digitalsleuth / WIN-FOR

Windows Forensics Environment Builder
https://digitalsleuth.gitbook.io/win-for-documentation/
MIT License
103 stars 18 forks source link

Download link for MiTeC Windows Registry Recovery is vey slow, hang up installation #6

Closed Qynklee closed 1 month ago

Qynklee commented 1 month ago
version: 3.1.2
description: MiTeC Windows Registry Recovery. Registry hive file viewer and analyzer
homepage: https://www.mitec.cz/wrr.html
license: Proprietary
changelog: https://www.mitec.cz/Data/XML/data_wrrvh.xml
url: https://www.mitec.cz/Downloads/WRR.zip
hash: 13b65261ce4e175e8799564d4e0dd699e2a2c6c2af69761e6b374195611a0196
bin: WRR.exe
shortcuts:
- - WRR.exe
  - MiTeC\Windows Registry Recovery
checkver:
  url: https://www.mitec.cz/Data/XML/data_wrrvh.xml
  xpath: /VH/RECORD[DATE!='under development']/VERSION
autoupdate:
  url: https://www.mitec.cz/Downloads/WRR.zip

I found this info in other github, installation hang up when install it. I think need config timeout when download and retry after installation completed image

digitalsleuth commented 1 month ago

Hi @Qynklee , I'll take a look at this and see what might be causing the hang up. Since all of the other MiTeC tools seem to download properly, I don't believe it's a website issue, but I'll see what I can find out.

digitalsleuth commented 1 month ago

Can you also provide the link to the other GitHub you referenced? I believe I've found the cause, but would appreciate being able to see the input from the other repo. Cheers!

Qynklee commented 1 month ago

In this, I dont find any other link about WRR.zip in repo. So I find in google and got this: https://github.com/Ash258/Shovel-Ash258/blob/main/bucket/WindowsRegistryRecovery.yml I download by this link and my speed about ~ 5KB/s. I think it make my WIN-FOR installation very slow.

Qynklee commented 1 month ago

This is my installation errors log after completed. I think some errors because I disable Windows Defender before install. errors.txt

digitalsleuth commented 1 month ago

It appears that Windows Defender identifies this file as malicious and it's possible that the hang-up is due to this. Can you please provide your winfor-saltstack log as well, located on the root of the C: drive?

Qynklee commented 1 month ago

Here you are, my logs about 54MB so I compress it by zip. winfor-saltstack-v2024.9.1.zip

Qynklee commented 1 month ago

I already disable Windows Defender before install so I think some module cant add to exclusion, which make some errors image

digitalsleuth commented 1 month ago

I have a few possible solutions for this that I can implement. Would you possibly be able to provide the output of the following command from a PowerShell prompt: Get-MpComputerStatus. This way I can better detect the status of Defender prior to attempting to add exclusions which won't work.

As for the MiTeC downloads, it appears that you either may have had a connection issue, or may be behind a proxy, because I'm seeing a lot of "HTTP 599" errors and "Errno 10061". Sometimes these errors are because of a proxy, firewall, or some other appliance in the way of the connection.

Qynklee commented 1 month ago

Yeah. This is my output command, hope it can help you image

Qynklee commented 1 month ago

I am creating new VM with original Windows 10 without disable Defender and run WIN-FOR installation again 😄

digitalsleuth commented 1 month ago

Could you also try running the following from a PowerShell prompt: Get-Service windefend

Qynklee commented 1 month ago

Yeah. It's stopped image

digitalsleuth commented 1 month ago

Perfect. Since that command works on your system and provides the expected result, I can use that for validation. Cheers!

Qynklee commented 1 month ago

Thanks you so much 😄 I'm glad I could help