Authentications SAM Artifacts

Key Points

• Purpose of SAM File: The Security Account Manager (SAM) file in Windows systems stores user accounts and security descriptors.

• Location: SAM file is located at C:\Windows\config\SAM.

• Structure: SAM file is a registry hive, containing keys and values.

• Digital Forensics Value: Provides detailed information about user accounts, crucial for tying a user to system activities.

Considerations

• Access to SAM File: Ensure proper permissions and methods are used to access and analyze the SAM file.

• Data Integrity: Maintain the integrity of the original SAM file to prevent contamination of evidence.

• Cryptographic Protection: Understand the cryptographic measures used in SAM to accurately interpret the data.

Detailed Explanation

Windows SAM: An Overview

Windows stores user accounts and security descriptors in the SAM file, a critical component of a system-defined database for configuration data storage and retrieval. This file plays a key role in authenticating local and remote users, ensuring system security against unauthenticated access.

Digital Forensics Value of User Accounts Artifacts

User Accounts artifacts are invaluable in forensic investigations to identify system users. This information includes:

• Username

• Full Name

• Privilege Level

• Login History (Successful and Failed Attempts)

Analyzing these artifacts helps in establishing a timeline and associating specific users with activities on the computer.

Location and Structure

• Location: C:\Windows\config\SAM

• SAM Hive Path: SAM\Domains\Accounts\Users

• Structure: The SAM file is a registry hive with keys and subkeys, viewable and editable through regedit.exe.

Analyzing with ArtiFast Windows

ArtiFast Windows facilitates the extraction and analysis of User Accounts artifacts from Windows machines.

Steps for Analysis

1. Accessing the File System:

   • You need physical or remote access to the file system of the Windows host.

   • If you have direct physical access, you might use a bootable USB drive with a forensics environment to access the file system without booting into Windows.

   • For remote access, you might use administrative shares or remote desktop with administrative privileges.

2. Locating the SAM File:

   • The SAM file is located in C:\Windows\System32\config\SAM on the target Windows system.

   • This file is locked by the operating system when Windows is running. To access it, you have to either boot from a different OS (like a forensics live USB) or use a tool that can read locked files.

   • Using Volume Shadow Copy:

     • If you cannot directly access the file due to it being in use, consider using the Volume Shadow Copy Service (VSS).

       • You can create a new shadow copy and access the SAM file from there. Tools like vssadmin can be used to create and manage shadow copies.

3. Extracting the SAM File:

   • Once you have access to the SAM file, you need to copy it to your analysis environment.

   • Make sure to follow proper evidence handling procedures to maintain the integrity of the data, like maintaining a chain of custody and using write blockers if working with physical drives.

4. Create a Case: Initialize your investigation with a new case.

5. Add Evidence: Include the SAM file as part of your evidence.

6. Artifact Selection: Choose User Accounts artifact for analysis.

   1. Review Artifacts: Utilize "Artifact View" or "Timeline View" for detailed examination.

User Accounts Artifact in ArtiFast

• Username: Account identifier.

• Full Name: User's full name.

• User Comment: Any comments associated with the user account.

• Profile Path: Location of the user's profile folder.

• Account Type: Category of the user account (e.g., admin, guest).

• Account Status: Current status (active, inactive, password requirements).

• Login Count: Frequency of user logins.

• Last Login Date/Time: Most recent login timestamp.

• Last Password Reset Date/Time: Timestamp of the last password reset.

• Last Password Failed Date/Time: Timestamp of the most recent failed login attempt.

• Logon Script: Scripts executed during user login.

• Last Write Date/Time: Timestamp of the last modification to the user's registry key.

Concluding Notes

Investigating User Accounts through the SAM file provides essential insights into user activities and system access patterns. This analysis is crucial for comprehensive digital forensics investigations in Windows environments.