Harlan Carvey has given us a great tool in RegRipper and it's undeniable that many examiners have found it to be a useful addition to their toolbox. RegRipper has a very specific purpose — parse the Windows registry. With some modification, we can turn RegRipper into WindowsRipper, an extremely powerful Windows triage tool. Using WindowsRipper we can parse much more than just the registry.
Adam James, a coworker who did the coding for this project, and I took a look at RegRipper and decided it could be morphed nicely into an amazing triage tool. The first thing Adam did was modify RegRipper to work against a mounted drive. You can read his explanation in the previous post or simply know that his code allows RegRipper to look at a mounted drive, find the Windows installation folder and walk through all of the User profiles found on the drive parsing each NTUSER.dat file. The code was recently posted on the RegRipper.net site.
Using this updated version of RegRipper, we can now ask it parse some other items within the Windows OS. As a proof of concept, we have RegRipper calling Harlan's script for LNK file parsing, launching an external GUI program, and also executing a plugin that calls a command line function. This last item will let us launch any other program that has a CLI simply by running a RegRipper plugin.
RegRipper's current architecture is laid out nicely for becoming a triage tool. When you run RegRipper, you can choose a "plugin" for each specific registry hive. Each plugin consists of numerous modules, which can be run on their own using rip.exe. For instance, looking inside the NTUSER.dat plugin, we see that it runs the following modules.
# List of plugins for the Registry Ripper #????????????- # NTUSER.DAT logonusername acmru adoberdr aim applets fileexts comdlg32 compdesc # The controlpanel plugin is intended for Vista systems only # User hives from systems prior to Vista will show ?not found' controlpanel #listsoft #logon_xp_run mmc mndmru mp2 mpmru mspaper officedocs recentdocs realplayer6 runmru tsclient typedurls muicache userassist user_run vncviewer winzip user_win winrar wallpaper vista_bitbucket
Using this architecture, we can build a plugin that consists of modules for a specific purpose. For instance, in addition to incident response work we also receive HR cases that often involve inappropriate use (typically porn). We could build a plugin called "Inappropriate Internet Use" to call modules to parse parts of the registry, internet history, recent internet searches, and create thumbnail pages of the internet cache. Many of these report items would be created by calling outside executables, bypassing the need for coding a custom module. The plugin would look something like this:
# List of plugins for WindowsRipper #????????????- # INAPPROPRIATE INTERNET USE logonusername recentdocs typedurls recentsearches (calling Nirsoft's MyLastSearch) internethistory (calling Pasco) cachedthumbnails (calling Easy Thumbnails)
Hopefully this example shows the potential that this type of a tool has. We're even working on a timeline plugin.
With a strong community effort, WindowsRipper could grow based on a large library of custom modules. Users could create their own plugins based on these modules. Some modules could include PhotoRec for file carving, MD5Sum for hashing, many of the Nirsoft.net tools and a host of others. We can launch all of these against a mounted drive and compliment other triage programs such as Drive Prophet.
We recorded a short video of our WindowsRipper proof of concept in action. This video shows RegRipper parsing items other than registry and launching external programs from both the main executable and a custom plugin. View the video here.
What we have done is a rough mockup in just a few hours. The plugins and code we have written isn't clean enough to be released yet — but hopefully will be be soon. Please let us know your thoughts on how to make this project even better.
Matt Churchill currently manages the digital forensics practice at Continuum Worldwide and has earned the GCFA, CFCE, CCE, and CISSP certifications.
.PNG "DFIR_ICON_(1).PNG"){kind=icon}
