Difference between pages "Windows SuperFetch Format" and "Plaso"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(External Links)
 
(File Formats)
 
Line 1: Line 1:
{{expand}}
+
{{Infobox_Software |
 +
  name = plaso |
 +
  maintainer = [[Kristinn Gudjonsson]], [[Joachim Metz]] |
 +
  os = [[Linux]], [[Mac OS X]], [[Windows]] |
 +
  genre = {{Analysis}} |
 +
  license = {{APL}} |
 +
  website = [https://code.google.com/p/plaso/ code.google.com/p/plaso/] |
 +
}}
  
SuperFetch, is a memory management scheme that enhances the least-recently accessed approach with historical information and proactive memory management. [http://technet.microsoft.com/en-us/magazine/2007.03.vistakernel.aspx]
+
Plaso (plaso langar að safna öllu) is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system. Plaso is intended to be applied for creating super timelines but also supports creating [http://blog.kiddaland.net/2013/02/targeted-timelines-part-i.html targeted timelines].
  
<b>Note that the following format specification are incomplete.</b>
+
The Plaso project site also provides [[4n6time]], formerly "l2t_Review", which is a cross-platform forensic tool for timeline creation and review by [[David Nides]].
  
== SuperFetch DB files ==
+
== Supported Formats ==
The <tt>Ag*.db</tt> files are of the SuperFetch file format. E.g.
+
<pre>
+
AgAppLaunch.db
+
AgCx_SC*.db
+
AgGlFaultHistory.db
+
AgGlFgAppHistory.db
+
AgGlGlobalHistory.db
+
AgGlUAD_%SID%.db
+
AgGlUAD_P_%SID%.db
+
AgRobust.db
+
</pre>
+
  
The SuperFetch DB files can be stored in uncompressed or compressed form, where different version of Windows use different compressed forms:
+
=== Storage Media Image File Formats ===
* Compressed SuperFetch DB - MEMO file format; Windows Vista
+
Storage Medis Image File Format support is provided by [[dfvfs]].
* Compressed SuperFetch DB - MEM0 file format; Windows  7
+
* Compressed SuperFetch DB - MAM file format; Windows 8
+
  
=== Compressed SuperFetch DB - MEMO file format ===
+
=== Volume System Formats ===
The MEM file consists of:
+
Volume System Format support is provided by [[dfvfs]].
* file header
+
* compressed blocks
+
  
This format uses the LZNT1 compression method
+
=== File System Formats ===
 +
File System Format support is provided by [[dfvfs]].
  
==== File header ====
+
=== File Formats ===
The file header is 84 bytes of size and consists of:
+
* [[Property list (plist)|Binary property list (plist) format]] using [[binplist]]
{| class="wikitable"
+
* [[Extensible Storage Engine (ESE) Database File (EDB) format]]using [[libesedb]]
|-
+
* [[Internet Explorer History File Format]] (also known as MSIE 4 - 9 Cache Files or index.dat) using [[libmsiecf]]
! Offset
+
* [[OLE Compound File]] using [[libolecf]]
! Size
+
* [[Windows Event Log (EVT)]] using [[libevt]]
! Value
+
* [[Windows NT Registry File (REGF)]] using [[libregf]]
! Description
+
* [[LNK|Windows Shortcut File (LNK) format]] using [[liblnk]]
|-
+
* [[Windows XML Event Log (EVTX)]] using [[libevtx]]
| 0
+
* Syslog
| 4
+
| "MEMO" (0x4d, 0x45, 0x4d, 0x4f)
+
| Signature
+
|-
+
| 4
+
| 4
+
|
+
| Uncompressed (total) data size
+
|-
+
|}
+
  
==== Compressed blocks ====
+
<b>TODO expand this list</b>
The compressed block size is the chunk data size, which is part of the LZNT1 compressed data, + 2 bytes for the size of the chunk header itself.
+
  
The uncompressed block size is 4096 (0x1000) or the remaining uncompressed data size for the last block.
+
== History ==
 
+
Plaso is a Python-based rewrite of the Perl-based [[log2timeline]] initially created by [[Kristinn Gudjonsson]]. Plaso builds upon the [[SleuthKit]], [[libyal]] and other projects.
=== Compressed SuperFetch DB - MEM0 file format ===
+
The MEM file consists of:
+
* file header
+
* compressed blocks
+
 
+
This format uses the LZXPRESS Huffman compression method
+
 
+
==== File header ====
+
The file header is 8 bytes of size and consists of:
+
{| class="wikitable"
+
|-
+
! Offset
+
! Size
+
! Value
+
! Description
+
|-
+
| 0
+
| 4
+
| "MEM0" (0x4d, 0x45, 0x4d, 0x30)
+
| Signature
+
|-
+
| 4
+
| 4
+
|
+
| Uncompressed (total) data size
+
|-
+
|}
+
 
+
==== Compressed blocks ====
+
The file header is followed by compressed blocks:
+
{| class="wikitable"
+
|-
+
! Offset
+
! Size
+
! Value
+
! Description
+
|-
+
| 0
+
| 4
+
|
+
| Compressed data size
+
|-
+
| 4
+
| ...
+
|
+
| Compressed data
+
|-
+
|}
+
 
