Plaso 20200430 Released

By

Plaso 20200430 released

The Plaso team is pleased to announce a new Plaso release, 20200430. This release has a significant change with libfsntfs/pyfsntfs becoming the default for accessing NTFS volumes. With this comes:
  • A substantial speedup for processing NTFS images. While the exact numbers will vary based on the data being processed, we’ve seen some of test images processed twice as fast with libfsntfs when compared to TSK.
  • Performance improvements for directories with a large number of entries (#810). Directories with a very large (or huge) number of entries could still be a performance bottleneck (libfsntfs/16).
  • Support for Windows Overlay Filter (WOF) compressed data (LZX and LZXPRESS-Huffman).
  • Preservation of control characters in file and data stream names (sleuthkit/1894).
  • Support for NTFS directories with case-sensitive entries.

If you run into any problems with NTFS parsing, note that pytsk NTFS support can be enabled using the --vfs-back-end=tsk option for image_export.py, log2timeline.py and psteal.py.

Other changes

  • Many of the formatters are now configuration driven (#444) enabling more user customization of the final event message. We’ll continue this migration, and provide more details about how to use this feature in future releases.
  • Further storage refactoring to enable more database normalization
  • Tools behave more nicely when used with pipes (#2846)
  • Support for Python 3.8
  • Fedora 32 and Ubuntu 20.04 releases

As usual, there’s a bunch of cleanups, performance tweaks and bug fixes, the full list of which are available in the release milestone.

Future plans

  • We continue to most of the formatters to configuration driven (#444) by adding support for enumeration and flag values.
  • We are planning to further improve the AMCache.hve parser to support more types of subkeys (#2790).
  • Work on alternative Plaso storage back-ends like Redis and Elasticsearch is continuing.

Per the Plaso's Users' Guide, we recommend using Docker to install Plaso with minimum hassle.

If Docker does not fit your needs there are installation instructions available for MacOS, Ubuntu and Fedora.

If you run into problems take a look at the Installation Problems page in the Plaso documentation, to see if other people have seen the issue before. If nothing there helps, ask for help on the Open Source DFIR slack or open an issue on the tracker.


Popular posts from this blog

Parsing the $MFT NTFS metadata file

By
Background Numerous articles have been written about parsing the $MFT NTFS metadata file before. Some of these explain the technique itself [ 1 ] and others mostly focus on how to use tools. Rarely do articles mention the pros and cons of the technique from a digital forensics perspective [ 2 ].  What is $MFT parsing?  For readers not familiar with the NTFS file system, MFT stands for Master File Table. This table is stored in a file system metadata file, meaning that as far as the file system is concerned it is a file, however that the file contains file system metadata not “regular” content. The name of this file is “$MFT”.  The MFT consists of a sequence of (predetermined) fixed-size entries (or MFT entries). These entries are typically 1024 bytes in size, however the size is defined in the NTFS volume header and in a “regular” MFT entry itself.  The first 4-bytes of a “regular” MFT-entry (or record) starts with the signature “FILE”. The MFT entry can also be filled wit
Read more

Incident Response in the Cloud

By
Many organizations have begun moving a majority of their services towards the cloud in recent years. As a result, attackers have shifted their focus towards the cloud. This has resulted in new techniques and methods specifically designed to compromise cloud infrastructure, like the recent SALTSTACK vulnerability that was widely exploited [ 1 ]. Therefore it is critical for these organizations to have an incident response team that understands the new risks attached to cloud and how cloud can make incident response easier or harder.  In this blog post we will walk you through each phase you may encounter in traditional incident response and highlight the differences when adopting cloud computing. It is aimed towards both those who are new to incident response and cloud computing. We’ve included insights that will benefit organizations taking that step towards cloud who want to ensure they are prepared to respond efficiently to cloud incidents.  Traditional Incident Response Before jump
Read more

Container Forensics with Docker Explorer

By Anonymous
  Introduction As previous blog posts on cloud forensics have noted, applications are increasingly being deployed using container orchestration frameworks such as Kubernetes, especially in cloud environments.  Similar to traditional deployments on physical servers or virtual machines (VMs), when a containerised application has a security issue it can lead to a compromise of the underlying compute architecture. In the case of container deployments this means a compromise of the container itself, the container host, or even a wider cluster compromise via abuse of orchestration tools. Often digital forensics is required to establish what went wrong and remediate any issues. This article will provide an introduction to container forensics with Docker Explorer by working through a scenario involving a compromised container running within a Kubernetes cluster. Although Kubernetes is briefly mentioned, this article will focus on analysis of an individual container rather than the wider clust
Read more