Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/orlikoski/CDQR

The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted drives and extracted artifacts from Windows, Linux, MacOS, and Android devices
https://github.com/orlikoski/CDQR

Last synced: about 16 hours ago
JSON representation

Host: GitHub
URL: https://github.com/orlikoski/CDQR
Owner: orlikoski
License: gpl-3.0
Created: 2016-01-14T16:48:48.000Z (almost 9 years ago)
Default Branch: main
Last Pushed: 2022-06-25T16:20:38.000Z (over 2 years ago)
Last Synced: 2024-05-21T01:03:36.156Z (6 months ago)
Language: Python
Homepage:
Size: 70.7 MB
Stars: 328
Watchers: 30
Forks: 51
Open Issues: 5
Metadata Files:
- Readme: README.md
- License: LICENSE

Awesome Lists containing this project

Python-Security-Tool-Database - Cold Disk, Quick Response - CDQR is a disk parser and artifact collector. Their readme explains all. This is one of the few on my list that I've never personally used. I also couldn't easily set up a situation in order to use it effectively to test it, but it's been in a bunch of DFIR kits I've been around so I feel comfortable including it here. (Synopsis / Table of Contents)
awesome-hacking-lists - orlikoski/CDQR - The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted drives and extracted artifacts from Windows, Linux, MacOS, and Andr (Python)

README

## NAME

CDQR — Cold Disk Quick Response tool by Alan Orlikoski

For latest release click [here](https://github.com/orlikoski/CDQR/releases/latest)

## Please Read
[Open Letter to the users of Skadi, CyLR, and CDQR](https://docs.google.com/document/d/1L6CBvFd7d1Qf4IxSJSdkKMTdbBuWzSzUM3u_h5ZCegY/edit?usp=sharing)

## Videos and Media
* [OSDFCON 2017](http://www.osdfcon.org/presentations/2017/Asif-Matadar_Rapid-Incident-Response.pdf) Slides: Walk-through different techniques that are required to provide forensics results for Windows and *nix environments (Including CyLR and CDQR)

## What is CDQR?
The CDQR tool uses Plaso to parse forensic artifacts and/or disk images with specific parsers and create easy to analyze custom reports. The parsers were chosen based triaging best practices and the custom reports group like items together to make analysis easier. The design came from the Live Response Model of investigating the important artifacts first. This is meant to be a starting point for investigations, not the complete investigation.

In addition to processing entire forensic images it also parses extracted forensic artifact(s) as an individual file or collection of files inside of a folder structure (or inside a .zip file).

It creates up to 18 Reports (.csv files) based on triaging best practices and the parsing option selected
* 18 Reports for DATT:
```
Appcompat, Amcache, Bash, Event Logs, File System, MFT, UsnJrnl, Internet History, Prefetch, Registry, Scheduled Tasks, Persistence, System Information, AntiVirus, Firewall, Mac, Linux, and Android
```
* 14 Reports for Win:
```
Appcompat, Amcache, Bash, Event Logs, File System, MFT, UsnJrnl, Internet History, Prefetch, Registry, Scheduled Tasks, Persistence, System Information, AntiVirus, Firewall
```
* 8 Reports for Mac and Lin:
```
File System, Internet History, System Information, AntiVirus, Firewall, Mac, and Linux
```
* 7 Reports for Android:
```
File System, Internet History, Persistence, System Information, AntiVirus, Firewall, and Android
```

## Important Notes
* Make sure account has permissions to create files and directories when running (when in doubt, run as administrator)
* Ensure line endings are correct for the OS it is running on

## DESCRIPTION

This program uses [Plaso](https://github.com/log2timeline/plaso/wiki) and a streamlined list of its parsers to quickly analyze a forenisic image file (dd, E01, .vmdk, etc) or group of forensic artifacts. The results are output in either ElasticSearch, JSON (line delimited), or the following report files in CSV format:
* 18 Reports for DATT:
```
Appcompat, Amcache, Bash, Event Logs, File System, MFT, UsnJrnl, Internet History, Prefetch, Registry, Scheduled Tasks, Persistence, System Information, AntiVirus, Firewall, Mac, Linux, and Android
```
* 14 Reports for Win:
```
Appcompat, Amcache, Bash, Event Logs, File System, MFT, UsnJrnl, Internet History, Prefetch, Registry, Scheduled Tasks, Persistence, System Information, AntiVirus, Firewall
```
* 8 Reports for Mac and Lin:
```
File System, Internet History, System Information, AntiVirus, Firewall, Mac, and Linux
```
* 7 Reports for Android:
```
File System, Internet History, Persistence, System Information, AntiVirus, Firewall, and Android
```

