6:38 p.m.
One thing we need to do is search the registries for the keys that autorun malware.
Does anyone know of a free tool that will do that? I'm currently using Encase to do
that but it is and expensive solution.
Harlan's RegRipper will dump some registry entries and sometimes it works, but it does
not search.
Mike
8:51 p.m.
Create a list of the keys/values you want to search and supply them to the
'Printkey' plugin
(http://code.google.com/p/volatility/wiki/CommandReference#printkey)
Additionally, depending on what you're searching against you can use Autoruns and
parse its contents or if you want a GUI search, try Registry Decoder.
--
Glenn P. Edwards Jr.
GREM, GCFA, GCIH
On Tuesday, May 15, 2012 at 6:38 PM, Mike Lambert wrote:
One thing we need to do is search the registries for
the keys that autorun malware.
Does anyone know of a free tool that will do that? I'm currently using Encase to do
that but it is and expensive solution.
Harlan's RegRipper will dump some registry entries and sometimes it works, but it
does not search.
Mike
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org (mailto:Vol-users@volatilityfoundation.org)
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
9:31 p.m.
Hi Glenn,
I specifically need to search the registry files (disk forensics) extracted from
compromised systems, not memory. I was looking for a free tool that non-forensic examiners
(disk) could get for free. (Forensic examiners have tools, they just cost a lot.)
Thanks! I will look up Registry Decoder.
Have a good evening,
Mike
Date: Tue, 15 May 2012 20:51:02 -0400
From: hiddenillusion(a)gmail.com
To: dragonforen(a)hotmail.com
CC: vol-users(a)volatilityfoundation.org
Subject: Re: [Vol-users] searching registries
Create a list of the keys/values you want to search and supply them to the
'Printkey' plugin
(http://code.google.com/p/volatility/wiki/CommandReference#printkey)
Additionally, depending on what you're searching against you can use Autoruns and
parse its contents or if you want a GUI search, try Registry Decoder.
--
Glenn P. Edwards Jr.
GREM, GCFA, GCIH
On Tuesday, May 15, 2012 at 6:38 PM, Mike Lambert wrote:
One thing we need to do is search the registries for the keys that autorun malware.
Does anyone know of a free tool that will do that? I'm currently using Encase to do
that but it is and expensive solution.
Harlan's RegRipper will dump some registry entries and sometimes it works, but it does
not search.
Mike
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
10:23 p.m.
I think Registry Decoder would be useful for you:
http://www.digitalforensicssolutions.com/registrydecoder/
-----Original Message-----
From: Mike Lambert <dragonforen(a)hotmail.com>
Sender: vol-users-bounces(a)volatilityfoundation.org
Date: Tue, 15 May 2012 20:31:17
To: <hiddenillusion(a)gmail.com>
Cc: Volatility List<vol-users(a)volatilityfoundation.org>
Subject: RE: [Vol-users] searching registries
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
10:48 p.m.
Registry Decoder will definitely do what you want. Just process the
hives in it, and then you can a search (either standard or with
wildcards) and you can limit to just keys, names, or values, and you
can also filter by last write time. You will immediately get tabs
generated for all the hits, and then you can get them automatically
reported into a number of formats. For more information, please see
the instructions file in the downloads section of the website.
On Tue, May 15, 2012 at 9:23 PM, Jamie Levy <jamie.levy(a)gmail.com> wrote:
I think Registry Decoder would be useful for you:
http://www.digitalforensicssolutions.com/registrydecoder/
-----Original Message-----
From: Mike Lambert <dragonforen(a)hotmail.com>
Sender: vol-users-bounces(a)volatilityfoundation.org
Date: Tue, 15 May 2012 20:31:17
To: <hiddenillusion(a)gmail.com>
Cc: Volatility List<vol-users(a)volatilityfoundation.org>
Subject: RE: [Vol-users] searching registries
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
3:11 p.m.
New subject: searching registries - Thank You All
David, Glenn, Jamie, Andrew and Mark,
Thank you all for your suggestions!! I have several options for people to open dead
registries that do not have forensic tools.
Have a great day all!
Mike
Date: Tue, 15 May 2012 21:48:50 -0500
Subject: Re: [Vol-users] searching registries
From: atcuno(a)gmail.com
To: jamie.levy(a)gmail.com
CC: dragonforen(a)hotmail.com; vol-users-bounces(a)volatilityfoundation.org;
hiddenillusion(a)gmail.com; vol-users(a)volatilityfoundation.org
Registry Decoder will definitely do what you want. Just process the
hives in it, and then you can a search (either standard or with
wildcards) and you can limit to just keys, names, or values, and you
can also filter by last write time. You will immediately get tabs
generated for all the hits, and then you can get them automatically
reported into a number of formats. For more information, please see
the instructions file in the downloads section of the website.
On Tue, May 15, 2012 at 9:23 PM, Jamie Levy <jamie.levy(a)gmail.com> wrote:
> I think Registry Decoder would be useful for you:
>
> http://www.digitalforensicssolutions.com/registrydecoder/
>
>
>
> -----Original Message-----
> From: Mike Lambert <dragonforen(a)hotmail.com>
> Sender: vol-users-bounces(a)volatilityfoundation.org
> Date: Tue, 15 May 2012 20:31:17
> To: <hiddenillusion(a)gmail.com>
> Cc: Volatility List<vol-users(a)volatilityfoundation.org>
> Subject: RE: [Vol-users] searching registries
>
> _______________________________________________
> Vol-users mailing list
> Vol-users(a)volatilityfoundation.org
> http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
>
>
> _______________________________________________
> Vol-users mailing list
> Vol-users(a)volatilityfoundation.org
> http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
4564
days inactive
4566
days old
vol-users@lists.volatilityfoundation.org
5 comments
4 participants
participants (4)
-
Andrew Case -
Glenn Edwards -
Jamie Levy -
Mike Lambert