{"id":10176,"date":"2025-10-17T22:12:33","date_gmt":"2025-10-17T22:12:33","guid":{"rendered":"https:\/\/www.hexacorn.com\/blog\/?p=10176"},"modified":"2025-10-17T23:19:06","modified_gmt":"2025-10-17T23:19:06","slug":"forensics-of-the-past","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2025\/10\/17\/forensics-of-the-past\/","title":{"rendered":"Forensics of the past"},"content":{"rendered":"\n

Few days ago my buddy and I had a chat about so-called old-school forensics. The one where you often used Encase, and – if you were inclined enough – EnScript scripting.<\/p>\n\n\n\n

This convo led me to my old Enscript code that I wrote over 15 years ago.<\/p>\n\n\n\n

At that time I worked for a consulting firm that was specializing in analysis of carding-related breaches, and we often saw the very same Threat Actors attacking victims in a hospitality and catering sector all over the place. Thanks to my reverse engineering skills, I ended up doing a lot of malware analysis tasks for the whole team back then + since I was very interested in automation, I ended up developing a very basic and rudimentary triage<\/code> Enscript script that one could just run immediately after they mounted an image in Encase.<\/p>\n\n\n\n

Reviewing that code this week… the code I wrote so many years ago… made my jaw drop.<\/p>\n\n\n\n

The stuff my script was looking at, and doing, back then… can be seen as a very early threat hunting exercise focused on a data from a single endpoint. An exercise where the artifacts were extracted in an automated fashion, bookmarked for review, and organized into a hierarchy that was supporting that quick&dirty review process:<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

The other routine was trying to bookmark a lot of important Registry entries associated with vital forensic information, so one could just walk through them and identify\/extract information that could make it into a report + highlight a lot of other Registry entries that could help finding that anecdotal smoking gun<\/em> (f.ex. many recent<\/em> folders):<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

The code also includes a list of known malware\/hacking file names, multiple persistence mechanisms, and a few other tricks…<\/p>\n\n\n\n

I don’t think it ever became a ‘One click to solve the case’ type of solution, but it definitely helped me to structure and systematize my approach to case analysis…<\/p>\n\n\n\n

And I guess… ‘what’s old, is new again’. Every once in a while.<\/p>\n","protected":false},"excerpt":{"rendered":"

Few days ago my buddy and I had a chat about so-called old-school forensics. The one where you often used Encase, and – if you were inclined enough – EnScript scripting. This convo led me to my old Enscript code … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[53,19],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/10176"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=10176"}],"version-history":[{"count":6,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/10176\/revisions"}],"predecessor-version":[{"id":10186,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/10176\/revisions\/10186"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=10176"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=10176"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=10176"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}