https://hub.docker.com/u/dfirscripts
Siftgrab is an automation script written in Bash that simplifies the process of parsing Windows forensic artifacts from Linux. It is wrapper for various open-source forensic tools and facilitates the mounting and extraction of forensic data from Windows systems.
Siftgrab runs on Ubuntu 22.04 in a VM or standalone, alternatively it can be installed as a Docker Image.
It provides easy access to different open source Linux forensic tools and custom scripts. It runs without having to separately locate download, install, or remember different command line options.
It can also be used at scale to process multiple data collections at once from tools like Kape and CyLR.
You can find a walk-through of the Siftgrab process here:
https://www.sans.org/blog/up-and-running-with-siftgrab/
The latest version outputs a number of custom Excel spreadsheets to assist in analysis. There is also a new submenu for easy access to extended artifact and memory parsing options.
Install script
To install all tools and dependencies, run the following commands:
(Recommended installation is using fresh installation of Ubuntu 22.04 VM or WSL. The install script works on Kali with some limitations. For full best results use the Docker install)
Note: WSL 2 has file system performance issues which may cause it to run slower
Consider WSL 1 or VM/Docker installs if speed is an issue.
INSTALLATION: Run the following commands from the terminal.
wget https://raw.githubusercontent.com/dfir-scripts/installers/main/install-forensic-tools.sh
sudo chmod 755 install-forensic-tools.sh
sudo ./install-forensic-tools.shDocker Install
Download and install latest version from Dockerhub and run. The Siftgrab menu loads automatically.
NOTE: Use -v parameter to provide access to mount points and output folders outside of docker image.
sudo docker pull dfirscripts/siftgrab:latest
sudo docker run -it -v /mnt:/mnt -v /cases:/cases dfirscripts/siftgrab
To access the siftgrab menu simply type:
sudo siftgrab
Menu Options Detail
1) Mount a Disk or Image with ermount
Basic disk mounting (ermount) can be performed using siftgrab menu selection 1
or by running the ermount command from the terminal.
When using the Docker, mount disks before running the
docker image to allow access to mount points and provide output locations.
********************************************************
EverReady Disk Mount
Mount/umount disk and disk images
(E01, vmdk, vhd(x), vdi, raw, iso, hfs+, qcow2 and vss)
USAGE: /usr/local/bin/ermount [-h -s -u -b -rw] -i \
<Image file or Disk> -m <Mount Point> -t <File System Type>
OPTIONAL:
-i Image file or disk source to mount
-m Mount point (Default /mnt/image_mount)
-t File System Type (Default NTFS)
-h This help text
-s ermount status
-u umount all disks from /usr/local/bin/ermount mount points
-b mount bitlocker encrypted volume
-rw mount image read write
********************************************************
2) Analyze Windows Artifacts: Mounted Disk, Image or Collections(e.g. KAPE, CyLR)
Once Windows file artifacts are readable (mounted disk or artifact collection) they can be processed using selection 2.
IMPORTANT NOTE: Artifacts must be located in their original path!
(example: registry files <source_path>/Windows/System32/config)
Menu selection #2 prompts for the following information:
Image source root directory: (default /mnt/image_mount)
Output Destination Directory: (default /cases).
If data exists and can be parsed, output will be created for different data types:
3) Analyze Windows Artifacts Collected from Multiple Systems (e.g. KAPE, CyLR)
- Recursive results using same process as selection 2
- Source path is the Directory holding unzipped collections
- Example of source data:
/mnt/hgfs/USB/R&D
-Each system's root path is similar to extracted Kape/CyLR collections
/mnt/hgfs/USB/R&D/RD_System1/C
/mnt/hgfs/USB/R&D/RD_System2/C
4) Extract Windows Eventlogs to jsonl and Sigma Scan using Hayabusa
-Extracts Windows Event Logs to jsonl, run Hayabusa and several parsers.
-Outputs to a destination named WindowsEventLogs
5) Analyze Windows Registry
-Runs Regripper and Regtimeline on Windows registry files.
