings provided by our config.XML, which will start shadow Key Logger discretely. We can restart Helen's computer to ensure that this is working.

Once Helen's computer has been restarted, we don't see any sign that would indicate the presence of Shadow Key Logger running. This is a good thing, because we need it to be ad discrete as possible. However, there is one subtle sign of its presence. If we focus our attention to the System Tray in the bottom right corner of Helen's computer, we can see that there is an icon in the shape of a computer. This is Shadow Key Logger's discrete way of showing us that is in fact running. The icon is designed to blend in with the others in the System Tray, and is really only visible to those who know what to look for.

 This system tray icon is also how we can send a stop command to Shadow Key Logger. If we double click on it, it will pull up a screen that discretely prompts for a  password. If were were to type in  our session password "easycomputerforensics" (defined in the config.xml file), the key logging session would terminate.  Since we do not want to end the session, we can close out of the pop-up box and continue the key logging session.

So where and how do we find the results of our key logging?  How often are the results updated. Like the session password, these preferences were declared in the config.xml file.

Our config.XML file instructs Shadow Key Logger to store its results in word documents, in  the System_Config folder. The results are updated every 5 minutes.

Now that we know how to find the results of the key logging sessions, all that is left to do is wait for Helen to use her computer again, so we can take a look. We turn her computer off, and carefully leave, ensuring everything looks exactly as it did before we were there.

_______________________________________________
"Theseus has called to inform us that in the short amount of time that we were gone, Helen turned on her computer, and typed up some sort of Email before leaving again. He has asked us to come by again and help him see what she typed."

On Helen's computer, we navigate to C:\System_Config\. In the folder, we see one document file produced by Shadow Key Logger.

We open it to view the results:

We can easily decipher the results to learn that Helen signed into her g-mail account just after 3pm. We also can see what she used as a username ("helenofTroy") as well as what she used as a password ("Trojanhorse").  Most importantly though, we can see the contents of an email that she started to type- it looks like we have more bad news for Theseus.

Finding Deleted Files Revised Edition

Finding Deleted Files


Hi there. Today I am going to be showing you how to find files that have been deleted on a storage device (in our case, a flash drive).  But before I can show you how to do this, I need to make sure that you are doing it in a digitally safe manner. 

To follow along in this tutorial, you will need:

The Demo Version of\\Forensic Toolkit 1.81: Available Here
ThumbScrew Write-blocking freeware: Available  Here
A copy of the flash drive we will be analyzing: Coming Soon

_________________________________________________________________________________

For the sake of this exercise, lets use the following scenario: 

"A friend of ours, Theseus,  has come to us with  a concern. He fears that his girlfriend Helen, has been unfaithful to him. He  brings us  a flashdrive of hers, and asks us to see if we can find anything  to confirm his suspicion."

So we begin.

First, we want to activate our write blocking software, ThumbScrew, on the computer we will use for the  examination. In our computer's system tray, we click the the Thumbscrew Icon, choosing to make "USB read only" 

 

What this will do is modify our computer's registry to prevent us  from accidentally writing to Helen's USB flashdrive when we plug it into our computer. This is important because we want to return the flashdrive in the exact same way we found it. Forensically speaking, we are ensuring that the evidence will not be altered by our investigatory process. Now we can plug in Helen's flash drive.


Next, we need a productive way to look through the flashdrive. We could use Windows Explorer as our primary tool, but without special forensic software, our analysis options are very limited. 
We will use  Forensic Tool Kit. At the opening screen, we select the option that allows us to go directly into working in FTK.  

When starting FTK, we will see this home screen. We go  to FILE>ADD EVIDENCE and click NEXT twice. 

 We will be asked to choose the format of the evidence that you wish to add to the case.  We want to select the "Physical Drive" option. Now, we can select Helen's flashdrive. 

Once we have selected  the flashdrive as evidence, we should see a screen that looks like this:

FTK has taken Helen's flashdrive, and has analyzed and organized all of the files on it. Just one problem though. What files?  FTK is reporting that there is only a sole document file on the drive (with the exception of a few file system folders). Additionally,  It  shows that there are no deleted files on the flashdrive. 

We can click on the "documents" tab in FTK, to see the file named "receipt.txt". the built in viewer in FTK allows us to read its contents- a simple receipt for a few purchases at the Greek Market Place". Not Something we could consider incriminating.

We double check in Windows Explorer, and sure enough, theres only that one document on the flashdrive.  But wait! Before we tell Theseus anything, we need to take a closer look.  Doesn't it seem odd that Helen would carry around a flashdrive with just a receipt on it?
   
Maybe she  wiped or reformatted her flashdrive at some point before "receipt.txt" was made.  After all, Helen is more tech-savvy than most. This would have  performed an advanced delete on any files that were previously on the flashdrive. If there were any incriminating files, they would now be hidden from the flash drive's file directory- and wouldn't appear in any of FTK's categories. 

To make sure we aren't missing anything , we need to take a look at the hexadecimal values of the flashdrive's storage space. To do this, select the "Total File Items"  pane in FTK, and select the FAT1 storage area.  Doing so will display the hexadecimal values for all of the files on Helen's flashdrive.

