August 9, 2018
How does exposing Windows Registry data you’ve never seen before sound to you?
We launched two new tools with powerful and unique functionality today – HiveRecon and HbinRecon. We are confident that our customers and colleagues, particularly those interested in the maximum exploitation of electronic evidence, will be pleased that we are yet again exposing valuable information that has not been possible previously.
Summary of HiveRecon Functionality
HiveRecon extracts Registry hives from Windows hibernation and crash dump files, often extracting hives when other solutions have completely failed and extracting healthier (more intact) hives when other solutions have appeared to run successfully. HiveRecon also extracts volatile hives and can incorporate swap files from the same hibernation session to extract even healthier Registry hives than if using a hibernation file alone.
- Extracts Windows Registry hives from hibernation and crash dump files
- Support for both stable and volatile hives
- Optional incorporation of pagefile from same session as hibernation
- Hive header checksum patching
- Detailed CSV output
Summary of HbinRecon Functionality
HbinRecon extracts Windows Registry hive bins (hbins) from any input and decodes the data they contain. Hive bins are essentially the building blocks of Registry hives. Examples of HbinRecon input include healthy Registry hives, fragmented hives, hive transaction logs, and unallocated space. HbinRecon is a surgical tool which is extremely useful in both testing and verification related to Registry data as well as uncovering valuable data not accessible using other methods.
- Identifies and parses Windows Registry hive bins from any input
- Hive (full/partial), transaction log, and hive bin slack identification
- Multiple scan modes for more efficient processing
- Decodes nk, vk, sk, lf, lh, li, ri, and db records
- Date/time decoding (RegFiletime/RegQWord/RegBinary values)
- Powerful nk and vk hunting modules beginning with “BAM Hunter”
- Resident and non-resident data options
- Hive bin carver to carve hive bins from extremely large input
- CSV output with customizable record separator
Why did we build these new tools?
We are a first and foremost a consulting company. We only engage in software development when we determine that existing tools and techniques are failing to expose valuable information in our cases. The following slides represent some of the workflows (processing Windows hibernation files and then attempting to extract Registry hives from them) using a variety of tools that we tested during the development of HiveRecon. In many ways these slides speak for themselves:
At this point, if you are a digital forensics practitioner, you should be asking yourself just how much Registry data you could have had access to in your previous cases if you were properly extracting hives from hibernation and crash dump files.
Where can you get HiveRecon and HbinRecon?
We are in the process of making both tools available to established customers with active software subscriptions. HiveRecon and HbinRecon will be available soon to new customers as well.
Please support us, as we work to make maximum exploitation of electronic evidence more accessible, by learning more about the powerful and unique functionality our tools provide. You can learn more about our tools at https://ArsenalRecon.com/#products. Thank you!
In “BitLocker for DFIR – Part I” we provided a quick summary of BitLocker, details regarding the various “states” of BitLocker volumes that we see most often in our casework, and some thoughts on things that are particularly relevant to digital forensics and incident response practitioners. We will now discuss launching virtual machines from BitLockered disk images.
BitLocker is a Full Volume Encryption (FVE) technology introduced by Microsoft in the Ultimate and Enterprise versions of Windows Vista. BitLocker has come a very long way since Vista, becoming quite flexible (some of our colleagues might prefer the word complicated) and secure if used properly.
Microsoft’s “Office Document Cache” (hereafter, ODC) is complex, infuriating, and misunderstood. For years there have been digital forensics practitioners who knew how valuable information within ODCs was (especially within FSD files), but they were essentially left with scraps after throwing existing tools and techniques against them. After many of the proverbial late nights and early mornings, Arsenal has now drastically improved the situation for our colleagues in digital forensics.
Stay Up to Date With The Latest News & Updates
Join Our Newsletter
Signup for the latest news on Registry, Hibernation Files, and other Digital Investigations related news.
or (617) 277-3625
Terms & Conditions