プロセス列挙

2664	2632	explorer.exe	0xfa8001189b30	19	632	2	False	2019-12-14 10:36:29.000000 	N/A
* 2792	2664	VBoxTray.exe	0xfa8001189b30	12	139	2	False	2019-12-14 10:36:30.000000 	N/A
* 2096	2664	cmd.exe	0xfa8001189b30	1	19	2	False	2019-12-14 10:36:35.000000 	N/A
* 2296	2664	chrome.exe	0xfa8001189b30	27	658	2	False	2019-12-14 10:36:45.000000 	N/A
** 2304	2296	chrome.exe	0xfa8001189b30	8	71	2	False	2019-12-14 10:36:45.000000 	N/A
** 1632	2296	chrome.exe	0xfa8001189b30	14	219	2	False	2019-12-14 10:37:12.000000 	N/A
** 2476	2296	chrome.exe	0xfa8001189b30	2	55	2	False	2019-12-14 10:36:46.000000 	N/A
** 2572	2296	chrome.exe	0xfa8001189b30	8	177	2	False	2019-12-14 10:36:56.000000 	N/A
** 2964	2296	chrome.exe	0xfa8001189b30	13	295	2	False	2019-12-14 10:36:47.000000 	N/A
3260	3180	notepad.exe	0xfa8001189b30	1	61	1	False	2019-12-14 10:38:20.000000 	N/A

chromeが気になる

ファイル「History」をダンプする

# python3 vol.py -f MemoryDump_Lab2.raw windows.filescan | grep -i history

0x3ec63a70 100.0\Users\Alissa Simpson\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat	216
0x3fa0fb60	\Users\Alissa Simpson\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat	216
0x3fa27920	\Users\Alissa Simpson\AppData\Local\Microsoft\Windows\History\desktop.ini	216
0x3fa3e430	\Users\SmartNet\AppData\Local\Google\Chrome\User Data\Default\History-journal	216
0x3fa6e660	\Users\Alissa Simpson\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019121420191215\index.dat	216
0x3fb249a0	\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat	216
0x3fb28380	\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat	216
0x3fcfb1d0	\Users\SmartNet\AppData\Local\Google\Chrome\User Data\Default\History	216
0x3fd4a670	\Users\SmartNet\AppData\Local\Google\Chrome\User Data\Default\History-journal	216
0x3fd967e0	\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\MpSfc.bin	216
0x3fdae3b0	\Users\Alissa Simpson\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019121420191215\index.dat	216

