search

ezaspy / elrond

Accelerating the collection, processing, analysis and outputting of digital forensic artefacts.
MIT License
31 stars 3 forks source link
automation dfir forensics python3

readme

Logo

Accelerating the collection, processing, analysis and outputting of digital forensic artefacts.

License: MIT Issues Forks Stars Subject Last Commit Code style: black

Table of Contents



About

elrond has been created to help fellow digitial forensicators with the identification, extraction, collection, processing, analysis and outputting of forensic artefacts from (up to 20 paritions for) Windows E01 or VMDK, macOS DMG/E01 or VMDK, Linux dd or VMDK disk images as well as raw memory images and previously collected artefacts which can all be outputted into Splunk. I have spent many an incident repeating the same processes by mounting, collecting (mainly Windows) forensic artefacts and then attempting to correlate them together with other data sources and artefacts. Thus, as mentioned above elrond has been built to consolidate those seperate processes into one single script helping to accerlate and automate these otherwise repetitive, tedious and often occasionally-referenced commands. As elrond outputs the artefact information as either CSV or JSON, they can be processed by many commonly-used log file analysis tools, consequently, elrond does have the capability to stand up a local Splunk (with acompanying app) or elastic instance, whereby the artefacts are automatically assigned and aligned with the MITRE ATT&CK® Framework. In addition, elrond can also populate a local ATT&CK Navigator instance providing a visual representation of potential attack techniques leveraged as part of said incident.
Additional features include image and file hashing, metadata extraction, file recovery and carving, AV scanning, IOC extraction, keyword searching and timelining.

It is important to note that elrond utilises many existing tools which have been built by other developers. elrond does do custom structuring of the outputted data but the conversion of the data is done by the other aforementioned toolsets.

Wild West Hackin' Fest 2023

I presented elrond, at Wild West Hackin' Fest 2023 as part of the Toolshed Talks.

elrond on Vimeo

Related Projects

elrond is responsible for the analysis-side of digital forensics, but what about acquisition? An acompanying script called gandalf can be deployed (locally or remotely) on either Windows (using PowerShell), Linux, or macOS (using Python or [bash]()) hosts to acquire forensic artefacts.


Configuration

Initial Configuration

SIFT-elrond (recommended)

Download the respective elrond OVA; the latest version of SIFT (20.04) or Ubuntu (22.04) with all of the elrond software packages, pre-installed.

  • For x64, download SIFT-elrond OVA (20.04)
  • sansforensics:forensics
  • For ARM, download elrond archive (22.04)
  • elrond:elrond Neither OVA contains the NSRL dataset; execute nsrl.sh and follow instructions to download.

It is recommended to run /opt/elrond/update.sh which will download and configure the latest version of elrond onto your existing system.

Self-build

Download Virtual Machine

There are several software package required for using elrond. Almost all of them are contained within the SANS SIFT Worksation virtual machine OVA. For the software which is not included (make.sh) installs and configures the additional software required for all potential functionality leveraged by elrond (volatility3, apfs-fuse, ClamAV etc.).



Configure

Follow instructions in CONFIG.md

You will only need to run the make.sh script once, per 'elrond VM' instance; if you encounter errors with CONFIG.md, individual scripts for each of the software packages are contained in .../elrond/elrond/tools/config/scripts/

Usage

python3 elrond.py <case_id> <directory> [<output_directory>] [-h] [-AaBCcDEGIiMmNnPQqRSsTtUuVXZ] [-K <keyword_file>] [-Y <yara_dir>] -F (include|exclude):[<include/exclude_file>]

Collect (-C)

Examples

python3 elrond.py case_name /path/to/disk/images -BCPS -F include:./include_file.txt

python3 elrond.py case_name /path/to/disk_and_memory/images -aqQvVMCPAS

python3 elrond.py case_name /path/to/disk/images -avVqQCPI

Gandalf (-G)

Examples

python3 elrond.py case_name /path/to/disk/images -aqvVGPAS

python3 elrond.py case_name /path/to/disk/images -BGPS -K keywords.txt

Reorganise (-R)

Examples

python3 elrond.py case_name /path/to/disk/images -aqvVRPAS

python3 elrond.py case_name /path/to/disk/images -BRPS -Y <directory/of/yara/files>

Support

See SUPPORT.md for a list of commands and additional third-party tools to help with preparing images or data for elrond.

Artefacts

Below is a list of all the artefacts collected and processed from the respective operating systems.

Windows

Linux

macOS

Notices

If you notice 'nixCommand' or 'nixProcess' in files processed from a Windows OS, this is somewhat intentional. I debated with myself whether to try and change these to 'WinCommand' and 'WinProcess', respectively but also considered the situation of Windows Subsystem for Linux (WSL) being installed. As a result, I have left them as they are. If you know of a way to identify whether a file belongs inside the Linux element of WSL based on file path, file type, file content etc. please raise an issue and let me know.


Acknowledgements