File Tags and Digital Forensics

                So I was bored one day and decided that with school and work, I just wasn’t busy enough and I needed a new project.  I wanted to do some research, preferably in the realm of digital forensics.  I started talking to my buddy Rob Marmo (@robmarmo) and the idea of looking how Windows utilizes the tag properties within certain files came up.  Eventually, after some thought and consideration we decided that it would make for an extremely fun project that would make for a great booster for our experience.  As it ends up it was a great learning experience in doing research and developing a way to utilize the information.

Background

                If you are not familiar, Windows introduced the ability to “tag” files in Windows Vista.  This feature allows the user to add a desired keyword to certain file types so they could easily be categorized and searched within the Search function they included within Vista as well.  Here is an example of how you can tag your files:

Your other option for tagging your file is via the file properties option for the file.  If the file format supports tagging you will see the option available within the “Details” tab, like so: 

These file tags are a great way to organize information in a user customized way.  To me, that is why file tags are quite interesting from a forensic point of view, as these tags are inputted manually via the user’s input.  So it’s quite possible to say that if a file is tagged with a certain keyword it may provide that file with an added value of interest to an investigation.

How It Works

                After a lot of looking and failed avenues, I was finally able to get a handle on how Windows implements the ability to File Tag.  First, you may have noticed that I said only certain file types can be tagged.  I don’t deliberately state the files that are tagged because it is a variable.  When you begin the tagging process, simply put, the tags are inserted into an XML that is then inserted into the file.  How this is handled varies on the file type.  This determination is handled by reading the registry.  If you look at HKEY_CLASSES_ROOT\SystemFileAssociations in the registry, you will find a list of various file types registered within the operating system.  Each file type has two keys of interest for our purposes the “FullDetails” and the “PreviewDetails”.  Within these keys are several values, and the one for file tags is “System.Keywords”.  This value says there is a way for Windows to store the tags within the file.  The actual injection of the XML is done via a property handler that is based on the file type, often done via a DLL. 

            There is another part the file tagging system, beyond simply adding the keywords to a file.  As you recall, I mention that this implementation was intended to allow for quick searching of files by these keywords via the Windows Search function.  This plays an interesting point with the file tagging system.  As you enter in these keywords this creates an interaction with the Windows Search Index.  I created a quick animation GIF to show how the Search Index works as I understand it:

As you can see, the search index works with a data store.  Those data stores work with the Search function and filters, as well as a notification system.  If certain parameters are met they are then gathered and sent to the System Index, which is actually a database locally stored on the system at: 

C:\ProgramData\Microsoft\Search\Data\Application\Windows\Windows.edb *

*It should be noted that this  location can be altered via the Index Options in the Advanced options.

This is a interesting database and seems to be proprietary to the Microsoft Operating System and is utilized by a few of their applications.  If you’re interested in taking a look at the database, I was able to by doing the following:

• Turn off Windows Search Service (This essentially unlocks the DB so you can use it)
• Navigate to the Index location
• Make a copy of the index EDB file
• You can turn back on Windows Search Service
• Download and install an EDB Viewer (I suggest EseDB Viewer from Woanware)
• Open your copied EDB file in the viewer

Viewing the Search Index provides an interesting look at all the information that your Windows systems can analyze in a short amount of time.  As best as I can tell the Search Index database is utilized by the tagging system for the preview generation.  While you’re inputting a tag, often time you will find that upon entry once you type in a letter you will be given option of tags.  These are tags that have previously been applied to files, and from what I can tell these are pulled from the Search Index database.  The “PreviewDetail” key discussed earlier is how the registry knows you can get these tags via preview and then the property handler works with the index. 

Interest in Recovery

                Again, each file type handles tag in a different way; it is dependent upon the property handler assigned to it.  How these handlers deal with the data and inject it into the files is different, and through my testing of various files types and how they dealt with the file tags I came across an interesting discovery.  Some of file types store tag data not only within the file XML but also in various parts throughout the file.  In testing I was able to see when tags were added or modified, and even if the file tags have been deleted (or not viewable by the OS as Windows will only read tags from the XML), they are still located within the file and viewable within the hex.  Now, this only occurs in certain file types with, dare I say, inefficient property handlers.  Looking at the new Office formats like .docx it handles XML with a higher proficiency it writes most all its properties to XML and then archives it and then is read via Word or whatever.  To me that makes for much more efficient way to deal with files.  However, when we look at something like a .jpeg, it writes the tags to the file in different locations based upon the interaction.  Forensically, this provides an investigator with an added way to look at a file.  My thought was if you have a file that has a MAC timestamp of all the same times exactly, but you see that within the file that it has indications that tags were added or modified it may indicate that the file timestamps may have been altered.