下から４つめ

python3 vol.py -f MemoryDump_Lab2.raw windows.dumpfiles --physaddr 0x3fcfb1d0

Sqlite

sqlite3 file.0x3fcfb1d0.0xfa8000efd1d0.DataSectionObject.History.dat

sqlite> SELECT datetime((visits.visit_time/1000000)-11644473600,'unixepoch','localtime') as 'date', urls.url as 'url', urls.title as 'title', urls.visit_count as 'count' FROM visits,urls WHERE urls.id = visits.url;
2019-12-14 18:16:05|https://chrome.google.com/webstore?hl=en|Chrome Web Store - Extensions|1
2019-12-14 18:16:08|https://chrome.google.com/webstore/category/extensions?hl=en|Chrome Web Store - Extensions|1
2019-12-14 18:16:12|https://www.google.com/|Google|2
2019-12-14 18:16:14|https://www.google.com/|Google|2
2019-12-14 18:16:18|http://bing.com/|Bing|1
2019-12-14 18:16:18|https://bing.com/|Bing|1
2019-12-14 18:16:18|https://www.bing.com/?toWww=1&redig=2BBD701F84AA44D2A71D870534D085AE|Bing|1
2019-12-14 18:16:32|https://www.facebook.com/|Facebook – log in or sign up|3
2019-12-14 18:16:47|https://www.facebook.com/|Facebook – log in or sign up|3
2019-12-14 18:27:31|http://volatilevirus.home.blog/|Abhiram's Blog – Dying Is The Day Worth Living For!!|1
2019-12-14 18:27:31|https://volatilevirus.home.blog/|Abhiram's Blog – Dying Is The Day Worth Living For!!|1
2019-12-14 18:29:17|http://r3xnation.wordpress.com/|R3xNation – Free Flowing passions|1
2019-12-14 18:29:17|https://r3xnation.wordpress.com/|R3xNation – Free Flowing passions|1
2019-12-14 18:29:33|http://ashutosh1206.github.io/|Home | Ashutosh|1
2019-12-14 18:29:33|https://ashutosh1206.github.io/|Home | Ashutosh|1
2019-12-14 18:29:37|https://www.onlinesbi.com/|State Bank of India|1
2019-12-14 18:30:08|https://www.india.com/|Latest India News, Breaking News, Entertainment News | India.com News|1
2019-12-14 18:30:43|https://ashutosh1206.github.io/writeups/|Writeups | Ashutosh|1
2019-12-14 18:30:46|https://volatilevirus.home.blog/blog-posts/|Blog Posts – Abhiram's Blog|1
2019-12-14 18:30:55|http://bbc.com/|BBC - Homepage|1
2019-12-14 18:30:55|https://bbc.com/|BBC - Homepage|1
2019-12-14 18:30:55|https://www.bbc.com/|BBC - Homepage|1
2019-12-14 18:31:35|https://www.bbc.com/sport/football/50780855|Jurgen Klopp signs new Liverpool deal until 2024 - BBC Sport|1
2019-12-14 18:32:52|https://www.google.com/|Google|2
2019-12-14 18:32:53|https://chrome.google.com/webstore/category/extensions?hl=en|Chrome Web Store - Extensions|1
2019-12-14 18:33:00|https://www.bing.com/?toWww=1&redig=2BBD701F84AA44D2A71D870534D085AE|Bing|1
2019-12-14 18:33:05|https://www.facebook.com/|Facebook – log in or sign up|3
2019-12-14 18:33:12|https://www.facebook.com/common/referer_frame.php||1
2019-12-14 18:33:15|https://www.facebook.com/|Facebook – log in or sign up|3
2019-12-14 18:33:25|http://yahoo.in/|Yahoo India | News, Finance, Cricket, Lifestyle and Entertainment|1
2019-12-14 18:33:25|http://in.yahoo.com/|Yahoo India | News, Finance, Cricket, Lifestyle and Entertainment|1
2019-12-14 18:33:25|https://in.yahoo.com/|Yahoo India | News, Finance, Cricket, Lifestyle and Entertainment|2
2019-12-14 18:33:32|https://in.yahoo.com/|Yahoo India | News, Finance, Cricket, Lifestyle and Entertainment|2
2019-12-14 18:33:53|https://www.youtube.com/|YouTube|1
2019-12-14 18:38:17|https://r3xnation.wordpress.com/about/|About – R3xNation|1
2019-12-14 18:41:52|http://blog.bi0s.in/|bi0s|1
2019-12-14 18:41:52|https://blog.bi0s.in/|bi0s|1
2019-12-14 19:04:59|https://www.youtube.com/|YouTube|1
2019-12-14 19:07:31|https://r3xnation.wordpress.com/about/|About – R3xNation|1
2019-12-14 19:07:32|https://ashutosh1206.github.io/writeups/|Writeups | Ashutosh|1
2019-12-14 19:07:35|https://volatilevirus.home.blog/blog-posts/|Blog Posts – Abhiram's Blog|1
2019-12-14 19:18:09|http://ndtv.com/|NDTV: Latest News, India News, Breaking News, Business, Bollywood, Cricket, Videos & Photos|1
2019-12-14 19:18:09|https://www.ndtv.com/|NDTV: Latest News, India News, Breaking News, Business, Bollywood, Cricket, Videos & Photos|1
2019-12-14 19:18:12|https://blog.bi0s.in/|bi0s|1
2019-12-14 19:21:38|https://mega.nz/#F!TrgSQQTS!H0ZrUzF0B-ZKNM3y9E76lg|MEGA|2
2019-12-14 19:21:39|https://mega.nz/#F!TrgSQQTS!H0ZrUzF0B-ZKNM3y9E76lg|MEGA|2
2019-12-14 19:37:11|http://bi0s.in/|Amrita Bios|1
2019-12-14 19:37:11|https://bi0s.in/|Amrita Bios|1

下から３行目にアクセス
https://mega.nz/#F!TrgSQQTS!H0ZrUzF0B-ZKNM3y9E76lg

ネットからファイルが取れた！

が，パスワードがかかってるw