In this example slot #12 holds 12 bytes of data. According to the type identifier this data needs to be interpreted as a security identifier (SID). The following slot, no. 13, is to be interpreted as NullType. Also, it does not contain any data.

This exactly is what I've seen in countless records. Then Roberto De Vivo provided me with an event log that made my parser crash. Several substitution arrays in his file look similar to slot #4 in the following image.

The length clearly is different from zero and the slot contains data. I found more non-empty NullType objects in the same file, some of them contain up to 16 bytes of data.

At first first I supposed that my understanding of the data type was wrong. So I let the Microsoft Event Viewer transform the records in question, but I couldn't find the "unsuspected" data anywhere in its XML output.

Further research is needed to determine what causes this "unexpected" data and whether it is of any forensic value.

Among the topics of the tutorial are:

• know different partitioning schemes
• locate partitions
• core functionality of a file system
• learn how to subdivide a partition into functional units
• locate directories
• interpret directory entries
• reconstruct a file

I will demonstrate how you can improvise your own disk analysis tools using Python, SQlite and Gnuplot. And, of course, I will utilize 010 Editor to explore the various structures of the file system.

The tutorial will be held the last day of the FIRST Conference, which runs from Sunday June 13 to Friday June 18, 2010. More information is available from the official conference website. Registration is already open and early registration rates are available until March 31, 2010. See you in Miami!

Hex digits are now shown in upper case to resemble the format of Microsoft's Event Viewer applet. This version fixes an error in the formatting of GUIDs.

Unfortunately I was not able to acquire test data for variant type 0x12. Therefore I decided to remove the handler module, Type0x12.pm.

The newly added file evtxsort.xsl provides a XML transformation to sort and normalize event log records.

WiebeTech Drive eRazer DRZR-2-VBND and Drive eRazer PRO are both able to wipe visible sectors. However, under some conditions the devices fail to clean sectors that are in a Host Protected Area (HPA) or Device Configuration Overlay (DCO). Please see the test report for a detailed description of the results. (PDF)

Voom HardCopy II does not support the ATA SECURE WRITE command. Therefore it has to overwrite sectors using the common ATA WRITE command. The tool succeeded in cleaning the test media. (PDF)

The popular boot CD Darik's Boot and Nuke 1.0.7 does not support ATA SECURE WRITE, too. According to the report, the vendor documents that the tool is unable to wipe secors in a DCO or HPA. Therefore these functions were not tested. (PDF)

The editor now natively supports UNICODE strings (wstring and wchar). Ugly workarounds are no longer needed, but I haven't updated my (public) templates.

The preprocessor now supports many directives like #define, #ifdef, and #else that are known from the C programming language. Please note that arguments to #include are now required to be enclosed in either angle brackets or double quotes.

The update to version 3.1 is now available for download from Sweetscape.

<?xml version="1.0" encoding="UTF-8" ?>

<xsl:stylesheet version="1.0" 
  xmlns:xsl="http://www.w3.org/1999/XSL/Transform" 
  xmlns:evtx="http://schemas.microsoft.com/win/2004/08/events/event">
  
  <xsl:output method="xml" indent="yes" encoding="UTF-8"/>
  <xsl:strip-space elements="*" />
  
  <xsl:template match="Events">
    <xsl:copy>
      <xsl:apply-templates select="evtx:Event">
        <xsl:sort select="evtx:System/evtx:EventRecordID" 
          data-type="number" 
          order="ascending"/>
        </xsl:apply-templates>
      </xsl:copy>
  </xsl:template>
  
  <xsl:template match="*">
    <xsl:copy>
      <xsl:apply-templates/>
    </xsl:copy>
  </xsl:template>
</xsl:stylesheet>

You should be able to run it in any XSLT processor, like Sablotron, Xalan, or SAXON. I already had libxslt installed, so I used their xsltproc command line tool:
xsltproc evtxsort.xsl mylog.xml > mylog.sorted.xml
Now, event records are formatted nicely and appear in ascending order.

You can customize this script to your needs, e.g. sorting records in descending order, or sorting by EventID, or writing a summary report, or ...

NullType objects in the context of a SubstitutionArray may now contain data. Don't worry if that doesn't make any sense to you. I'm going to describe my observations in a separate article. Thanks to Roberto De Vivo for the bug report and for providing me with a fascinating sample file!

There are also some minor changes to the parser's architecture. In the Chunk object, the stack of element names was replaced by a stack of pointers to the corresponding start elements. Closing elements (Node0x03 and Node0x04) now propagate their type back into the start element (Node0x01). This allows for the start element to produce the whole string. This facilitates using the Evtx Parser as a library from other tools.

Download the new version here.

Added 02/25/2010: Please see also the announcement of version 1.0.3.

• I removed a to restrictive constraint from the Node0x0d.pm module. The parser now responds more flexible to unknown data types. I wish to thank Rob Hulley and Adrian Forschner for their bug reports, sample data and continued testing.
• The Evtx.pm modules now keeps track of the currently processed chunk. The get_current_chunk() method provides a pointer to the current chunk object.
• The Evtx.pm and Chunk.pm modules now parse more values from the file and chunk headers. Thanks again to Rob Hulley for his patch.
• A new sample program, evtxinfo.pl, displays these properties. In addition it lists the first and last event record number for each chunk. There are two sets of numbers: one refers to the examined file, while the other refers to the log channel.

$ ./evtxinfo.pl sample4.evtx 
Information from file header:
Format version  : 3.1
Flags           : 0x00000000
         File is: CLEAN
     Log is full: NO
Current chunk   : 2 of 16
Next Record#    : 5276

Information from chunks:
Chunk file (first/last)     log (first/last)     
----- --------------------- ---------------------
    1       4681       4976       4902       5197
    2       4977       5054       5198       5275
    3        593        888        814       1109
    4        889       1135       1110       1356
    5       1136       1431       1357       1652
    6       1432       1727       1653       1948
    7       1728       2023       1949       2244
    8       2024       2312       2245       2533
    9       2313       2608       2534       2829
   10       2609       2904       2830       3125
   11       2905       3200       3126       3421
   12       3201       3496       3422       3717
   13       3497       3792       3718       4013
   14       3793       4088       4014       4309
   15       4089       4384       4310       4605
   16       4385       4680       4606       4901

02/04/2010: Please see also the release notes on version 1.0.2.

The preliminary Call for Papers has been posted. Submissions are due June 25, 2010. Please see the conference website for further details.

In the technical section of this issue Juan Carlos Ruiloba Castilla (Policía Judicial de Barcelona, Spain) discusses fast-flux networks.

Let's celebrate the 10^th anniversary with a stream of top-notch papers. The call for papers is open, papers are due February 28, 2010.

For a preview of what to expect, please have a look at my slides for a three-hour class held at the FIRST 2009 Conference.

Attendees will get:

• a ready to run work environment, based on Volatility and a Linux virtual machine
• a couple of brand-new Voaltility plugins
• a selection of memory samples to work on
• printed courseware and slides in PDF

Prerequisites:

• bring your own laptop
• at least 1 GB of RAM
• at least 6 GB free hard disk space
• either VMware player or VMware workstation
• Microsoft Windows host OS recommended, Linux will do for most of the exercises
• Microsoft Debugging tools for Windows

Back issues are still available:

• July 2009
• August 2009
• September 2009