Future

                I am still in the research phase with this information, but this is everything I have gathered thus far.  I have developed a proof of concept application that is working and pulling files that have been tagged and readable by the OS.  It’s still in development, and I plan and getting it out to the community eventually once I have it optimized and have added all the features I wish to include.  Also, you may be wondering how I came to acquire this information, so I am planning on posting a research and implementation article as well that will describe the research I did in a fair amount of detail with pertinent examples and such.  It may also include how I learned to program the tool I am developing as well.  I think explaining the thought process behind research and development may be beneficial to the community and hopefully inspire others to do the same by providing some background and basic thought process.

Hope you enjoyed this, and if you have any thoughts on the implications of file tags and how they can be utilized in an investigation I would love to hear them.  Leave a comment or e-mail me at:  michael.ahrendt@gmail.com

Review of Digital Evidence and Computer Crime

            Just finished “Digital Evidence and Computer Crime:  Forensic Science, Computers and the Internet” by Eoghan Casey and featuring other contributing authors, and it’s quite good.  I bought this book because I wanted an all-encompassing book that provided insight on the various aspects of an investigation, especially the legal portion.  And in this aspect the book does an excellent job, and is in-depth in area’s I have yet to see in other books.  The book is divided into five portions digital forensics, digital investigations, apprehending offenders, computers and network forensics.  For me the book was worth it for the first three portions; however, the computers and network portions, while a good start, there are more in-depth books that provide better insight. 

            Part I: Digital Forensics, was one of my favorite parts of the book.  It provides the reader with a good background on where digital forensics comes from and how it has evolved.  It details the role of the investigator in a case and the complications with digital evidence (the portion applying to levels of certainty was very enlightening).  I really enjoyed the portions of the book relating to both US and European law.  This was an aspect I was looking to learn more about and the book provides a great overview while outlining the specific important parts of popular cyber law. 

            Part II:  Digital Investigions, is all about the process.  Casey does a good job of applying the tradition scientific method to the digital forefront.  Applying it in this way it provides an easy to apply method to the investigative process.  Not focusing on the specifics but more the outline of the thought process, which allows you to go beyond knowing the specifics.  Methods for conducting investigations, handling crime scenes and reconstruction are discussed, as well as, going into motives.

            Part III:  Apprehending Offenders, was rather unexpected when I looked through the table of contents and even more so when I read the chapters.  However, in this case unexpected was excellent.  Various scenarios of need of investigation are discussed like cyber stalking and computer intrusions, and then delve into the victimology of the scenarios.  This was really interesting to me, as it provides a psychological aspect to the investigative process; something I then realized can really help with an investigation.

            Part IV and V:  Computers and Networking are pretty much what I expected.  The computer portion really does give a great foundation of knowledge, and if this is one of your beginning journeys it’s a great place to start.  It does go over the background of important artifact information like file system structure, basics of file recovery, browser artifacts, and the registry.  It also provides good info on Unix and Mac systems.  The network portion is quite detailed describing the various layers of the network topology. There is a lot of great information in these chapters that was a great review of knowledge. 

            Overall, the book was enjoyable from start to finish and I would recommend it to anyone looking for a great overview of digital forensic investigation process from start to finish.   I am happy to add this book to my growing reference library.  

Coming Up:

So, I have a lot going on.  I have the following books to read (expect reviews):

• Windows Forensic Analysis 3rd Edition
• Practical Malware Analysis
• Digital Triage Forensics
• Windows Internals 6th Edition

I also have some research that I wish to share regarding File Tagging, with maybe a tool to follow eventually.  So look for that as well.  

Automated Triage Utility

A New Utility

      Well, it has been awhile since my last post.  I have been busy finishing up Capstone course work at Davenport University.  For my Capstone project I selected to focus on digital forensics and created a workstation for evidence examination with a Windows 7 host.  On top of that, I elected to create a script that would perform basic triage functions with known commands and utilities.  I developed the script with the AutoIt language based on a recommendation from a friend.  The course allowed me to develop a proof-of-concept application that did quite a bit, but it did it very poorly.  So a few long nights later, I re-did it all and made it work a bit better and do a few more interesting things, discussed later.  After reading Corey Harrell's recent blog post about his new script, I decided I would share my tool as well since it's a small way I can contribute to the community I love.