+
The uncompressed block size is 65536 (0x10000) or the remaining uncompressed data size for the last block.
+
 
+
=== Compressed SuperFetch DB - MAM file format ===
+
The MAM file consists of:
+
* file header
+
* compressed blocks
+
 
+
This format uses the LZXPRESS Huffman compression method.
+
 
+
==== File header ====
+
The file header is 12 bytes of size and consists of:
+
{| class="wikitable"
+
|-
+
! Offset
+
! Size
+
! Value
+
! Description
+
|-
+
| 0
+
| 4
+
| "MAM\x84" (0x4d, 0x41, 0x4d, 0x84)
+
| Signature
+
|-
+
| 4
+
| 4
+
|
+
| Uncompressed (total) data size
+
|-
+
| 8
+
| 4
+
|
+
| Unknown (checksum?)
+
|-
+
|}
+
 
+
==== Compressed blocks ====
+
The uncompressed block size is 65536 (0x10000) or the remaining uncompressed data size for the last block.
+
 
+
Note the LZExpress Huffman variant used differs from the one used in the MEM0 format. This variant can refer to uncompressed data stored in the previous compressed block. The compressed blocks are essentially a single compressed stream.
+
 
+
=== Uncompressed SuperFetch DB format ===
+
<b>TODO</b>
+
 
+
==== File header ====
+
<b>TODO</b>
+
 
+
{| class="wikitable"
+
|-
+
! Offset
+
! Size
+
! Value
+
! Description
+
|-
+
| 0
+
| 4
+
| 0x0000000e
+
| Unknown (Database type or signature?)
+
|-
+
| 4
+
| 4
+
|
+
| Uncompressed (total) data size
+
|-
+
|}
+
== TRX files ==
+
The <tt>Ag*.db.trx</tt> files are of the TRX file format. E.g.
+
<pre>
+
AgCx_SC*.db.trx
+
</pre>
+
 
+
<b>Note that the following format specification is incomplete.</b>
+
 
+
=== File header ===
+
The file header is variable of size and consists of:
+
{| class="wikitable"
+
|-
+
! Offset
+
! Size
+
! Value
+
! Description
+
|-
+
| 0
+
| 4
+
| 1
+
| Unknown (Version?)
+
|-
+
| 4
+
| 4
+
|
+
| Unknown
+
|-
+
| 8
+
| 4
+
|
+
| File size
+
|-
+
| 12
+
| 4
+
|
+
| Maximum number of records (of the record offsets array)
+
|-
+
| 16
+
| 4
+
|
+
| Number of records
+
|-
+
| 20
+
| ...
+
|
+
| Record offsets array, where the record offset is a 32-bit integer. Unused record offset are set to 0.
+
|-
+
|}
+
 
+
=== Record ===
+
<b>TODO describe</b>
+
  
 
== See Also ==
 
== See Also ==
* [[SuperFetch]]
+
* [[dfvfs]]
 +
* [[log2timeline]]
  
 
== External Links ==
 
== External Links ==
* [http://technet.microsoft.com/en-us/magazine/2007.03.vistakernel.aspx Inside the Windows Vista Kernel: Part 2], by [[Mark Russinovich]], March 2007
+
* [https://code.google.com/p/plaso/ Project site]
* [http://blog.rewolf.pl/blog/?p=214 Windows SuperFetch file format – partial specification], by ReWolf, October 5, 2011
+
* [https://sites.google.com/a/kiddaland.net/plaso/home Project documentation]
* [https://googledrive.com/host/0B3fBvzttpiiSWFFkSTBOUHdjOVU/Windows%20SuperFetch%20(DB)%20format.pdf Windows SuperFetch database format], by the [[libagdb| libagdb project]], April 2014
+
* [http://blog.kiddaland.net/ Project blog]
 
+
* [https://sites.google.com/a/kiddaland.net/plaso/usage/4n6time 4n6time]
[[Category:File Formats]]
+

Revision as of 02:21, 3 June 2014

plaso
Maintainer: Kristinn Gudjonsson, Joachim Metz
OS: Linux, Mac OS X, Windows
Genre: Analysis
License: APL
Website: code.google.com/p/plaso/

Plaso (plaso langar að safna öllu) is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system. Plaso is intended to be applied for creating super timelines but also supports creating targeted timelines.

The Plaso project site also provides 4n6time, formerly "l2t_Review", which is a cross-platform forensic tool for timeline creation and review by David Nides.

Supported Formats

Storage Media Image File Formats

Storage Medis Image File Format support is provided by dfvfs.

Volume System Formats

Volume System Format support is provided by dfvfs.

File System Formats

File System Format support is provided by dfvfs.

File Formats

TODO expand this list

History

Plaso is a Python-based rewrite of the Perl-based log2timeline initially created by Kristinn Gudjonsson. Plaso builds upon the SleuthKit, libyal and other projects.

See Also

External Links