Adventures in the Underland: The CQForensic Toolkit as a Unique Weapon Against Hackers

## Overview

Paula Janusz (CEO of secure.com, Microsoft Regional Director) presented CQForensic Toolkit—an open-source collection of forensic analysis tools developed by their team. Core thesis: forensic investigation requires multiple specialized tools beyond standard Windows utilities; the team reverse-engineered Windows internals (particularly EVTX event log format and Data Protection API) to create tooling that corporate forensicists lack. Context: during penetration tests and incident response engagements, the team identified recurring forensic analysis needs (extracting hidden event logs, recovering deleted files, accessing cached remote sessions, decrypting encrypted credentials) and built a free toolkit addressing these gaps. Talk structured as live demonstrations of 6 major tools: EVTX recovery, prefetch parsing, service account password extraction, remote desktop cache visualization, file undelete, and MFT small-file recovery. Goal: enable security professionals to extract forensic evidence from Windows systems that attackers may attempt to hide.

## Technical Details and Forensic Capabilities

**EVTX (Event Log) Extraction and Repair**: Windows logs events to .evtx files, but files are frequently corrupted if power-lost or deliberately damaged during incident cleanup. The toolkit reverse-engineered the EVTX binary format (XML-based but with complex digitally-signed chunks) and built recovery tool that both repairs corrupted existing logs AND extracts unwritten event logs still residing in kernel memory. Technique: identify SVC host process (ID 848) that runs Windows event log service (wevtsvc.dll) via volatility plugin, dump process file handles, extract partial EVTX data from memory, rebuild consistent file structure using the custom CQForensicToolkit EVTX recovery utility. Result: recovers event entries that never made disk, providing invisible-to-standard-tools attack timeline evidence.

**Prefetch Analysis and Execution History**: Windows prefetch (.pf files) contain execution history of all processes since OS install—run counts, timestamps, loaded DLLs, accessed files. Unlike event logs (easily deleted), prefetch is harder to tamper with and survives even shift-delete. CQ Prefetch Parser tool extracts executable history: identify suspicious single-run count executables (suspicious because notepad or calc normally run many times if legitimately used), cross-reference against Windows indexing service, MFT journal, compatibility cache. Suspicious pattern: run_count==1 for executable without digital signature indicates possible attacker-deployed malware.

**Service Account Password Extraction**: Windows services (background processes) authenticate using service accounts stored in Registry Security hive at HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets. SecretDumper tool extracts plaintext passwords from this registry location by specifying service name. Forensic value: compromised service accounts reveal persistence mechanisms; attackers create scheduled tasks or new services with stolen credentials for backdoor access.

**Remote Desktop Cache Visualization**: RDP protocol transmits screen grids that are cached on client machine at C:\Users\<user>\AppData\Local\Microsoft\Terminal Server Client\Cache. CQForensicToolkit RDP cache reconstruction tool decompiles cached grids into visual snapshots—allowing forensicists to reconstruct session history (what appeared on screen, user actions). Unlike video recording, resolution is grid-based (pixelated), but sufficient to identify what windows/applications user accessed remotely, what data they viewed.

**File Undelete and MFT Recovery**: Most file recovery tools operate on unallocated disk space. CQForensicToolkit's undelete utility recovers files that weren't overwritten by leveraging MFT (Master File Table)—when files deleted via shift+delete or standard delete, their data persists in MFT as clear-text records up to ~700 bytes. Tool recovers these embedded file fragments even after disk overwrite operations, reconstructing original filenames and partial content.

## Forensic Implications and Defense Strategy

**Invisible Attack Evidence**: Attackers routinely delete event logs (clearing audit trails) or use disk-wiping tools (EricaII, CCleaner) to destroy forensic evidence. Standard Windows Event Viewer shows only active logs; memory-resident unwritten events remain invisible. Toolkit reveals this invisible timeline—granting defenders evidence that attack occurred even when attacker cleared disk artifacts.

**Service Account Exploitation**: Service account passwords stored in registry represent critical persistence mechanism; attackers often steal these during lateral movement to maintain access as trusted system components. Example: if compromised service account is SQL Server service account, attacker can schedule background tasks as SQL Server (trusted, not flagged), extracting data or deploying malware without triggering application-level alerts.

**RDP Session Reconstruction**: RDP is common attack vector for lateral movement; reconstructing cached sessions reveals what sensitive data attacker viewed remotely (financial systems, employee records, source code repositories). Forensic investigators can prove exfiltration intent by demonstrating attacker accessed high-value data shares before networks breached.

**Organizational Implications**: Enterprise forensics tool gap between attacker sophistication and defender tooling; most IR teams rely on commercial suites or vendor-specific tools, missing custom forensic capabilities developed by offensive-minded researchers. Open-source toolkit democratizes forensic analysis—enabling smaller organizations and under-resourced IR teams to conduct thorough investigations matching commercial competitor analysis. Training consideration: forensics requires both technical Windows internals knowledge (registry hives, MFT structure, memory layout) and reverse-engineering capability to understand hidden data formats.

**Ethical Perspective**: Paula emphasized social engineering component of security—her Swiss penetration test story (tailgating into building, exploiting social dynamics to gain physical access) demonstrated that technical controls insufficient without human-behavior understanding. Applies to digital forensics: attackers focus on destroying evidence (logs, files); defenders must maintain multiple independent evidence sources (event logs, prefetch, cache, MFT, memory snapshots) and cross-reference to build trustworthy timeline resistant to attacker manipulation.