I've posted the project on Google Code here:  http://code.google.com/p/triage-ir/

The Requirements

     As I mentioned previously, the script I created utilizes other applications to function.  First off, it utilizes your standard 'cmd.exe' from the Windows system (found at C:\Windows\System32).  Eventually, I hope to make it so it doesn't need a copy of the command prompt in the folder but the syntax in the script does not seem to be working properly at this point.So the application folder will look something like this:

You will notice that there is also a tools folder.  This, obviously, will be where I have the tools required for the script stored.  Unfortunately for licensing reasons, I do not include the tools needed.  The tools are free, so you can download them as follows:

• Sysinternals Suite - Mark Russinovich 
• DumpIt - MoonSols
• MD5DEEP & SHA1DEEP - Jesse Kornblum

This is the structure of the Tool folder as it should be seen, or at least similar:

The Function

     The script is designed to perform basic triage commands, as well as acquire evidence automatically on the system.  I designed the script to be ran from a flash drive, but you can really run it from anywhere.  All reports and evidence will be collected in the script directory under a Incident folder with a time stamp ("mm-dd-yy Incident").  The tool should perform the following functions:

• Gather Information on
• System Information
• Running Processes
• Services Information
• NTFS Information
• Mounted Disks
• Directory Structure
• Scheduled Tasks
• AutoRun 
• Account Settings
• Logged in Users
• IP Configuration
• Routes
• Active Connections
• ARP
• DNS
• NETBIOS
• Network Shares
• Shared Files
• Connected Sessions
• Workgroup PCs
• Capture Evidence
• Prefetch
• Recent Folder
• Jump Lists (Windows 7)
• SYSTEM hive
• SECURITY hive
• SAM hive
• SOFTWARE hive
• Current User NTUSER.DAT
• All user's NTUSER.DAT
• Random Access Memory
• Preserve Data
• MD5 Hashing
• SHA1 Hashing

All of this contained in a simplified graphical user interface.  Many of the commands are modular so you can choose what commands and what items you wish to run or capture, with a simple check box.  When you run the script you should get to see something like this:

The Results

     Once you've selected your choice of modules you simply hit run and then you will see a new folder created in the script folder named "mm-dd-yy Incident".  This folder if you run everything you will see something like this:

You'll get a lot of information regarding the PC you run the tool on.  All of it sectional going to its own report.  This was the easiest way for me to setup reporting.  My hope is to someday create a centralized html file for easy access to all of the information in an easily navigated web page.  The evidence folder is where you'll find all of your stored data.  It will look a little like this:

You should find copies (used robocopy to retain metadata settings, I hope) of the Recent Folder, Prefetch Folder, and Jump List folders if you are in Windows 7.  You will also notice it can rip all of your registry hives for quick analysis with your favorite tool.  Considering adding a Reg Ripper module so you can get quicker reports from extracted registry data.  

Future

     Full disclosure, this script is a work in progress at the moment.  I can't promise it will work for everyone.  I'm hoping some of you will be kind enough to test it out and send me your feedback and errors so I can hopefully ensure reliability of it.  Also, if you have ideas that you would like to see implemented within the script just let me know and I will try to implement them properly.  As of right now, I am simply continuing to work on getting the script to run without the copied command prompt and adjusting the tool to a better order of volatility when executing the commands.  Also I need to add some sort of progress monitoring and clean up execution windows a bit.  Any and all suggestions are welcomed!  You may contact me at:  michael.ahrendt@gmail.com

Again, you may download the script here.  You can choose to just use the executable or, if you have AutoIt, you can run from the source code of the same name.

Hope you enjoy.

Review of Metasploit: A Penetration Tester's Guide

     Metaspoit:  A Penetration Tester's Guide (MAPTG) from David Kennedy (@Dave_Rel1k), Jim O'Gorman (@_Elwood_), Devon Kearns (@dookie2000ca), and Mati Aharoni (@backtracklinux) is probably the foremost resource one can obtain for learning the basics of the Metasploit framework.  The book is for those behind the curve a little bit and haven't used Metasploit yet.  I feel like the book does a great job of delivering on what it promises, a foundation knowledge of the ins and outs of the great framework.  By the time you finish the book you should understand how to use the framework; you most likely will not understand all of it, but it gives you great information on how you can figure it out really through utilizing the many utilities within the tool.