-Output goes to a directory using the computer name in the system registry
6) Save a copy of Windows Artifacts
-Save a Gzipped copy of common Windows Artifacts from a mounted data source
7) lf - Terminal file manager
-Launch lf file system browser
8) Additional Parsers and Memory Analysis (Sub Menu)
** 1) Evtxtract (Carve binary files for Windows Event Logs)
** 2) ntfs_parser (Deep parsing of MFT,USNJRNL,Logfile,INDX)
** 3) prefetch-carve.py (Carve binary files for prefetch)
** 4) usncarve.py (Carve binary files for $usnjrnl entries)
** 5) bulk_extractor(Image and DMP file artifact extraction)
** 6) Didier Stevens Tools(oledump, pdftool many parsers and decoders)
** 7) Volatility 3.0 (Memory image analysis)
** 8) Memprocfs (Mount and analyze Windows memory images)
** 9) BMC-Tools (Carve RDP Image Tiles from RDP Cache)
** 10) Yarp + Registryflush (Merge registry hives with transaction logs)
** 11) EventTranscriptParser.py (Parse Eventranscript.db)
9) Terminal
-Access terminal from menu
10) Read me
-View the readme file
Results can be reviewed from Siftgrab using lf file browser or from Windows using preview programs like Quicklook. Results are mainly csv and json so they can easily be searched and reviewed using grep, jq, excel or search tools like Agent Ransack.
https://hub.docker.com/u/dfirscripts
Triage Output: By default output data goes to the /cases directory but can be sent to a network share Output is sorted by artifact category:
./All_Summary
./All_Slicers
./Alert
./AlternateDataStreams
./Amcache
./BITS
./Browser_Activity
./Deleted_Files
./EventTranscript
./LNK
./LogFile
./lolbas
./MFT
./PCA
./PowerShell
./Prefetch
./RDP
./Registry/Impacket
./Registry/Regripper
./Registry/yarp-registryflush.py
./SRUM
./ScheduledTasks
./Services
./Timeline
./USB
./UserAccessLog
./Volatile
./WinActivitiesCache
./WindowsEventLogs
./WMI
Directory creation:
The following directories are created:
/mnt/raw
/mnt/image_mount
/mnt/vss
/mnt/shadow
/mnt/bde
/mnt/smb
/cases
/usr/local/src
/opt/app/
From Gift PPA: (Not available for Kali)
libscca libewf-tools libbde-tools libvshadow-tools libesedb-tools liblnk-tools
libevtx-tools plaso-tools bulk-extractor
From Python PIP:
prefetchcarve usncarve LnkParse3 usnparser tabulate puremagic construct libesedb-python==20181229 openpyxl>=2.6.2 pefile>=2019.4.18 python-registry>=1.3.1 pywin32-ctypes>=0.2.0 six>=1.12.0 bits_parser pyarrow evtxtract beautifulsoup4 libscca-python setuptools==58.2.0 python-evtx regex oletools pandas sqlalchemy
From Github:
https://github.com/ANSSI-FR/bmc-tools
https://github.com/msuhanov/yarp
https://github.com/msuhanov/dfir_ntfs
https://github.com/dkovar/analyzeMFT
https://github.com/yarox24/EvtxHussar/
https://github.com/fireeye/BitsParser
https://github.com/dfir-scripts
https://github.com/keydet89/Tools
https://github.com/obsidianforensics/hindsight
https://github.com/davidpany/WMI_Forensics
https://github.com/volatilityfoundation/volatility3
https://github.com/kacos2000
https://github.com/DidierStevens/DidierStevensSuite
https://github.com/brimorlabs/KStrike
https://github.com/MarkBaggett/srum-dump
https://github.com/salehmuhaysin/JumpList_Lnk_Parser
https://github.com/wagga40/Zircolite
https://github.com/stuxnet999/EventTranscriptParser
https://github.com/Silv3rHorn/4n6_misc
https://github.com/omerbenamram/evtx
https://github.com/omerbenamram/mft
https://github.com/Yamato-Security/hayabusa
https://github.com/gokcehan/lf
https://cert.at/de/downloads/software/software-densityscout
https://github.com/gleeda/misc-scripts/blob/master/misc_python/jobparser.py
From APT (Common)
git curl net-tools vim fdisk fdupes sleuthkit dcfldd afflib-tools autopsy qemu-utils lvm2 exfatprogs kpartx pigz exif dc3dd pff-tools python3-lxml sqlite3 jq yara gddrescue unzip p7zip-full p7zip-rar hashcat foremost testdisk chntpw graphviz ffmpeg mediainfo ifuse clamav geoip-bin geoip-database geoipupdate python3-impacket libsnappy-dev reglookup ripgrep vinetto
From APT (Kali Only):
gnome-terminal libewf-dev ewf-tools libbde-utils libvshadow-utils libesedb-utils xmount liblnk-utils libevtx-utils python3-llfuse python3-libesedb plaso