Tools, Methodology & Skills Learned
A companion write-up documenting the investigative workflow used during the Windows Server 2008 / DVWA compromise analysis. This page focuses on process, tooling, reasoning, and practical DFIR skills demonstrated.
1. Overview
This investigation was conducted as a step-by-step DFIR exercise using a disk image and a memory image from a compromised Windows Server 2008 host. The target system hosted XAMPP and DVWA, making it a useful case for combining traditional Windows forensics with web server incident response and memory analysis.
This companion page explains the methodology, tools, investigative reasoning, and practical skills developed while working through the case.
2. Investigation Methodology
The investigation followed a structured workflow similar to a professional incident response engagement. Each step attempted to answer a specific question rather than simply running tools at random.
Principles Applied
- Evidence first: conclusions were only made after artefacts supported them.
- Correlation over single-source claims: no single log was treated as the whole truth.
- Negative evidence matters: absence of Prefetch, tasks, and event IDs was documented.
- Timeline-driven thinking: findings were placed into chronological context.
- Memory matters: volatile artefacts revealed attacker activity absent from event logs.
3. Tools Used
Sleuth Kit / mmls
Used to identify the disk layout and NTFS partition start sector before read-only mounting.
mmls s4a-challenge4
RegRipper
Parsed Windows hives including SOFTWARE, SYSTEM, and SAM for OS details, timezone, installed software, users, and group membership.
rip.pl -r SAM -p samparse
hivex
Provided a low-level fallback for manual registry hive exploration and exporting registry subtrees.
hivexregedit --export SOFTWARE
python-evtx
Used to parse EVTX files and extract event IDs of interest from Security and Task Scheduler logs.
python3 parse_security.py Security.evtx
Volatility 2
Used for image identification, process listing, command-line extraction, console recovery, network review, and process memory dumping.
vol.py -f memdump.mem --profile=Win2008SP1x86 consoles
grep / strings / find
Used for keyword searching, timeline discovery, web shell hunting, memory strings analysis, and filesystem enumeration.
strings 2880.dmp | grep -Ei "hacker|net user"
4. Investigation Workflow
The disk image was mounted read-only using the NTFS partition offset discovered with
mmls.Registry analysis identified Windows Server 2008 SP1, installed XAMPP components, timezone, and user accounts.
SAM parsing identified suspicious users and group membership. ProfileList correlation showed no user profiles for those accounts.
Security.evtx and Task Scheduler logs were parsed. Expected account creation events were absent.
Volatility recovered command history and Apache worker memory strings, including account creation and RDP commands.
Apache logs revealed sqlmap exploitation, web shell upload, command execution, c99 usage, and reverse shell deployment.
Findings were linked across memory, Apache logs, PHP logs, registry, and filesystem timestamps.
5. Skills Demonstrated
Windows Forensics
- Registry hive analysis
- SAM account interpretation
- ProfileList correlation
- Timezone normalization
- Installed software review
Memory Forensics
- Profile selection with Volatility
- Process analysis
- Command-line extraction
- Console history recovery
- Process memory dumping and strings analysis
Web Incident Response
- Apache access log interpretation
- SQL injection reconstruction
- sqlmap artefact recognition
- Web shell identification
- PHP error log correlation
Analytical Reporting
- Distinguishing facts from hypotheses
- Building an attack timeline
- Mapping to MITRE ATT&CK
- Developing IOCs
- Writing defensible conclusions
6. Investigative Decision Making
Why start with registry?
Registry artefacts established the baseline: OS version, timezone, software, and user accounts. This made later event and memory timestamps meaningful.
Why event logs were not enough
The Security log did not contain expected account creation or group membership events. Instead of assuming the accounts were not created, the investigation pivoted to memory and web server artefacts.
Why memory changed the case
Volatility recovered console commands and Apache process memory strings that explained missing parts of the timeline. The memory image preserved evidence that disk logs did not.
Why Apache logs became the primary timeline
The Apache access log captured the attacker's interaction with DVWA in chronological order, including sqlmap activity, shell upload, command execution, c99 usage, and reverse shell staging.
7. Artefacts Examined and What They Proved
| Artefact | What It Answered | Why It Mattered |
|---|---|---|
| SOFTWARE hive | OS version, installed software | Established Windows Server 2008 SP1 and XAMPP baseline. |
| SYSTEM hive | Timezone | Allowed correct timestamp interpretation. |
| SAM hive | User accounts and groups | Identified suspicious accounts and RDP group membership. |
| Security.evtx | Logon activity | Showed limited audit coverage and absence of expected user creation events. |
| Volatility consoles | Typed commands | Recovered net user, net localgroup, and netsh activity. |
| Apache access.log | Web attack sequence | Provided the clearest chronological reconstruction of the compromise. |
| PHP error log | Shell testing | Confirmed the attacker accessed the shell incorrectly before using it properly. |
| Apache process memory | Recovered hidden strings and POST data | Revealed Owned by hacker and account creation command strings. |
8. Lessons Learned
Memory can be decisive
Event logs did not contain the full story. Memory preserved command history and web request fragments.
Web logs can reconstruct intent
Apache logs showed the attacker learning, testing, failing, and succeeding.
Negative evidence matters
No Prefetch, no malicious scheduled tasks, and missing event IDs helped narrow the likely attack path.
Correlation builds confidence
The strongest findings were supported by multiple independent sources.
9. Portfolio Value
This case demonstrates a practical DFIR workflow across several domains: Windows forensics, memory forensics, web application incident response, timeline reconstruction, IOC development, and professional reporting.
Skills suitable to highlight
- Performed Windows registry analysis using RegRipper and hivex.
- Parsed and interpreted Windows EVTX event logs.
- Used Volatility 2 for memory image analysis and process dumping.
- Recovered attacker command history from volatile memory.
- Analysed Apache logs to reconstruct web application exploitation.
- Identified and interpreted PHP web shells and reverse shell payloads.
- Correlated registry, logs, filesystem timestamps, and memory artefacts.
- Mapped attacker behaviour to MITRE ATT&CK techniques.
- Produced professional DFIR reporting artefacts suitable for publication.