    

It seems suspicious that there is this much data present for only a single text file. So we think that Helen tried to get rid of  something taht was once on the flashdrive, But how do we find out what it was? 

We can make use of a tool in FTK that specializes in reading this kind of data. The tool is the data carver. To use it, We  Select TOOLS>DATA CARVING, and press "okay" to the pop up box that appears. We have just instructed FTK to read and interpret the  information that corresponds to files that we cannot see. 

Sure enough, the data carving tool produces  two files that were previously not view-able  a .jpg file and a .pdf file-good thing we double checked.  We can view either file by double-clicking.

Judging by the nature of the files, its probably best that we call Theseus and tell him the bad news.

The  Carved: JPG file

The carved PDF file:

To preserve what we found, FTK allows us  to add the carved files to the case, and then export them onto our computer. 

________________________________________________________________________

I hope that this blog post has provided you with an insightful-yet easy to follow- guide to doing a basic file restoration from a storage device that has been reformatted. My next post will demonstrate how to crack open a password protected file.

Finding Deleted Files

Finding Deleted Files


Hi there. Today I am going to be showing you how to find files that have been deleted on a storage device (in our case, a flash drive).  But before I can show you how to do this, I need to make sure that you are doing it in a digitally safe manner. 

To follow along in this tutorial, you will need:

The Demo Version of\\Forensic Toolkit 1.81: Available Here
ThumbScrew Write-blocking freeware: Available  Here
A copy of the flash drive we will be analyzing: Coming Soon

_________________________________________________________________________________

For the sake of this exercise, lets use the following scenario: 

"A friend of ours, Theseus,  has come to us with  a concern. He fears that his girlfriend Helen, has been unfaithful to him. He  brings us  a flashdrive of hers, and asks us to see if we can find anything  to confirm his suspicion."

So we begin.

First, we want to activate our write blocking software, ThumbScrew, on the computer we will use for the  examination. In our computer's system tray, we click the the Thumbscrew Icon, choosing to make "USB write only" 

What this will do is modify our computer's registry to prevent us  from accidentally writing to Helen's USB flashdrive when we plug it into our computer. This is important because we want to return the flashdrive in the exact same way we found it. Forensically speaking, we are ensuring that the evidence will not be altered by our investigatory process. Now we can plug in Helen's flash drive.


Next, we need a productive way to look through the flashdrive. We could use Windows Explorer, but without special forensic software, our analysis options are very limited. 
We will use  Forensic Tool Kit. At the opening screen, we select the option that allows us to go directly into working in FTK.  

We go  to FILE>ADD EVIDENCE and click NEXT twice. 

 We will be asked to choose the format of the evidence that you wish to add to the case.  We want to select the "Physical Drive" option. Now, we can select Helen's flashdrive. 


Once we have selected  the flashdrive as evidence, we should see a screen that looks like this:

 


FTK has taken Helen's flashdrive, and has analyzed and organized all of the files on it. Just one problem though. What files?  FTK is reporting "0" for the number of files for every type (with the exception of a few file system folders).  It even shows there are no deleted files on the flashdrive.


We double check in Windows Explorer, and sure enough, nothing. It would appear as if Helen's flashdrive is empty. But wait! Before we tell Theseus anything, we need to take a closer look.  Doesn't it seem odd that Helen would carry around a flashdrive with nothing on it?
   
Maybe she  wiped or reformatted her flashdrive before Theseus could get a hold of it.  After all, Helen is more tech-savvy than most. This would have  performed an advanced delete on any files that were on the flashdrive. If there were any incriminating files, they would now be hidden from the flash drive's file directory- and wouldn't appear in any of FTK's categories. 

To make sure we aren't missing anything , we need to take a look at the hexadecimal values of the flashdrive's storage space. To do this, select the "Total File Items"  pane in FTK, and select the FAT1 storage area.  Doing so will display the hexadecimal values for all of the files on Helen's flashdrive.  If there is really nothing on the drive, we should see the  empty HEX value "00" all of the way through.  

We can see that this isn't the case.  So we know that Helen tried to get rid of something, But how do we find out what it was? 

We can make use of a tool in FTK that specializes in reading this kind of data. The tool is the data carver. To use it, We  Select TOOLS>DATA CARVING, and press "okay" to the pop up box that appears. We have just instructed FTK to read and interpret the  information that corresponds to files that we cannot see. 


Sure enough, the data carving tool produces  two files that were previously not view-able  a .jpg file and a .pdf file-good thing we double checked.  We can view either file by double-clicking.

Judging by the nature of the files, its probably best that we call Theseus and tell him the bad news.

To preserve what we found, FTK allows us  to add the carved files to the case, and then export them onto our computer. 

________________________________________________________________________

I hope that this blog post has provided you with an insightful-yet easy to follow- guide to doing a basic file restoration from a storage device that has been reformatted. My next post will demonstrate how to crack open a password protected file.

Hello.

Hello.

The purpose of this blog is to provide easy to follow "how-to's" related to computer forensics. The posts will focus on simplified versions of real-world forensic applications. Best of all, each will be done using free (or almost free) tools- making it possible for you to try things yourself.

 Computer forensics is a fascinating area of study, and I hope this blog helps you to appreciate it as much as I do.