     Let me start this review off by stating my personal opinion on how you should utilize this book:  build a test penetration lab and follow the books instructions as you go along.  Take advantage of the appendices!  Appendix A will tell you how to setup your test environments, both your attack machines and your victim machines.  Appendix B is your cheat sheet and quick reference for the numerous commands you'll be using.  I suggest starting here and just familiarize yourself here before you begin.  This is not what I did, but in retrospect I really wish I had.  

     The book doesn't waste time, after going into the basics of what will occur in a standard penetration test.  The authors state that this book is not the best source for understanding all that can occur in a Pen Test and refer to the Penetration Test Execution Standard as a better source of gaining better insight on the subject if you're looking for it.  Next the book cover's the basics of metasploit so you can get around the console with better familiarity, or options you have if you want more information.  These chapters are small and cover the essentials of what you'll need to know to get through the book if you have no prior knowledge about the tool.  The following chapters, which I will not cover in depth, go step-by-step through a basic Pen Test outline.  They start and information gathering and go all the way into creating your own exploits to automating your process with scripts within the framework.  

     Every chapter covers it's subject very well.  They're very concise and to the point, which I enjoy a whole lot.  Also, most of the chapters include examples of how to run the tools, and what output should look like (which is why I suggest you set up a lab environment and run the commands as your read them).  At times, I wish the chapters were a bit more in-depth, especially the creation of exploits chapter; however, that is probably a bit outside the scope of this particular book.  I especially enjoyed the chapters on creating exploits and the power of the Social-Engineering Toolkit.  The final chapter uniquely summarized what was learned in the book by explaining how to simulate a penetration test, and if completed properly will have you exploiting your vulnerable test lab in no time.  

     I highly would recommend this book to anyone who is looking to get into Metasploit a lot more.  It gives you a great base to learn the tool, and if nothing else spawn even more of a desire to learn more (I know it did for me).  I started this book with very base knowledge of the Metasploit framework, and after some testing and the guidance of this book I feel a lot more comfortable with using the amazing power behind Metasploit.  You can pick this book up for about $28 dollars on Amazon, this is an amazing value!  I would suggest if you even have an interest in penetration testing that you pick up this book and read it.

Road to CCE, Pt. 3: Review of Digital Forensics with Open Source Tools

     "Digital Forensics with Open Source Tools" (DFwOST), by Cory Altheide and Harlan Carvey is an excellent resource for a beginning forensics student I feel.  I am so happy that I decided to pick up this book, it has proven to be one of the best resources I now have.  This book reads extremely well, as the information it contains is concise and to the point.  DFwOST is certainly a value and I can see myself returning to it in the coming months.  

     As far as the content of the books is concerned, the authors provide a wealth of knowledge covering the basics of digital forensics.  The beginning chapter goes over what open source is and how its going to relate to the book.  The next chapter then discusses the differences in choosing a host operating system (mainly Windows vs Linux).  Chapters 3 through 8 analyze varying topics of digital forensics like file system analysis, points of analysis for varying operating systems, Internet artifacts, and file analysis.  These chapters hold a lot of information relating to the multiple points of interest in digital forensics; and while discussing the topics the authors provide the reader with examples of analysis with popular open source projects.  The final chapter then offers the reader insight into how to utilize the various discussed tools with better efficiency; as well as, the pros and cons of graphical user interfaces versus command line interfaces.  

     Overall, I feel like this is one of the best resources for learning about digital forensics because it provides great information along with practical knowledge of how to use the information.  It's easy enough to follow along with the reading while testing these tools with your own test lab.  The authors often provide easy to follow installation methods, which can often be valuable with dealing with some open source projects.  If you're looking to get into forensics more or even just learn about current open source projects going on in the forensics world I would recommend you go out and pick up this book.  I feel like this book helped me take the knowledge I've learned from other books I've discussed in this blog and transform it into practical knowledge as it's easy to get access to these tools and test them for myself without spending money (a plus for any college student).  

