Windows Forensics

Setting up your forensic workstation

Build your forensic workstation tutorial and downloads

The environment was built on a 12-ccore Classic Mac Pro as it had sufficient storage to host all the VMs.
I used the Blue Cape Security - Build your forensic workstation tutorial as it was very comprehensive:  BlueCapeSecurity - Build-your-forensic-workstation - Opens in new tab

Other Download Links:

VirtualBox and Windows 2019 VM installation

Update VirtualBox v7 License Terms Error:

Many have encountered issues while installing Windows using VirtualBox version 7, specifically an error stating: “Windows Cannot Find the Microsoft Software License Terms”.

Windows VirtualBox Error - Opens in new tab

Troubleshooting Steps:

WSL and Ubuntu Installation on Windows 2019 Server

Important: Only proceed with this tutorial if you are setting up a forensic workstation on Windows 2019/2022 server.

Start by installing Windows 2019 Server. Using a VHD is recommended to expedite the installation process, as the .iso installation is time-consuming.

Server Setup

Once the server installation is complete, shut it down and adjust the virtual hard disk size as follows:

Navigate to: File > Tools > Virtual Media Manager.
Ensure the hard disk size is set to 100GB*.

Adjust Disk Size

Install the VirtualBox 7.0.14 Oracle VM VirtualBox Extension Pack - Opens in new tab

Additionally, install the Guest Additions to optimize VM performance.

Enable the Windows Subsystem for Linux (WSL) feature by executing the following command in PowerShell:

Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux

Configure the Windows Environment

  1. Restart the workstation.
  2. Install .NET Framework 4.5, a prerequisite for Chocolatey.
  3. Restart after installation.
  4. Install Windows Terminal. If you encounter issues with the Microsoft Store, use Chocolatey for installation. Always review the script before execution:
Set-ExecutionPolicy Bypass -Scope Process -Force; 
[System.Net.ServicePointManager]::SecurityProtocol = 
[System.Net.ServicePointManager]::SecurityProtocol -bor 3072; 
iex ((New-Object System.Net.WebClient).DownloadString('[https://community.chocolatey.org/install.ps1](https://community.chocolatey.org/install.ps1)'))
  1. Install Windows Terminal via Chocolatey:
choco install microsoft-windows-terminal

Forensic Workstation Configuration Best Practices

  1. Set your time zone to UTC. • This standardizes your forensic analysis across tools and time zones, ensuring accurate event correlation.
  2. Configure Windows Explorer to show hidden files. • Navigate to File Explorer -> View -> check “Hidden items” and “File name extensions”.
  3. Create directories for case data and forensic tools: • C:\Cases for evidence and C:\Tools for utilities. • Placing these directories at the root minimizes path length when using command-line tools.
  4. Modify Microsoft Defender settings: • Temporarily disable “Real-time protection” and, if necessary, permanently disable it via Group Policy. • Exclude “C:\Cases” and “C:\Tools” from virus and threat protection scans to prevent interference with your forensic work.

Finally, take a snapshot of the VM to preserve this configuration.

Update: December 2022!

Make sure to download the Ubuntu 20.04 package directly! There are more recent versions and many have reported issues with them.**

WSL and Ubuntu installation on Windows 10 (alternative)

Important: Follow this section only if your forensic workstation is on Windows 10/11.

VirtualBox and Windows 2022 Server

Untitled

  • Complete the form and select download now:

Untitled

  • Choose the language and select your language, and choose the appropriate format (VHD or ISO). For this setup, I recommend using the ISO format.:

Untitled

Hardware Configuration for VirtualBox:

Allocate 24GB RAM and a 100GB disk with a NAT network connection.

Untitled

  • Ensure the VirtualBox Guest Additions are installed to enhance performance and add extra features
    • Mount the .iso file:

Untitled

  • Grant permission and restart after the installation has completed:

Untitled

  • Install pending updates
  • Install the Windows Subsystem for Linux (WSL). Execute the following command in PowerShell (Run as Administrator):
wsl —install

Untitled

  • Wait for Ubuntu to be downloaded and installed:

Untitled

Installing Windows Terminal and Configuring Linux Subsystem

Prerequisite Installation

To facilitate seamless navigation between various terminal windows (e.g., Ubuntu, Kali Linux, PowerShell), follow these steps. Ensure you're in the Downloads directory before executing the PowerShell commands.

Installing Windows Terminal

Windows Terminal Preview

Install the package with:

Add-AppxPackage .\Microsoft.WindowsTerminal_1.19.10821.0_8wekyb3d8bbwe.msixbundle

After installation, verify the status of the package. Ensure the Status is “OK”:

Get-AppxPackage *WindowsTerminal* -AllUsers

Installing Kali Linux Subsystem

  1. Obtain the URL of the Appx package from the Kali Linux Microsoft Store.
  2. Open RG-Adguard in a new tab.
  3. Paste the Microsoft Store URL into RG-Adguard, and download the .appxbundle file.

To install the package, run the following command in a PowerShell window with Administrator privileges:

Add-AppxPackage .\KaliLinux.54290C8133FEE_1.2024.1.0_neutral_~_ey8k8hqnwqnmg.AppxBundle

Configuring Directories

Create the following directories to organize your work environment:

New-Item -Path "C:" -Name "Cases" -ItemType "Directory"
New-Item -Path "C:" -Name "Tools" -ItemType "Directory"

Optional: Consider creating an additional Installers folder within the Tools directory to store all installation files post-setup.

Additional Setup

Enable the viewing of hidden files and file extensions to streamline file management.

Untitled

Finally, proceed with the installation of the recommended Windows tools as needed.

Untitled

Snapshot Shutdown and take a snapshot. The previous took a lot of time and we don’t want to go through all the steps again. - Note updated Plaso install instructions here:

Install Plaso on Windows

Plaso is not available as a Windows executable and must instead be downloaded as a python binary therefore Python 3 should be installed first so the package can be installed using pip3:

  1. Install Python: - Download and install Python 3.x from the official Python website

    • Make sure to check the “Add Python to PATH” option during installation.

  2. Open Command Prompt (CMD): - Press Win + R, type “cmd”, and press Enter.

  3. Install plaso using pip:

    • In the Command Prompt, type the following command and press Enter:

      `pip install plaso`

  4. Verify the installation:

    • To verify that plaso is installed, type the following command:

plasoinfo --version

  • If you see the version number, plaso is successfully installed.

Note: If you encounter any issues during installation, make sure you have administrative privileges and that Python is added to your system PATH.

Windows Forensics Navigation

  1. Windows Forensics Overview 

  2. Roadmap 

  3. Forensic Workstation Setup This Page

  4. Data Collection Process Overview

    4.1 Target System Containment

    4.2 Memory Acquisition

    4.3 Disk Acquisition

  5. Forensic Data Examination