## ARGUMENTS & OPTIONS
```
positional arguments:
src_location Source File location: Y:/Case/Tag009/sample.E01
dst_location Destination Folder location. If nothing is supplied
then the default is 'Results'

optional arguments:
-h, --help show this help message and exit
-p PARSER, --parser PARSER
Choose parser to use. If nothing chosen then 'win' is
used. The parsing options are: win, mft_usnjrnl, lin,
mac, datt
--nohash Do not hash all the files as part of the processing of
the image
--mft Process the MFT file (disabled by default except for
DATT)
--usnjrnl Process the USNJRNL file (disabled by default except
for DATT)
--max_cpu Use the maximum number of cpu cores to process the
image
--export Creates zipped, line delimited json export file
--artifact_filters ARTIFACT_FILTERS
Plaso passthrough: Names of forensic artifact
definitions, provided on the command command line
(comma separated). Forensic artifacts are stored in
.yaml files that are directly pulled from the artifact
definitions project. You can also specify a custom
artifacts yaml file (see
--custom_artifact_definitions). Artifact definitions
can be used to describe and quickly collect data of
interest, such as specific files or Windows Registry
keys.
--artifact_filters_file ARTIFACT_FILTERS_FILE
Plaso passthrough: Names of forensic artifact
definitions, provided in a file with one artifact name
per line. Forensic artifacts are stored in .yaml files
that are directly pulled from the artifact definitions
project. You can also specify a custom artifacts yaml
file (see --custom_artifact_definitions). Artifact
definitions can be used to describe and quickly
collect data of interest, such as specific files or
Windows Registry keys.
--artifact_definitions ARTIFACT_DEFINITIONS
Plaso passthrough: Path to a directory containing
artifact definitions, which are .yaml files. Artifact
definitions can be used to describe and quickly
collect data of interest, such as specific files or
Windows Registry keys.
--custom_artifact_definitions CUSTOM_ARTIFACT_DEFINITIONS
Plaso passthrough: Path to a file containing custom
artifact definitions, which are .yaml files. Artifact
definitions can be used to describe and quickly
collect data of interest, such as specific files or
Windows Registry keys.
--file_filter FILE_FILTER, -f FILE_FILTER
Plaso passthrough: List of files to include for
targeted collection of files to parse, one line per
file path, setup is /path|file - where each element
can contain either a variable set in the preprocessing
stage or a regular expression.
--es_kb ES_KB Outputs Kibana format to elasticsearch database.
Requires index name. Example: '--es_kb my_index'
--es_kb_server ES_KB_SERVER
Kibana Format Only: Exports to remote (default is
127.0.0.1) elasticsearch database. Requires Server
name or IP address Example: '--es_kb_server
myserver.elk.go' or '--es_kb_server 192.168.1.10'
--es_kb_port ES_KB_PORT
Kibana Format Only: Port (default is 9200) for remote
elasticsearch database. Requires port number Example:
'--es_kb_port 9200 '
--es_kb_user ES_KB_USER
Kibana Format Only: Username (default is none) for
remote elasticsearch database. Requires port number
Example: '--es_kb_user skadi '
--es_ts ES_TS Outputs TimeSketch format to elasticsearch database.
Requires index/timesketch name. Example: '--es_ts
my_name'
--plaso_db Process an existing Plaso DB file. Example:
artifacts.plaso
-z Indicates the input file is a zip file and needs to be
decompressed
--no_dependencies_check
Re-enables the log2timeline the dependencies check. It
is skipped by default
--process_archives Extract and inspect contents of archives found inside
of artifacts or disk images
-v, --version show program's version number and exit
-y Accepts all defaults on prompted questions in the
program.
```

## DEPENDENCIES

1. 64-bit Windows, Linux, or Mac Operating System (OS)
2. The appropriate version of Plaso for the OS https://github.com/log2timeline/plaso/releases
3. [Python v3.x](https://www.python.org/downloads/) (if using cdqr.py source code)

## EXAMPLES

```
cdqr.py c:\mydiskimage.vmdk myresults
```
```
cdqr.exe -p win c:\images\badlaptop.e01
```
```
cdqr.exe -p datt --max_cpu C:\artifacts\tag009
```
```
cdqr.exe -p datt --max_cpu C:\artifacts\tag009\$MFT --export
```
```
cdqr.exe -z --max_cpu C:\artifacts\tag009\artifacts.zip
```
```
cdqr.exe -z --max_cpu C:\artifacts\tag009\artifacts.zip --es myindexname
```

## AUTHOR

Alan Orlikoski
* [GitHub](https://github.com/orlikoski)
* [Twitter](https://twitter.com/AlanOrlikoski)