Password Auditing (or, How I Learned to Crack Passwords)

Password auditing can be a fun little project for an IT security department.  Currently, Microsoft systems store their passwords in the registry via an NTLM hash.  As I will show, NTLM is fairly easily reversed when good password policy is not followed. 

The methodology I will cover is going to utilize rainbow tables for cracking passwords.  Rainbow tables are stored tables of pre-computed hashes that are compared against to the hashes you have in order to find the password in a much faster time.  This method is great when you have a set of good tables.  When you don’t have this ability, there still are brute force attacks which can be fairly lengthy if you don’t have access to a nice cloud or local cluster. 

I utilized 3 different programs to complete my password auditing testing:  ophcrack, rcracki_mt, and rcrack. 

OPHCRACK

     Ophcrack is great little utility.  You can download a LiveCD to boot from disk (will automatically load your NTLM hashes) or you can load an application to a test machine (what I did).  The methodology of use is pretty much the same.  First off, there are many tables for Ophcrack available from their website. 

This graph shows the various tables available.  Note that there is only one free table.  However, their tables are fairly priced if you have the money.  The Vista free tables are very well put together and will due for basic auditing and searching for really easy passwords.  I was able to get Vista Special tables for about 100$, I believe.  Not a bad deal considering it’ll get a good majority of passwords I found in my testing (unfortunately). 

The interface is fairly straight forward.  “Load” option will allow you to load the various formats of hashes (LM or NTLM).  In order to get the hashes from my machine I used Password Dump v7.1.  Simply run:  pwdump7 –d <output location>  and the application will do the work and create a text similar to this: 

Clark:1000:NO PASSWORD*********************:259745CB123A52AA2E693AAACCA2DB52:::

Barry:1000:NO PASSWORD*********************:2D20D252A479F485CDF5E171D93985BF:::

Bruce:1000:NO PASSWORD*********************:21E6C83723EB7BC2CFED883DA412B804:::

Oliver:1000:NO PASSWORD*********************:8D793BF7E73DAA43A28D04BD4BA1FC05:::

Peter:1000:NO PASSWORD*********************:E803ABFAF249575CAF1529465E243B3E:::

Matt:1000:NO PASSWORD*********************:6B4B376436A5664FEACAC52301155951:::

Logan:1000:NO PASSWORD*********************:71BAD9C6FD984ADD32187A1DDF360F85:::

Scott:1000:NO PASSWORD*********************:67A252C097F568BEC274AF4CC1462DC0:::

Xavier:1000:NO PASSWORD*********************:A086E310475F2B8DFD9E2F7265BD16C8:::

Steve:1000:NO PASSWORD*********************:6EF391B2282F1DA56379EDB11BBB034F:::

Clint:1000:NO PASSWORD*********************:87F65D137998A4CE59EA65B114A0F831:::

Eric:1000:NO PASSWORD*********************:F773C5DB7DDEBEFA4B0DAE7EE8C50AEA:::

This was the text file I used to crack.  No I didn’t have all these accounts setup on a Windows machine; I wanted to test the application so I created this file by simply copying the context of the pwdumd7 file output and generated the hashes via Cain & Abel v.4.9.4 hash generator. 

            Once you have the hashes, you can click on the crack button and you will see something like this: 

From here you can simply save the results into a simple CSV file.  

Voila!  You will have your passwords cracked in roughly 12 minutes (at least on my i5 dual core 8GB DDR3 laptop in this scenario).  

rcracki_mt

     rcracki is a decent application that is available from http://www.freerainbowtables.com/en/download/.  You'll notice also at that website there are a plethora of various rainbow tables from MD5 hashing to LM and NTLM hashed passwords.  I personally, chose to go with the rainbow table for NTLM that had the hashes for 7 character passwords including all possible variations (roughly 140 GB worth of tables).  

     rcracki_mt is a command line interface tool, with fairly simple usage.  Here is my usage example:

This command breaks down as such:

  

     rcracki_mt -h <hash> (-l <password list>) -t <number of threads to utilize> <directory to your tables>

rcracki_mt was able to find a completely special character password in about 5 minutes of cracking with the 2 threads.  Not bad, however, rcracki_mt tables are separated into a ton of tables that have to load and to me didn't seem super efficient.  However, it's my personal opinion and for free this is a GREAT option.  

rcrack

      rcrack is a similar version to rcracki_mt, however it uses simple .rt tables and not the indexed versions utilized by rcracki_mt.  rcrack is both a GUI and CLI tool.  I chose for the GUI version because I was using this in a demonstration and pictures are easier for meetings.  With rcrack you also get a tools to generate your own rainbow tables.  I opted to create my own rainbow table to be able to crack any numerical password up to 10 digits.  To generate this table it took roughly 2 days time to complete the 4 tables I made totaling around 200MB.    I then created a simple text file with various numerical passwords into a text file, again I got the hashes using Cain and Abel's hash generator.

