Disk Filtration
Disk Image Analysis | Part 4
So someone decided corporate secrets are a free-for-all and our dear Liam thought he could play sneak-and-leak. This writeup walks through the hunt: the breadcrumbs on the endpoint, the USB that betrayed him, the dusty hotspot he used to dodge network logs, and the little executable the external actor insisted he run. Read it like a detective novel, but with more registry keys and less melodrama. Screenshots are left exactly where you asked — because evidence should always stare you in the face.
Attack Chain
An overview of the attack chain is provided in the table below:
The Exfiltration Hunt
Prerequisites
- Autopsy
- Expediting Registry Analysis
- File Carving
- NTFS Analysis
- Windows Forensics 1
- Windows Forensics 2
Scenario
Tech THM discovered their critical data had been leaked to the competitors. After an internal investigation, the company suspects Liam, a recently terminated employee who was working as a system engineer with Tech THM. This suspicion was raised as Liam had access to the leaked data in his company-provided workstation. He often worked late hours without clear justification for his extended presence. He was also caught roaming around the critical server room and taking pictures of the entry gate. Following these suspicions, Liam’s workstation (provided by the company) was investigated. The initial investigation suggests that an external entity was also helping Liam.
Investigative Questions
What is the serial number of the USB device Liam used for exfiltration?
We can get it through different ways:
either through Autopsy:
or through
After that let us “ Extract Files” to the Desktop to work on them with Registry Explorer:
What is the profile name of the personal hotspot Liam used to evade network-level detection
Get Iram Jack’s stories in your inbox
Join Medium for free to get updates from this writer.
Now let us check “Recent Documents” we might find a clue over there.
Now let’s check the mentioned path
What is the name of the zip file Liam copied from the USB to the machine for exfiltration instructions?
What is the password for this zip file?
Time to reveal the external entity helping Liam! Who is the author of the PDF file stored in the zip file?
Using Exiftool located in Forensic Tools Folder
What is the correct extension of the file that has no extension in the zip folder?
It looks like Liam searched for some files inside the file explorer. What are the names of these files? (alphabetical order)
What are the names of the folders that were present on the USB device? (alphabetical order)
The external entity didn’t fully trust Liam for the exfiltration so they asked him to execute file_uploader.exe, through the instructions in PDF. When was this file last executed and how many times was it executed? (YYYY-MM-DD HH:MM:SS, number of execution times)
Extracting Prefetch
Then; back to our Forensic Tools Folder and use PECmd
PECmd.exe -d ..\..\Extracted\Prefetch --csv ..\..\Extracted\Prefetch
Then; TimeLineExplorer
Liam received a hidden flag inside a file (in the zip folder) from the external entity helping him. What was that?
Extracting the zip file and use the password we gained before
It seems like Liam caused one last damage before leaving. When did Liam delete “Tax Records.docx”? (YYYY-MM-DD HH:MM:SS)
We’re going to use MFTECmd tool
MFTECmd.exe -f ..\..\Extracted\$UsnJrnl_$J --csv ..\..\Extracted --csvf J.csv
Which social media site did Liam search for using his web browser? Likely to avoid suspicion, thinking somebody was watching him. (Full URL)
What is the PowerShell command Liam executed as per the plan?
Closing notes
because every good heist needs a wrap-up
The trail on the endpoint is rarely neat — it’s threaded through registry artefacts, MUICache and shellbags, jump lists, shadow copies, and sloppy human behavior. Keep your artifacts tidy, extract everything, and let the timestamps and hashes do the talking. When you’ve carved out the files, parsed the registry, and pulled the event logs, the narrative becomes unavoidable: people slip, devices remember, and USBs don’t lie.
