First, to clone the drive I used a duplicator. One of these can be found on Amazon for less than a $100 depending on the model and the features you get. One such model can be found at this link and I have also included a picture below:
After the drive is cloned, I use an external enclosure to mount the drive. Similar to the one at this link or below:
When you mount the drive verify that you mount it read only. I am utilizing a Debian linux distro called Kali to conduct the analysis. Initially when I plugged the drive in I saw the following:
The hard drive after plugging it in showed up as /dev/sdb and it auto-mounted it's 2 partitions in the /media folder. These were also mounted as you can see rw which stands for read-write. However, to preserve the information we want to re-mount this hard drive as read-only so nothing can change. To do this the following commands were issued:
umount /dev/sdb1 - Command to unmount the first partition
umount /dev/sdb2 - Command to unmount the second partition
mkdir /mnt/analysis - Create a directory under the /mnt partition to mount to
mount -t ntfs /dev/sdb2 /mnt/analysis -o ro - mount the 2nd partition to the /mnt/analysis directory read-only
After mounting the drive read-only I like to scan it with an anti-virus (AV). The anti-virus that I have installed on Kali is ClamAV. With up-to-date signatures I initiated a scan on the partition that I mounted. Most of the time when an AV detects malware it will remove it, however I do not want it removed. I want to use the results of the AV scan to assist in the analysis. Let this run in the background as you conduct other tasks. Below are the commands executed to run a scan on the second partition.
clamscan -i -r /mnt/analysis
# The above command will run the ClamAV scan, -i will only display the infected files, -r does a recursive scan and then what directory or mount point do I want it to scan.
To create a timeline based on the files on the physical drive we will use a utility that is part of the sleuth kit called fls. The description of fls as contained in the man page is fls lists the files and directory names in the image and can display file names of recently deleted files for the directory using the given inode.
I used the following command to create the timeline:
fls -l -p -r /dev/sdb2 > fls-timeline-output.txt
After this command completes you will have a timeline of the filesystem. To explain the output of this file. It contains 9 columns that are tab delimited.
1st column at a high level is if it is a directory, file, a deleted file, file unique identifier, and parent identifier
2nd column is the filepath and filename
3rd column is the date/time of when the file was last modified
4th column is the date/time of when the file was last accessed
5th column is the date/time of when the master file table (MFT) was last modified
6th column is the date/time of when the file was created
Another method to get a timeline is with the following 2 commands:
fls -r -m "/mnt/analysis" /dev/sdb2 > fls-bodyfile.txt
mactime -b fls-bodyfile.txt -d > fls-bodyfile.csv
The above commands will create a comma-delimited file which will allow you to view it in Microsoft Excel or Libre / Open Office.
Glancing back at the anti-virus (AV) scan that is running it had come back flagging 3 files:
/Users/<>/AppData/Local/LogMeIn Rescue Applet/LMIR0001.tmp/lmi_rescue.exe: Win.Worm.Agent-9246
/Users/<>/AppData/Local/LogMeIn Rescue Applet/LMIR0001.tmp/LMI_Rescue_srv.exe: Win.Worm.Agent-9246
/Users/<>/AppData/Local/LogMeIn Rescue Applet/LMIR0001.tmp/ra64app.exe: Win.Worm.Chir-1896
cat fls-timeline-output.txt | grep -i "LogMeIn" > fls-timeline-w-LogMeIn.txt
r/r 60435-128-4: Users/<>/AppData/Local/Microsoft/Windows/Temporary Internet Files/Content.IE5/H1057PY5/Support-LogMeInRescue.exe 2015-06-09 18:33:03 (MDT) 2015-06-09 18:33:03 (MDT) 2015-06-09 18:33:03 (MDT) 2015-06-09 18:33:03 (MDT) 1528128 0 0
r/r 60435-128-5: Users/<>/AppData/Local/Microsoft/Windows/Temporary Internet Files/Content.IE5/H1057PY5/Support-LogMeInRescue.exe:Zone.Identifier 2015-06-09 18:33:03 (MDT) 2015-06-09 18:33:03 (MDT) 2015-06-09 18:33:03 (MDT) 2015-06-09 18:33:03 (MDT) 26 0 0
The LogMeIn installed itself inside of the following directory Users/<>/AppData/Local/LogMeIn Rescue Applet/LMIR0001.tmp/. Located in this directory is a session log which tells us the technician ID that was used by the miscreant and when the remote control / view of the session began. Some of the information has been removed.
2015-06-10 12:33:05 AM|00000fc4||Starts=Rescue Applet
2015-06-10 12:33:05 AM|00000fc4||AppletRole=Standalone
2015-06-10 12:33:05 AM|00000fc4||AppletVersion=7.6.403.1728
2015-06-10 12:33:05 AM|00000fc4||OperatingSystem=Windows N 6.1.7601
2015-06-10 12:33:05 AM|00000fc4||Folder=C:\Users\<>\AppData\Local\LogMeIn Rescue Applet\LMIR0001.tmp\
2015-06-10 12:33:35 AM|00001160||Gateway=control.app02-04.logmeinrescue.com
2015-06-10 12:33:47 AM|00001160|360164719|TechnicianID=14565682
2015-06-10 12:34:02 AM|00001178|360164719|AppletRole=Remote Control/View
2015-06-10 12:34:02 AM|00001178|360164719|AppletVersion=7.6.403.1728
2015-06-10 12:52:25 AM|00001178|360164719|Stops=Rescue Applet
2015-06-10 12:54:29 AM|00000fc4||Stops=Rescue Applet
2015-06-10 12:54:30 AM|00001160|360164719|Stops=Rescue Applet
Even though it appears this miscreant did not get anything, they are after any information they can get. This ranges from bank account information, credit card information and more. I have seen it where they will create the victim an email account to use so the victim will be able to transfer documents back and forth to them.
When this sort of intrusion occurs the hard drive should be wiped and reinstalled regardless of the situation.