NTFS Object IDs related to user activity (W11 and Windows Server 2022)
Description
The NTFS system file $ObjID contains records (entries) of identifiers that Windows use for tracking. In these records the MFT record number is included, making it possible to connect each index entry with the corresponding file record. This system file is created on any NTFS volume, also external devices. The ObjectIDs contains a timestamp for last boot for the boot session the Object ID entry was created. It also contains a node address that is either a valid MAC address from the computer used when the Object ID was created, or a random value. In this dataset we have exported the $MFT and the $ObjID Index Allocation Attribute named $O. We wanted to see how indexes were created on Installation and based on user activity. We also wanted to see if there were differences between internal and external hard drives ( usb-stick or usb-disk). In some of the folders within this dataset there is a file named log.txt which defines the use case for that scenario. Others have a folder name that describe the use case. Notable findings: USB sticks do not include the Object ID for the file $Volume, which also means all indexes will be missing the Birth Volume Object ID. External USB hard drives will be assigned an Object ID for the $Volume file if attached once during a reboot of the computer. Internal hard drives will also be assigned an Object ID for the $Volume system file. Whenever a NTFS volume is assigned an Object ID for the $Volume system files, the indexes will also be assigned Birth Volume Object IDs. If Object IDs were created before the device was assigned the Object ID, the result is index entries with only an Object ID, where both Birth Volume Object ID, Birth Object ID is set to zero. However new Object ID entries after the Object ID was assigned to the $Volume will be assigned Object ID, Birth Volume Object ID, and Birth Object ID. The Domain Object ID seems to not be in use. User activity using File Explorer, Libre Office, MS Office, and more will create Object ID entries on files that are not assigned any previous Object ID. We suggest using the Object IDs to focus on the files that have indications of user activity during any investigations. By using the Object IDs we can in most cases connect external devices to the computers used to create the Object IDs, and we can identify when these computers were booted. Please refer to the paper Using the object ID index as an investigative approach for NTFS file systems (Nordvik et al., 2019) at https://doi.org/10.1016/j.diin.2019.01.013 for more information about the Object ID index. Use the prototype tool NTFSObjIDParser from https://github.com/RuneN007/NTFSObjectIDParser to parse this dataset by opening $MFT and $O files from each subfolder.
Files
Steps to reproduce
Windows Server 2022 We installed the desktop version of the Windows Server 2022 evaluation version using Virtual box v 7.1.12. After the install we saw that the system clock was wrong, and we needed to adjust the clock. However, the initial boot time was preserved in this session. Therefore it may seem strange that the boot time for the session is after the creation of many of the files. However, observing last MFT record modification of files before the boot time stored in the connected Object ID index in the same boot session is a clear indication of changing the system clock. The Windows Server 2022 had this MAC address: Ethernet adapter: 08-00-27-0F-A4-BA (in use) The $ObjID$O index used the address of the Ethernet adapter. Observation: Indirect user actions ---------------------- Internet Explorer and the folders Videos, Documents, Music, Desktop, and Downloads was assigned Object IDs without any direct related user activity. This could be related to some use of Internet Explorer during installation. The squirt.exe was not started by the user. This tools has to do with Bluetooth transfers, and is activated by default by Windows. The $Volume file was assigned an Object ID. This is later used by all other Object ID index entries in their Birth Volume Object ID. Direct user actions -------------------- We started Microsoft Edge, and the File Explorer using shortcut icons in the Desktop. We downloaded FTK Imager and started it when finishing the installation Wizard Then we rebooted, and started Microsoft Edge From this Windows installation a total of 13 Object ID index entries were created. Of these approximately 6 was based on our user activity. This means you should not expect many Object IDs in a newly installed Windows Server version. Windows 11 - Before Reboot An external USB disk was connected to an existing Windows 11 computer The external disk connected and reformatted to NTFS A folder named Documents were created. Opened the folder and created these documents: - Important.txt - Passwords.txt - Narc.txt - Contacts.txt - Problems.txt Finally created the folder Private The $MFT and the $ObjId$O was exported using FTK Imager The W11 computer had these MAC addresses: Bluetooth adapter: 18-CC-18-D6-E0-C4 (Media disconnected) Wifi: 18-CC-18-D6-E0-C0 (in use) We observed that the $ObjID$O index used the address of the Bluetooth, No reboot performed. Windows 11 - AfterRebootDeviceAttached Then we rebooted the Windows computer while the external USB disk was connected. When Windows started we did the following: - Copied the file container.jpg to the folder Documents\Private using File Explorer and CTRL plus drag and drop from the C volume to the the external disk. Moved the file Driftsgarasje.jpg to the folder Documents\Private using File Explorer and SHIFT plus drag and drop from the C volume to the external disk. See the corresponding log.txt files in each sub directory for more information.
Institutions
- Politihogskolen