     This is what RainbowCrack GUI will look like once you select File |  Load Passwords from List...  Then once you have your hashes loaded, you select "Rainbow Tables" and point it either to a singe file or a directory.  Now to begin cracking:

With this instance in order to find all 5 passwords it took merely 2 minutes.  

It is also possible to convert the tables available at freerainbowtables.com into a format usable by RainbowCrack (rcrack).  However, I have not felt the need to test this as I find rcracki_mt decent enough to use at this moment.  

All of these methodologies are what I have used to begin auditing passwords in order to assess the need for a stronger password policy.  Hopefully you can use it to implement auditing if you need to.

+++Hopefully not needed to say, but use this information ethically!  I did this for research and work, not to harm anyone.

Road to CCE, Pt. II: Review of Windows Forensic Analysis 2E

“The key to forensic analysis isn’t pushing the button on an application user interface.  After all, as I’ve said time and time again, the age of Nintendo forensics is over!  The key to forensic analysis is understanding what artifacts are available to you and having a logical, reasoned, and comprehensive plan or process for collecting and interpreting data.”  These are the words of Harlan Carvey, the author of Windows Forensic Analysis (as well as other great titles).  Reading that quote within the final part of Carvey’s book really summed up what it was all about, for me.  Truly understanding what information that is available to us through thorough examination and not relying upon a tool, was really the underlying message I got from this book.  That message is spot on to me, and is the reason I picked up this book.  I did not want to become another ‘button monkey’ who had to rely on a program to perform an investigation.  Tools are great when you have the background knowledge necessary to understand what the application is doing in the background, and the value of the information it provides.  That being said this book is FANTASTIC; obviously with recommendations from Eric Huber, Rob Lee, and Richard Bejtlich this really didn’t need to be said.  

The first part (chapters 1, 2, and 3) of this book will cover the importance of live response to an incident.  It’ll give you examples of important places to look for and gather crucial data.  It will then give examples on how to analyze the data collected.  Chapter 3 delves into the truly fascinating world of memory forensics and how this portion of analysis should not be overlooked (memory holds a ton of information).  The next portion of the book goes into the various files that can be used in an investigation.  The fourth chapter of the book dives into the deep pool of information that the registry of a Windows system.  The fifth chapter covers the other various files that can be obtained, such as, event logs, browser history, and other numerous log files available on systems.  These chapters are very technical and provide a vast wealth of knowledge.  The next portion of the text goes over executable files and rootkits; which covers the interesting ways in which a program operates and then can be altered.  And the final portions of this book ‘ties it all together’ with great examples and providing ways to perform an investigation on the cheap (particularly interesting to me as a student).

This book is an excellent source of information if you’re interested in learning more about what a Windows computer has to offer to your investigation.  I will definitely be keeping this book around for all the great information it provides.  Carvey, not only provides a treasure of information but he provides data within the text so you can get a good look at what sort of information you’re going to want.  To go along with all the miscellaneous data sources, you’re provided with suggestions/recommendations on tools that can help you obtain and analyze that data.  On top of this there are also tips, notes, and warnings that can apply to the topic at hand that help put the provided material into better context.

To sum up, this book is a must for anyone interested in the topic, it reads like a dream for such a technically heavy text. 

____________________________________________________

With yet another book completed on my list of texts I wanted to finish, before moving to more of an intensive hands-on approach to learning forensics.  I will be finishing one last book (of which Harlan Carvey is a contributing author to along with Cory Altheide) before applying everything.  I will be reading Digital Forensics with Open Source Tools next for obvious reasons; with more hands on stuff next in what I want to do why not use open source tools?  I am a bit nervous as to the few “not for beginners” mentioned on the Amazon reviews, but I always like a challenge.  However, hopefully it will be as good as a companion to The Sleuth Kit as some reviews say, as well.  Look for a review in a few weeks!