Forensic Evidence Collection From Windows Host Using Python Based Tool

As a part of digital forensics and incident response, we need to collect artifacts from different systems, application and databases, network and security devices and other. Artifacts will help us to understand recent and historical activities that have been occurred in particular system at a particular time. Two of these artifacts on windows machines are Event Logs and Registry Values specially USB which provides information about external media attached to machine and Run Keys that gives insights on persistence mechanism used by malware. It might be possible that, attacker executes the power shell malicious script that is controlling the system or leave a back door power shell script to access the victim’s system. For this purpose, we are proposing a tool to get power shell events for investigation if attackers are using power shell. Security event logs are the first step towards identifying a threat or a complete attack. So if user receives a spam email then security events generate few events which are related to it and we have also used SIEM tool for further investigation. Our tool also transfers all the event logs in text file such that, an investigator can easily analyze the text file in SIEM tool. sysmon event log is containing all the monitoring events like process creation, termination, network connection, any changes in file creation, timestamp etc. This python based tool has capabilities to fetch the sysmon event logs and store them in a text file. An investigator can pass that file in SIEM tool for further investigation. This may add an additional security patch to the existing scenario.